Measured on real systems
The blog
How to turn a control panel into a product: billing, provisioning and the measured traps behind 14 hosting and game-server panels.
- Written from measured behaviour, not from documentation
- Every claim about another vendor carries its source
- Nothing here sits behind a signup form
- 122
- Articles
- 23
- Platforms
- 9
- Languages
Virtualization
- A boundary belongs in the coreRevoking a hosted agent detached it from its order and left a running Proxmox machine nobody could reach and everybody kept paying for.Read the article
- A tag that half the corpus carriesOne tag sat on 75 of 127 articles, so the related block fell back to the publication date and 71 pages received no incoming tile at all.Read the article
- The verb four words awayChanging one Dutch pronoun rewrites verbs it never touches. A table of 84 words that exits on anything it does not know, and agreement four words away.Read the article
- A capability word for an old commandWhen a round adds a protobuf field, an old agent fails loudly. When it only changes what a flag means, the same agent answers plausibly and is wrong.Read the article
- A name that cannot be translatedNine languages said nine different things about one foreign key clause. Eight of them were correct translations, and that was the whole problem.Read the article
- A null that fell through the sieveEvery real container reported that its backup coverage could not be established. The config was read fine. The wire said null and the schema said absent.Read the article
- A vague plural is not a numberA guard comparing numbers across nine languages reported two defects that were not defects, and passed two languages for reasons unrelated to numbers.Read the article
- A badge that set a cookie on every pageOne image in the footer cost twenty two Lighthouse points across the site. The fix was not removing it, and the interesting part is what a proxy must refuse.Read the article
- A bar narrower than its windowA header collapsed on window width while a sidebar ate a third of it, and the language that overflowed by zero pixels was the one that was actually broken.Read the article
- A conversion script that ran too wideA typography script curled an apostrophe inside a quotation of program output in an article it never should have touched. Every check stayed green.Read the article
- A join instead of a reconcileAn automation step froze on the status it saw. The fix was not a worker that repairs the row: that row explains a decision, and repairing it destroys it.Read the article
- A pause that held the order openA wait inside a flow kept the order request open for its whole duration. The fix was a threshold rather than a checkbox, and the number was measured.Read the article
- A run that printed its own failureThe verification run wrote every exit code to a summary and then wrote DONE regardless. A release went out over a red line nobody read. What a gate has to be.Read the article
- A scan that closed its own tickEvery successful scheduled scan marked its own slot as expired, over one word from the wrong enum. Two defects only a real agent and a real feed could show.Read the article
- A script that knows it is talking to a containerSeven optional fields where absent means not established, a command table whose test derives its own cases, and an operating system that was in the wrong list.Read the article
- A shortcut is a reference, not a rightSix cards you can add to a dashboard, and shortcuts that only render when the viewer may still see the target today. Two findings only a real run produced.Read the article
- A webhook URL that is the secretAn incoming webhook can be its own credential if the URL carries the weight. What that costs: 160 bits, a signature over the clock, a body cut off early.Read the article
- A wire you can drag, and exactly one triggerDragging a wire is the easy part. The hard questions were what a test button may touch, who acts when nobody is watching, and how long a pause may last.Read the article
- A wrong secret that looks like silenceThree monitoring protocols written by hand instead of pulled in, and one failure mode the protocol itself makes impossible to tell apart from a dead server.Read the article
- Documentation written before the mergeTwo sentences on a new documentation page were false the day it shipped, because another branch landed first. What a guard catches, and what only a grep can.Read the article
- Every self call was in tail positionA recursive walk had to learn to stop halfway and continue tomorrow. The rewrite was exact rather than approximate, and 43 tests proved it.Read the article
- Green because it could not get thereOur contract test answered the most ordinary command there is with unsupported. Every test that depended on it was green for the wrong reason.Read the article
- Offline next to a heading saying onlineA fail safe default is correct on its own and wrong beside a fact. Rebuilding an agent page as cards made two of those contradictions visible at once.Read the article
- One real agent, one development gatewayFive rounds shipped with the same caveat: unproven over the wire. Closing it took one real agent, a planted password, and two results that measured nothing.Read the article
- The child wakes the parentA flow that calls another flow could poll, or be told. We built both, and the fallback clock is a day rather than five minutes for a measured reason.Read the article
- The select goes around the sentenceFourteen sentences called a container a VM. Swapping the word works in English and breaks in seven languages, so the branch has to hold the whole sentence.Read the article
- Three faults no script could seeEight articles in eight languages had passed every automated check. A reader found an invented number, half a sentence, and a title every link contradicted.Read the article
- Two families of fiveFive pages needed an illustration and the house style turned out not to exist. A pixel count settled it, and an orange ribbon lost to a measurement of zero.Read the article
- Two names for the same articleA link text that shortens a title is house style. One that replaces a word is a defect. Telling them apart took a measurement, not an opinion.Read the article
- Updated at three in the morning, on purposeAgent auto updates default to on at 03:00. The interesting decisions were which situations consume a slot, how far a catch up may reach, and one night with two.Read the article
- When the title cannot be the headingA rule saying an article's title equals its heading collides with a sixty character limit. Five languages needed the pattern that already existed.Read the article
- A backup that was never restored is not a backupThree different proofs get called one word. What a green Proxmox Backup Server verify really says, what it cannot say, and why empty has to mean empty.Read the article
- A canary that runs against real serversStub tests cannot prove authentication. Two monitoring defects only a real PostgreSQL and a real Redis could show, and what a status page is allowed to count.Read the article
- A date in the future is not a scheduleTwo dozen live articles claimed they had not been published yet. The fix was not a scheduler; it was a build that refuses a date it cannot possibly know.Read the article
- A flow is a graph, and a graph has to be finiteTurning a step list into a node editor sounds like a UI change. It is a decision about loops, about branches nobody took, and about one stolen click.Read the article
- A ledger that counts before anyone is billedMonitoring produces a number for every check long before there is any price. Here is how we built the counting first, and why that order is the safe one.Read the article
- A match that refuses to be sureFour facts from four sources, kept apart. Why a KEV listing never raises a severity, and why only a bounded version range counts as a real advisory match.Read the article
- A probe that cannot be talked into anythingMonitoring from outside a customer network means running machines of our own. Here is how the platform stops one of them from doing anything else.Read the article
- A progress bar that refuses to guessMost time estimates are invented. Here is the rule that decides when our panel is allowed to show one, and what it says on the screen when it is not.Read the article
- A secret that travels onceA monitoring check needs a password at the far end. Here is how it reaches one probe, for one attempt, without ever landing in a queue, a log or an audit row.Read the article
- A timeout is not a stop buttonA deadline ends your waiting, not the work. What a one hour cap does to a long backup, why two clocks disagree, and how to record a result nobody knows.Read the article
- An accessibility exception that measures itselfEvery accessibility checker ends up with an exception list. Ours holds two, each with a measurement attached, and the run fails when one stops matching.Read the article
- An export you can verifyA data subject export as a durable job: a temporary file renamed into place, a sha256 in the receipt, a single use token, and one shared directory in two roles.Read the article
- An incident that never closes on silenceA monitoring incident should open on a measurement and close on a measurement. Here is what breaks when the absence of data is allowed to count as good news.Read the article
- Choosing a VMID range for a hosting businessA VMID is an identity, not a counter. What the range you pick decides: what your platform may create, what it may read, and what happens when it fills.Read the article
- Fifteen things a billing migration cannot carryA billing migration is not a data copy. Fifteen measured omissions, money as integer cents, and why a fingerprint is the only usable idempotency key.Read the article
- How a signed agent update refuses itselfA checksum proves a download arrived intact, not that you sent it. What signing an auto-updating agent really costs, and the release that got it wrong.Read the article
- How an agent picks the right edge serverMulti-A DNS, layer-4 edges and PROXY protocol v2, with the measurements: what a client does with several addresses, and why returning is the hard half.Read the article
- The case against port forwarding your panelAn agent that dials out needs two outbound rules and no inbound port. Here is what that buys, what it costs, and the four problems it moves rather than solves.Read the article
- Where hosting panel credentials should liveA control panel that stores your hypervisor and panel logins is the most valuable target in your stack. Here is the alternative, and what it does not solve.Read the article
- Planning IPv4 address pools for a VPS productAddresses are the one input you cannot buy more of on a Tuesday. How to shape pools, why the database has to referee, and what happens when one runs dry.Read the article
- Projecting, never replacingA single progress view over migrations, backups, restores and reinstalls, without becoming a second system of record. Two failures were completely silent.Read the article
- What Proxmox vzdump modes actually guaranteeSnapshot, suspend and stop are not three speeds of the same backup. Only one of them is consistent by construction, and the API will not tell you which ran.Read the article
- Reinstalling a container is a replaceA container has no template disk and no cloud-init, so reinstalling one means destroying it and rebuilding it. That changes what you owe the customer first.Read the article
- Sixteen thousand keys, nine languagesTranslating a control panel is not a text problem. The failures that matter are silent: a lost argument, a flattened plural, a guard that checks nothing.Read the article
- Stripe for hosting: when a payment is yoursSucceeded is not settled, a dispute is not a refund, and dunning is a dashboard setting. What building recurring hosting billing on Stripe actually involves.Read the article
- The migration that never ranA migrator that reports success while skipping a file is worse than one that crashes. How timestamp ordering silently drops migrations, and what to check.Read the article
- Two rounds, one field numberTwo branches added a variant to the same protobuf message on the same day and both picked the same number. Very little about that fails loudly.Read the article
- Unprivileged is a measurement, not a settingRestoring a container backup starts with reading the configuration inside the archive, because the safe value for one flag cannot be sent blindly.Read the article
- VM or container? What to sell on ProxmoxA KVM guest and an LXC container share one hypervisor, one number space and one price list, and very little else. The differences that cost you money.Read the article
- vSphere to Proxmox: what actually movesThe disk is the easy part of leaving VMware. The identity, the guest customisation, the network adapter and the guest agent are four separate problems.Read the article
- What a backup does not containThe same missing option means yes on a virtual machine and no on a container. Here is how we measured Proxmox backup coverage instead of promising it.Read the article
- White-label panels: what the customer seesPutting your name on a reseller panel is the easy half. The hard half is deciding which screens exist for your customer at all, and enforcing that.Read the article
- Why a Proxmox 200 is not a resultProxmox answers a clone request with a UPID and gets on with it. How to read that identifier, poll it honestly, and tell a finished task from a successful one.Read the article
- Stop hand-building cloud-init templates on ProxmoxOne command on a Proxmox node: pick your distros and get checksum-verified, cloud-init-ready templates. Free with every account.Read the article
- SolusVM alternatives: judge it on 2026, not on 2022SolusVM alternatives compared against a product still shipping weekly. What the 2022 criticism actually said, what changed since, and when to look elsewhere.Read the article
- Proxmox VNC asks for the same ticket twiceYour noVNC client connects to Proxmox and then hangs on a black screen. The vncproxy ticket opens the tunnel; the VNC server behind it wants that ticket again.Read the article
- VirtFusion alternatives: what you would be giving upVirtFusion alternatives compared: what KVM-only actually buys you, one measured gap in its WHMCS module, and which panel suits a multi-product hosting estate.Read the article
- Virtualizor alternatives: what to actually compareVirtualizor alternatives compared: what it still does best, what changed in its own licence terms, and which panel fits which kind of hosting business.Read the article
- Tenantos alternatives: an honest comparison from a competitorTenantos alternatives compared by a direct competitor: where its bare-metal depth and per-server minimums decide it, and where another shape fits better.Read the article
- An empty Proxmox ipfilter set means deny allEnable ipfilter on a Proxmox VM whose NIC has no addresses and the card goes completely dark: no error, no log line. In the PVE firewall, absence is a value.Read the article
Web hosting
- ISPConfig billing automationISPConfig answers HTTP 200 to everything, including failures. What that means for a billing hook, and how the account lifecycle maps onto its remote API.Read the article
- CloudPanel on Hetzner Cloud: install it, then sell on itInstalling CloudPanel on a Hetzner Cloud server is a ten-minute job. Selling hosting on it is three layers, and only one of them is the panel.Read the article
- ISPConfig migration: what the toolkit covers, and what it leaves youISPConfig migration means two different jobs. What the paid Migration Toolkit covers, what it explicitly does not, and the three things no toolkit moves.Read the article
- Migrate cPanel to Virtualmin: what transfers, and what does notWhat Virtualmin's own cPanel import takes over, and the two traps that land in the first week: the username it keeps, and the quota it cannot see.Read the article
- Migrating from cPanel to DirectAdminThe most-taken route off cPanel, and what does not come across: username rules, quota sentinels, the identifier your billing system stores, and five real traps.Read the article
- Virtualmin billing automation: what a Virtualmin billing panel has to doFrom order to live Virtualmin account, and what an unpaid invoice actually does: suspend, resume and delete, with the panel commands behind each step.Read the article
- cPanel and WHM alternatives for hosting providersSix control panels compared on licence model, migration effort and measured API behaviour, plus what replaces WHM on the administrator side of each one.Read the article
- The CyberPanel WHMCS module, and the alternativeWhat any WHMCS module for CyberPanel can and cannot do, because its API sets the ceiling. Measured limits, and a provisioning layer that sits above it.Read the article
- How to sell web hosting with HestiaCPHestiaCP has an API but no ordering, invoicing or capacity layer. What its API actually returns, where it bites, and how to build a hosting product on top.Read the article
- How to sell web hosting with PleskTurning a Plesk server into a hosting product: one key for two APIs, the suspend trap that hides an account from your own polling, and what we never ask for.Read the article
- Selling web hosting with VirtualminSell hosting on Virtualmin: which Webmin user and password to use, why the TLS fingerprint is mandatory, how plans map, and when quota fields stay empty.Read the article
- Automating CloudPanel billing and provisioningA paid order, an overdue invoice, a cancellation. CloudPanel has a command for two of those three. The third is a vhost edit, and that choice has consequences.Read the article
- DirectAdmin vs cPanel: what the 2026 prices actually cost youDirectAdmin or cPanel in 2026? Published list prices after the January increase, the cost curve per account, and nine operational differences we measured.Read the article
- How to sell web hosting with CloudPanelCloudPanel is fast, free and built for one server, not for tenants. What its command line really does, and the three gaps that matter when you sell on it.Read the article
- How to sell web hosting with CyberPanelCyberPanel has an API, but creating a site reports success before it knows. What the API really returns, the traps that bite first, and how to build on it.Read the article
- The panel API said 200. Nothing happened.Your integration reports success and nothing happened. Six hosting control panel APIs return HTTP 200 on failure. Measured, with the field to read instead.Read the article
- How to sell web hosting with ISPConfigISPConfig drives web, mail and DNS across several servers from one install, with clients and limits built in. What its remote API gives you, and what it lacks.Read the article
- HestiaCP vs CyberPanel: which free control panel should you sell on?HestiaCP or CyberPanel for your hosting business? Contributors, release cadence, suspension behaviour and usage metering, measured on 21 August 2026.Read the article
- The 2026 cPanel price increase, and what to do about itcPanel list prices rose again on 1 January 2026. What it costs at 100, 500 and 1,000 accounts, which numbers hold up, and the four routes out.Read the article
- Automating HestiaCP billing and provisioningFrom a paid order to a live HestiaCP account, and from an overdue invoice to a suspended one. The commands, the measured traps, and where the invoice lives.Read the article
- Automating Plesk billing and provisioningFrom a paid order to a live subscription, and from an overdue invoice to a dark one. The calls, the measured timings, and four traps that only bite unattended.Read the article
Game panels
- WISP billing automationWISP enforces a suspension and has no idea whether anyone paid. The lifecycle mapping, the two-key trap, and the shapes that break a first integration.Read the article
- Choosing a game panel by the API you automateSix game panels, measured on what their APIs actually let you do. The decisive question is not features but whether the panel enforces a suspension at all.Read the article
- Selling game servers with GameAPSell game server hosting on GameAP: the admin API token, why there is no game picklist, how placement and ports work, and what suspending really does.Read the article
- Billing automation for PufferPanelOrder to server, and unpaid invoice to stopped server, on PufferPanel. The lifecycle mapping, the async rule, and the suspend gap you have to design around.Read the article
- Pterodactyl vs Pelican: which game panel should you build on?Pterodactyl or Pelican? Contributor counts, release cadence and nine measured API differences, with the figures taken on 21 August 2026.Read the article
- How to sell game server hosting with PufferPanelPufferPanel runs game servers but has no shop, no suspend and no live console. What that means when you sell on it, and how to automate the parts it does have.Read the article
- Billing automation for Pelican PanelFrom paid order to running Pelican server, and from unpaid invoice to a suspended one. The lifecycle mapping, the async rule, and where the honest limits are.Read the article
- How to sell game server hosting with Pelican PanelPelican runs game servers but does not sell them. How to turn a Pelican panel into a product: two API keys, eggs as plans, node placement and imports.Read the article
- Five Pterodactyl API traps, and what Pelican changedCreating a Pterodactyl server fails on a field your customer never sees, and egg variables have no required flag. Five measured traps, and what Pelican changed.Read the article
- How to sell Minecraft hosting with MCSManagerMCSManager runs game servers without requiring Docker, across several nodes, from one panel. What that buys you, and what selling still needs on top of it.Read the article
Infrastructure
- A label that survives a hostname changeA sticker on a server is a public document. What we put on it, why the QR code holds no URL, and how a barcode table gets verified instead of trusted.Read the article
- Why a vulnerability scanner should send zero bytesThe line between a check and an attack is the bytes you put on the wire. How to turn that promise into a number your tests can fail on, with the measurements.Read the article
- From a DHCP answer to a finished installNetboot part two. What happens after the offer lands: the boot script, the answer file, the callback nobody writes, and which vendors publish a checksum.Read the article
- Proving you own a hostname without a certificateA monitoring form with a hostname field is a traffic generator unless ownership is proven. Two challenge types, why they expire, and who should fetch them.Read the article
- Rack space is not capacityHow full is that rack? There are five answers, in five different shapes, and adding them up produces a number that is wrong in a way nobody can audit.Read the article
- Nowhere is a place: moving hardware between sitesMoving a machine to another site means it is briefly in no datacenter at all. Fifteen states, four open checks, and three ways out of not knowing.Read the article
- The hold becomes the placementMoving a machine between two racks has one dangerous instant: the moment the destination is neither reserved nor occupied. Here is how we removed it.Read the article
- The only real limit on rack occupancyTwo engineers pick the same rack unit at the same time. The form says free to both of them. What decides is a partial unique index, and nothing else can.Read the article
- Two orders, one machineA dedicated server can be sold exactly once. Locking the whole candidate pool quietly cost us a reservation, and the fix was to lock one machine at a time.Read the article
- When NetBox is the source of truthConnecting an external DCIM is not a sync. It is a per field decision about who decides, plus a list of things you refuse to import and say so out loud.Read the article
- Why UEFI netboot fails when BIOS worksUEFI clients answer PXE-E16 while BIOS boots fine from the same server. The cause is the destination address of your proxy-DHCP reply, and RFC 2131 is explicit.Read the article
External providers
- InterServer: "pending" does not mean unpaidInterServer's vps_status sat on pending for 46 minutes while the invoice read Paid. Why you need three status fields, not one, and what each actually means.Read the article
- How to sell web hosting VPS with InterServerResell InterServer slice-based VPS: the per-slice price, the single account-wide API key, the 52-minute delivery we timed, and what ordering really spends.Read the article
- Hetzner Cloud vs InterServer: two suppliers to resellTwo VPS suppliers to resell, measured side by side: list prices, regions, API design, delivery speed, and the operational differences that decide which fits.Read the article
- Hetzner Cloud: the available flag predicts nothingHetzner calls a server type unavailable, then delivers it four times; calls another available, then refuses it. What we measured, and what to read instead.Read the article
- Automating Hetzner Cloud billing and provisioningTurning hourly Hetzner compute into a fixed monthly product: the calls behind each moment, the no-suspend problem, and four traps that only bite unattended.Read the article
- How to sell web hosting VPS with Hetzner CloudResell Hetzner Cloud VPS without owning a hypervisor: the list prices, the API token you need, and the catalogue quirks we measured before shipping.Read the article
Billing panels
- Two rules, and a dead link between themA crawl of 1776 pages found exactly 18 broken URLs. Both rules that produced them were correct; nobody had tested what happens where the two meet.Read the article
- FOSSBilling Pterodactyl integration: what actually existsFOSSBilling says it will not build a Pterodactyl integration. That leaves three ways to sell game servers through it, and they fail in different places.Read the article
- WHMCS alternatives: which problem are you actually solving?WHMCS alternatives compared honestly: which ones actually replace it, and why the answer for many hosters is to keep WHMCS and fix the layer beneath it.Read the article
Comparisons and guides
How these platforms compare, and what it takes to sell on top of them.
Start with one host and one agent
Create an account, install the agent with a single command and connect your first Proxmox host. The trial runs for 14 days and asks for no payment details.