Join waitlist

All comparisons

PlusPanel vs CyberPanel

A control panel for websites, email and backups. CyberPanel with OpenLiteSpeed is free and open source; premium add-ons and hosted services are optional purchases.1 CyberPanel's core is free and runs on your server. PlusPanel has a free tier too; on Pro you pay for the parts you would otherwise run yourself: the OS, its updates, isolation and the fleet view.

The 3 structural differences

Architecture

CyberPanel: Installed on each server with an install script; the panel runs on that server2 · Panel and API reached over HTTPS on port 8090 of the server (https://<ip>:8090)3

PlusPanel: A control plane in our EU cloud commands a minimal agent on each server. The server exposes no management port: the agent connects outbound over mTLS inside WireGuard and runs only typed, signed, expiring commands.

Licensing

CyberPanel: Core panel free and open source (GPLv3); optional paid add-ons licensed per server IP4 · Core USD 0; all 6 add-ons USD 59/year or USD 169 lifetime per server (as of 2026-10-10)4

PlusPanel: Per server, with unlimited accounts and domains: Free for one server, Pro €19/server/month, founding customers €9 locked for life.

Jurisdiction & security model

CyberPanel: CyberPersons LLC, Escondido, California, United States (privacy policy)5 · firewalld rules and ModSecurity WAF (OWASP rules) managed from the panel6

PlusPanel: 2Lines Sistem, Romania (EU). The OS is a signed image we maintain, with atomic rollback; WAF, firewall, country blocking and 2FA are included at GA, with no add-on licences.

Side by side

AxisPlusPanelCyberPanel
Licensing modelPer server; unlimited accounts and domainsCore panel free and open source (GPLv3); optional paid add-ons licensed per server IP4
ArchitectureEU SaaS control plane + minimal agent on each serverInstalled on each server with an install script; the panel runs on that server2
Inbound management portsNone: the agent connects outbound (mTLS inside WireGuard)Panel and API reached over HTTPS on port 8090 of the server (https://<ip>:8090)3
OS modelPlusPanel OS: immutable signed image, atomic updates with rollback, maintained by usInstalls on Ubuntu 20.04-24.04, AlmaLinux 8-10, Rocky/RHEL 8-9, CloudLinux 8, CentOS 92
Account isolationRootless containers per account, user namespaces, SELinux MCS, kernel quotasSeparate users, site ownership, ACLs, document roots and OpenLiteSpeed resource controls7
Email deliverabilityManaged relay with IP pools over WireGuard (at GA)Local Postfix/Dovecot; vendor's CyberMail delivery service offered separately4
Security includedWAF, firewall, country blocking, 2FA included (at GA); no add-on licencesfirewalld rules and ModSecurity WAF (OWASP rules) managed from the panel6
Company jurisdiction2Lines Sistem, Romania (EU)CyberPersons LLC, Escondido, California, United States (privacy policy)5
Migration toolingMigration Center from cPanel/WHM, free in every edition (at GA)Command-line importer for cPanel backup archives (v1.8.5 and later)8
Entry priceFree (1 server) · Pro €19/server/month · founding €9 locked for lifeCore USD 0; all 6 add-ons USD 59/year or USD 169 lifetime per server (as of 2026-10-10)4

PlusPanel cells marked “at GA” describe v1.0; everything else runs today.

Security advisories

How fixes reach servers is a structural difference, so here are the CyberPanel advisories recorded in NVD and CISA's catalog, quoted as published, and how PlusPanel ships fixes.

CyberPanel advisories

CVE-2024-51567
NVD: upgrademysqlstatus in databases/views.py in CyberPanel before commit 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus; NVD records exploitation in the wild in October 2024 by PSAUX. Affected: versions through 2.3.6 and unpatched 2.3.7 (NVD configuration: up to, excluding, 2.3.8). CVSS 3.1 base score 9.8 Critical (NIST) and 10.0 Critical (CNA: MITRE). NVD published 2024-10-29 (UTC).9
CVE-2024-51568
NVD: CyberPanel before 2.3.5 allows command injection via completePath in the ProcessUtilities.outputExecutioner() sink; /filemanager/upload (File Manager upload) unauthenticated remote code execution via shell metacharacters. Affected: versions before 2.3.5. CVSS 3.1 base score 9.8 Critical (NIST) and 10.0 Critical (CNA: MITRE). NVD published 2024-10-29 (UTC).10
CVE-2024-51378
NVD: getresetstatus in dns/views.py and ftp/views.py in CyberPanel before commit 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus; NVD records exploitation in the wild in October 2024 by PSAUX. Affected: versions through 2.3.6 and unpatched 2.3.7 (NVD configuration: up to, excluding, 2.3.8). CVSS 3.1 base score 9.8 Critical (NIST) and 10.0 Critical (CNA: MITRE). NVD published 2024-10-29 (UTC).11
CISA KEV
CISA's Known Exploited Vulnerabilities catalog lists CVE-2024-51567 (added 2024-11-07) and CVE-2024-51378 (added 2024-12-04), both with known ransomware campaign use marked "Known". CVE-2024-51568 is not listed (catalog version 2026.10.08).12
Vendor security notice
On 2024-10-29 CyberPanel published a notice stating that a security patch had been released and directing users to update the panel.13

How PlusPanel ships fixes

  • Fixes ship as a new signed OS image: rebuilt, scanned (Trivy), signed (cosign)
  • Measured on the demo server: apply 44 s, rollback 28 s
  • Rollout in waves with health gates, stopping before production on failure (at GA)
  • The agent accepts only typed, signed jobs; the server exposes no management port

Facts worth knowing

License
The CyberPanel source repository is licensed under the GNU General Public License v3.0.14
Web server
CyberPanel ships with OpenLiteSpeed; CyberPanel Enterprise runs LiteSpeed Web Server Enterprise, free for one domain and licensed for more.15
Paid add-ons
Premium add-ons (SSL V2, WordPress Manager Pro, Backup V2, Email Debugger, Root File Manager, Rspamd Manager) cost USD 59/year or USD 169 lifetime, licensed per server IP; the .htaccess Module is a separate product at USD 59/year or USD 199 lifetime (as of 2026-10-10; VAT not stated).4
Server-to-server transfer
Remote Transfer moves accounts from a remote CyberPanel installation to a local one.16
Imunify360
Imunify360 integration requires converting the OS to CloudLinux with CageFS and entering an Imunify360 key.17
History
CyberPanel was started in 2017 by Usman Nasir (Founder & Lead Developer) as a control panel for OpenLiteSpeed.18
Install base (vendor-stated)
The vendor states 500K+ servers, 2M+ downloads and 180+ countries.4

Questions

CyberPanel is free. Why pay?

PlusPanel has a free tier as well: one server, forever. On Pro (€19/server) you pay for OS maintenance with atomic rollback, signed updates across the fleet, container isolation per account, and support.

How does PlusPanel ship security fixes?

As a new signed OS image: rebuilt, scanned and signed, then rolled out in waves with health gates (at GA), and rolled back in one command if it misbehaves. The agent accepts only typed, signed commands, never shell input, and the server has no management port to attack.

Can I import from CyberPanel?

Not at GA: Migration Center starts with cPanel/WHM. If you need a migration from CyberPanel, say so when you join the waitlist; it decides what we build next.

No trademark page published; site footer reads "© 2026 CyberPanel" and the privacy policy names CyberPersons LLC as the Company5 PlusPanel is not affiliated with, endorsed by or sponsored by CyberPanel's owner. Names are used nominatively, for comparison only.

Sources

Every CyberPanel fact on this page is quoted from an official CyberPanel page or document, verified on the date shown in its footnote. Prices change: check the source before you decide. We re-verify these pages every quarter.

  1. https://cyberpanel.net/ · verified 2026-10-10
  2. https://github.com/usmannasir/cyberpanel · verified 2026-10-10
  3. https://cyberpanel.net/KnowledgeBase/home/how-to-enable-api-access-in-cyberpanel/ · verified 2026-10-10
  4. https://cyberpanel.net/cyberpanel-addons · verified 2026-10-10
  5. https://cyberpanel.net/privacy-policy · verified 2026-10-10
  6. https://cyberpanel.net/firewall-management · verified 2026-10-10
  7. https://cyberpanel.net/blog/isolate-website-directory · verified 2026-10-10
  8. https://cyberpanel.net/KnowledgeBase/home/auto-import-cpanel-sites-to-cyberpanel/ · verified 2026-10-10
  9. https://nvd.nist.gov/vuln/detail/CVE-2024-51567 · verified 2026-10-10
  10. https://nvd.nist.gov/vuln/detail/CVE-2024-51568 · verified 2026-10-10
  11. https://nvd.nist.gov/vuln/detail/CVE-2024-51378 · verified 2026-10-10
  12. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json · verified 2026-10-10
  13. https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel · verified 2026-10-10
  14. https://github.com/usmannasir/cyberpanel/blob/stable/LICENSE · verified 2026-10-10
  15. https://cyberpanel.net/KnowledgeBase/home/install-cyberpanel/ · verified 2026-10-10
  16. https://cyberpanel.net/KnowledgeBase/home/3-remote-transfer/ · verified 2026-10-10
  17. https://cyberpanel.net/KnowledgeBase/home/how-to-install-and-use-imunify360-on-cyberpanel/ · verified 2026-10-10
  18. https://cyberpanel.net/about-us · verified 2026-10-10

Lock €9/month per server, for life.

No spam. One email when founding opens, one at GA.