HestiaCP vs CyberPanel: which free control panel should you sell on?

Both are open source. Both cost nothing to license. Both are picked by hosters who looked at what cPanel charges and decided to keep that money. And both are supported live by Provibr, which means we earn exactly the same whichever one you run, so this comparison has nothing to sell you.

The two are less alike than the shared "free control panel" label suggests. HestiaCP is an account-centric panel on a conventional nginx/Apache stack. CyberPanel is a website-centric panel built around OpenLiteSpeed. That difference reaches all the way into how you suspend a non-paying customer, which is not where most people expect to find it.

The project health numbers

Measured through the GitHub API on 21 August 2026. A year from now these will be wrong, which is why the date is here rather than in a footnote.

HestiaCP is the younger project with roughly four times the contributors and a visibly faster release rhythm. CyberPanel has a comparable fork count (people do build on it) but a much smaller group of people shipping changes and a large open issue backlog.

Those are counts, not judgements. A big backlog can mean an engaged user base filing reports; a fast release cadence can also mean churn. What they do tell you is how quickly a bug that affects you is likely to be looked at, and that is a fair thing for a hoster to weigh.

Where they differ in daily operation

Everything in this table is something we measured while building and shipping the two Provibr integrations, against running panels.

Several of those decide real things.

Suspension is the one that will surprise you. On HestiaCP, suspending an account suspends the account. On CyberPanel it is a web server trick: the site becomes unreachable, but FTP, mail and databases keep working and the unix user is not locked out. If you use suspension as your enforcement step for non-payment, that is a materially different tool on the two panels.

CyberPanel does not meter usage. This is not something an integration can add. Bandwidth is calculated and then discarded, and disk usage comes out of a cache that stayed empty on a new website, so a reported zero cannot be told apart from no reading at all. Provibr therefore shows no usage graph for CyberPanel, deliberately: a line that sits at zero forever looks like a measurement. HestiaCP carries the limit and the usage of every account along with each poll, in megabytes, with no extra call. If you sell by disk or by traffic, that difference is your billing.

Changing a package on CyberPanel changes the bookkeeping and not much else. Measured from inside a server after moving it to a package with different limits: the disk quota stayed as it was, and the web server configuration kept its old values. The panel shows the new name. Read that name as administration, not as a limit that moved with it.

CyberPanel's create call does not tell you what happened. The first answer arrives in about three seconds and says nothing, not even whether the domain was still free. The real outcome lands roughly fifty seconds later. Anything automating this has to wait for the second answer rather than believing the first.

Two CyberPanel conditions catch people out before their first order. API access is off by default, per user, and the panel checks that switch before it checks the password, so a correct password gives exactly the same API Access Disabled answer as a wrong one, and everything points at your credentials while the problem is one checkbox away. And part of the API refuses any administrator name other than admin; a renamed administrator cannot be used at all. Neither is a setting you can talk your way around.

HestiaCP has its own sharp edges, and one of them bites hard. The panel bans an address after five refused sign-ins, and a command outside a key's permissions counts as one of them. After that the panel stops answering altogether, timing out rather than returning an error. Nothing should ever retry HestiaCP calls automatically. Its API also keeps an allow-list of addresses, empty on a fresh install, and empty means nobody rather than everybody: until your agent's address is on it, a perfectly good key gets refused on every call. Note also that HestiaCP's HTTP status code is not the contract: the Hestia-Exit-Code header is. A successful change comes back as 204, and "already suspended" arrives as a 401.

One last operational note in CyberPanel's favour on credentials, and against it: HestiaCP lets you create an access key that can be withdrawn on its own, without touching your panel password. CyberPanel has no API token covering the four commands that create, suspend, repackage and remove a website. They all want the password, so what you hand your automation is the full administrator password.

Which one should you pick?

Pick HestiaCP if you bill on disk or traffic, if suspension is how you enforce payment, if you want a credential you can revoke on its own, or if the pace at which bugs get fixed matters to you. It is the safer default for a hosting business.

Pick CyberPanel if you specifically want OpenLiteSpeed. That is a real reason and it is the one CyberPanel is chosen for. Go in knowing that you will do your own usage metering, that suspension does less than it sounds like, and that a package change is a label.

Pick neither yet if you have not decided how you enforce non-payment. That answer differs between these two panels, and it is easier to choose the panel around your process than to bend your process around the panel.

You can also run both

Most hosters who ask this question already have one panel and are thinking about the other. That transition is the expensive part, not the software: two logins, two ways of counting what you sold, two places to look when a customer calls.

Provibr connects both, in the same account. A HestiaCP account and a CyberPanel website appear in the same server list, count towards the same capacity and land on the same monthly invoice. The agent dials outward from your own network, so neither panel needs an inbound port and nothing is installed on either. Accounts and websites you did not create through Provibr stay untouched until you import them, which is how you move an existing panel across without rebuilding anything on it.

Read next

• HestiaCP setup: the access key, the allow-list, packages and importing accounts.
• CyberPanel setup: switching API access on, the admin requirement, and what stays in the panel.
• The CyberPanel WHMCS module: what a module can and cannot do, because the CyberPanel API sets the ceiling.

Stars, forks, contributors, issues and release cadence were measured via the GitHub API on 21 August 2026. Everything described about the two APIs was measured against running panels while building the Provibr integrations.