License & Deployment Mix: 13 tools – 7 OSS, 6 commercial; all self-hosted (no SaaS).
Control panels are the GUI / admin layer that sits on top of a Linux web-hosting server and manages every account-scoped resource: websites, email accounts, DNS zones, MySQL/MariaDB databases, FTP/SFTP, SSL certificates, subdomains, cron jobs, file storage. They are how shared hosting providers (and many small managed-hosting companies) deliver per-customer self-service.
This is a different category from web-servers/servers/ (the HTTP server software like nginx or Apache), web-servers/hosting/ (managed website-builder services like Wix and Vercel), and web-servers/cms/ (content management systems). A control panel is the operator-facing software a hosting company runs to give its end-users a self-service UI; it bundles a stack of underlying services (Apache/LiteSpeed, Exim/Postfix, Dovecot, BIND/ PowerDNS, MySQL, Pure-FTPd, etc.) behind a single web admin.
What Control Panels Do
A control panel typically covers all of:
- Web server config – create vhosts; manage document roots, PHP versions, redirects
- Email – create mailboxes, aliases, forwarders; manage SPF/DKIM/DMARC; spam/AV
- DNS – per-domain zone management (A, AAAA, CNAME, MX, TXT, SRV); often with one-click templates for new domains
- Databases – create MySQL/MariaDB databases and users; phpMyAdmin / Adminer
- File management – web-based file manager, FTP/SFTP user management
- TLS – Let’s Encrypt automation; custom cert upload
- Backups – per-account or per-server backup jobs to local/S3/remote
- Account provisioning – the reseller / WHM layer that creates and limits hosting accounts with quotas and feature gates
- Statistics – bandwidth, disk, CPU, hits
The control panel itself is not the hosting; it orchestrates the hosting stack.
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Cross-tool comparison tables for the control panels in this category.
The information below is point-in-time and captured from each project’s documentation / website at the time of writing; treat it as a shopping-aid summary, not a contract. Per-tool evaluations (where present) are the authoritative source for licensing/pricing specifics.
1. License and Cost Model
| Tool | License | Cost model |
|---|---|---|
| cPanel + WHM | Proprietary | Per-account tiers (Solo / Admin / Pro / Premier / Premier 1000+); priced annually per server; per-account costs scale up |
| Plesk | Proprietary | Per-server tiers (Web Admin / Pro / Host); add-ons priced separately; available via cloud-marketplace BYOL |
| DirectAdmin | Proprietary | Per-server tiers (Personal / Lite / Standard / Premium); much cheaper than cPanel/Plesk |
| InterWorx | Proprietary | Per-server tier; one tier with optional add-ons |
| CyberPanel | OSS (GPL) + commercial Enterprise | Free OSS edition; Enterprise add-ons paid |
| HestiaCP | OSS (GPL-3) | Free; donations |
| ISPConfig | OSS (BSD) | Free; commercial support contracts available |
| Webmin / Virtualmin | OSS (BSD) + Pro | Free OSS Virtualmin GPL; Virtualmin Pro is paid |
| aaPanel | OSS (Apache) + Pro | Free OSS edition; aaPanel Pro paid |
| CloudPanel | OSS (MIT) | Free |
| Froxlor | OSS (GPL-2) | Free |
| KeyHelp | Free + commercial extensions | Free core; paid add-ons (KeyAddons) |
| ISPmanager | Proprietary (with limited free tier) | Per-server tiers |
2. OS Support
| Tool | Linux | Windows | BSD |
|---|---|---|---|
| cPanel + WHM | AlmaLinux / Rocky / RHEL / CloudLinux (only) | No | No |
| Plesk | Multi-distro Linux (Ubuntu, Debian, AlmaLinux, etc.) | Yes – Windows Server | No |
| DirectAdmin | RHEL family, Debian, Ubuntu | No | FreeBSD |
| InterWorx | RHEL family | No | No |
| CyberPanel | AlmaLinux / RHEL / Ubuntu | No | No |
| HestiaCP | Debian / Ubuntu | No | No |
| ISPConfig | Debian / Ubuntu / RHEL family | No | No |
| Webmin / Virtualmin | Most Linux | Limited | Some BSD support |
| aaPanel | CentOS / Ubuntu / Debian | No | No |
| CloudPanel | Debian / Ubuntu | No | No |
| Froxlor | Debian / Ubuntu / RHEL family | No | No |
| KeyHelp | Debian / Ubuntu | No | No |
| ISPmanager | RHEL family / Debian / Ubuntu | No | No |
3. Bundled Service Stack (defaults)
What the control panel installs and manages out of the box. Most are swappable to a degree.
| Tool | HTTP | Mail (SMTP/IMAP) | DNS | DB |
|---|---|---|---|---|
| cPanel + WHM | Apache + LiteSpeed (paid) | Exim + Dovecot | BIND or PowerDNS | MySQL / MariaDB |
| Plesk | Apache + nginx (proxy) / IIS on Windows | Postfix + Courier/Dovecot / MailEnable on Windows | BIND / Microsoft DNS | MySQL / MariaDB / MS SQL |
| DirectAdmin | Apache or LiteSpeed or OpenLiteSpeed or nginx | Exim + Dovecot | BIND | MySQL / MariaDB |
| InterWorx | Apache + nginx | qmail / Dovecot | BIND | MySQL / MariaDB |
| CyberPanel | OpenLiteSpeed / LiteSpeed | Postfix + Dovecot | PowerDNS | MariaDB |
| HestiaCP | Apache + nginx (proxy) | Exim + Dovecot | BIND | MySQL / MariaDB |
| ISPConfig | Apache or nginx | Postfix + Dovecot | BIND or PowerDNS | MySQL / MariaDB |
| Webmin / Virtualmin | Apache or nginx | Postfix + Dovecot | BIND | MySQL / MariaDB / PostgreSQL |
| aaPanel | OpenLiteSpeed / Nginx / Apache | Postfix + Dovecot (optional) | DNSmasq / BIND | MySQL / MariaDB |
| CloudPanel | Nginx | (No bundled mail; relay-only) | Cloudflare-friendly; no bundled DNS server | MySQL / MariaDB |
| Froxlor | Apache or nginx or LiteSpeed | Postfix + Dovecot | BIND or PowerDNS | MySQL / MariaDB |
| KeyHelp | Apache + nginx | Postfix + Dovecot | BIND | MySQL / MariaDB |
| ISPmanager | Apache or nginx | Exim + Dovecot | BIND | MySQL / MariaDB / PostgreSQL |
4. Multi-Server / Clustering
Many control panels are single-box; some support distributing services across multiple servers (e.g., separate mail server, separate DB server).
| Tool | Multi-server | Notes |
|---|---|---|
| cPanel + WHM | Limited (DNS clusters; remote MySQL) | Not a cluster product per se |
| Plesk | Yes (Plesk Multi-Server) | Distributes mail / web / DNS / DB |
| DirectAdmin | Yes (Multi-Server) | DNS, MySQL, mail can be remote |
| InterWorx | Yes (cluster of NodeWorx) | Built around clustering from day 1 |
| CyberPanel | Limited (slave nodes) | Best as single-box |
| HestiaCP | No | Single-server |
| ISPConfig | Yes (mature multi-server) | Strong suit; one master, many slaves |
| Webmin / Virtualmin | Yes (Cloudmin add-on) | Manages multiple Virtualmin nodes |
| aaPanel | Limited | Single-box favoured |
| CloudPanel | No | Single-server |
| Froxlor | Limited | Single-server favoured |
| KeyHelp | No | Single-server |
| ISPmanager | Yes (Cluster edition) | Separately licensed |
5. SSO / OIDC / LDAP
How well the panel integrates with external identity providers like Authentik. This is a sore spot across the category – shared-hosting control panels historically assume their own user database.
| Tool | OIDC | SAML | LDAP | Notes |
|---|---|---|---|---|
| cPanel + WHM | No (native) | No | Yes (LDAP auth via PAM) | Third-party SSO via reverse-proxy + custom auth modules |
| Plesk | Limited | Limited | Yes | Plesk SSO extension exists; OIDC via add-on |
| DirectAdmin | No | No | Yes | LDAP-only out of the box |
| InterWorx | No | No | Yes | LDAP-only |
| CyberPanel | No | No | No | Local users only |
| HestiaCP | No | No | No | Local users only |
| ISPConfig | No | No | LDAP support | Mostly local |
| Webmin / Virtualmin | No | No | Yes | LDAP and PAM |
| aaPanel | No | No | No | Local users only |
| CloudPanel | No | No | No | Local users only |
| Froxlor | No | No | No | Local users only |
| KeyHelp | No | No | No | Local users only |
| ISPmanager | No | No | Yes | LDAP via add-on |
For Authentik integration, the practical pattern across this category is Authentik forward-auth in front of the control panel’s admin URL – the panel sees an authenticated header from Authentik and trusts it (where supported), or you put Authentik in front to gate access without trying to make the panel itself OIDC-aware.
6. API / Automation
| Tool | API | CLI | Infrastructure-as-code |
|---|---|---|---|
| cPanel + WHM | UAPI / WHM API 1 (REST/JSON) | Yes (whmapi1, uapi) | Limited; some Terraform community providers |
| Plesk | XML-RPC + REST | Yes (plesk CLI) | Plesk Onyx CLI; Terraform community |
| DirectAdmin | API (HTTP) | Yes | Limited |
| InterWorx | API (XML-RPC + REST) | Yes | Limited |
| CyberPanel | REST API | Yes (cyberpanel) | Limited |
| HestiaCP | Bash API (HTTP) | Yes (v-* commands) | Ansible roles common |
| ISPConfig | SOAP + REMOTE API | Yes | Ansible roles available |
| Webmin / Virtualmin | XML-RPC | Yes (virtualmin) | Limited |
| aaPanel | REST API | Yes | Limited |
| CloudPanel | CLI-only (no HTTP API at time of writing) | Yes (clpctl) | Limited |
| Froxlor | API | Yes | Limited |
| KeyHelp | API (paid) | Yes | Limited |
| ISPmanager | REST API | Yes | Limited |
8. Security Track Record (high-level)
The control-panel category has a non-trivial history of high-impact CVEs because each panel is, by design, an unauthenticated-internet-facing admin surface for an entire server. Recent notable incident:
- CVE-2026-41940 (cPanel + WHM) – unauthenticated remote auth-bypass; actively exploited within 24h of disclosure (Mirai variants, “Sorry” ransomware, AdapdixC2); ~44k compromised IPs by 2026-04-30 (Shadowserver). Affected customers’ DNS zones, mail accounts, and websites all fell under attacker control simultaneously.
This is the recurring failure mode for the category: a panel compromise is a server-compromise that includes DNS, mail, and web for every account on it. Patch windows must be hours, not weeks.
Per-Tool Evaluations
| Tool | File |
|---|---|
| cPanel + WHM | cpanel.md |
| Plesk | plesk.md |
| DirectAdmin | directadmin.md |
| InterWorx | interworx.md |
| ISPmanager | ispmanager.md |
| KeyHelp | keyhelp.md |
| CyberPanel | cyberpanel.md |
| HestiaCP | hestiacp.md |
| ISPConfig | ispconfig.md |
| Virtualmin (Webmin) | virtualmin.md |
| aaPanel | aapanel.md |
| CloudPanel | cloudpanel.md |
| Froxlor | froxlor.md |
See Also
- README.md – conceptual overview and tool index
- ../README.md – parent Web Servers & Hosting category
Tools
13 tools.
aaPanel
aaPanel is the international (English-language) release of the Chinese-market panel bt.cn (BaoTa Panel), one of the most widely deployed control panels in Asia.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
CloudPanel
CloudPanel is a relatively new (2020s) open-source control panel from German vendor MGT-COMMERCE, distinguished by its design for cloud VMs – AWS, GCP, Azure, Hetzner, DigitalOcean, Vultr, Linode – rather than traditional bare-metal s…
License: MIT (OSS) · Kind: web · Deploy: native · SSO: none
cPanel + WHM
cPanel + WHM is a proprietary web hosting control panel widely used in shared hosting, orchestrating Apache, Exim, Dovecot, DNS, and MySQL via per-account (cPanel) and server-admin (WHM) interfaces.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
CyberPanel
CyberPanel is the most prominent open-source control panel built around the LiteSpeed web server.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
DirectAdmin
DirectAdmin is the third major commercial web hosting control panel, positioned as a faster, lighter, cheaper alternative to cPanel and Plesk.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Froxlor
Froxlor is a lightweight, German-origin open-source control panel that descends from the older SysCP project. Its design philosophy is “minimal by default, manage the underlying configs yourself when you need to”.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none
HestiaCP
HestiaCP is an open-source web hosting control panel forked from VestaCP, designed to manage web servers, DNS, mail, databases, and FTP from a single web interface.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
InterWorx
InterWorx is a niche commercial control panel distinguished by its clustered hosting design from day one.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
ISPConfig
ISPConfig is the longest-running mature open-source control panel and the one most often described as “commercial-quality without the price”. The project started in 2005 in Germany and has been continuously maintained since.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: native · SSO: none
ISPmanager
ISPmanager is a commercial control panel from ISPsystem, widely used in Eastern Europe, Russia, and parts of Asia. It is largely unknown in the North American hosting market but holds significant share in its home regions.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
KeyHelp
KeyHelp is a German web hosting control panel from Keyweb AG (a German hosting provider) that they have made available for free use beyond their own customer base.
License: LicenseRef-KeyHelp (source-available) · Kind: web · Deploy: native · SSO: none
Plesk
Plesk is the second-dominant commercial web hosting control panel and the only major panel that runs on both Linux and Windows Server.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: OIDC
Virtualmin (with Webmin)
Webmin is the longest-running open-source Unix administration interface, started by Jamie Cameron in 1997.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
