Category: Web and apps
Hosting panel with HestiaCP or Virtualmin: your own web server, with no licences
A panel where you add websites, domains and databases yourselves, with someone behind it keeping the server secure, up to date and backed up in a way that can be restored.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- HestiaCP: GPLv3. Virtualmin: free GPL edition and optional paid Pro edition
In short
HestiaCP and Virtualmin are open source hosting panels, an alternative to cPanel or Plesk with no paid per-server licences. We install them in your account and split the work: you create websites, domains, databases and FTP accounts from the panel; we take care of the server, security, updates, off-site backups and monitoring. Email is not included by default.
What do we take care of?
A hosting panel makes it easy to create websites, but it does not maintain the server on its own. With nobody behind it, patches fall behind, the disk fills up with local backups that are useless if the machine goes down and one vulnerable website can compromise all the others. This is what we keep under control:
Panel
HestiaCP or Virtualmin installed and up to date, with restricted access and two-factor authentication.
Server
Operating system, web services, PHP and databases with patches kept current.
Security
Firewall, Fail2ban, key-based SSH and each website isolated under its own system user.
Backups
Websites and databases backed up off the server every day, with tested restores.
Certificates
Automatic HTTPS with Let’s Encrypt for every domain, with an alert if a renewal fails.
Monitoring
Services down, disk, load, memory and certificates about to expire.
How do we split the work?
The point of the panel is that you do not depend on us for day-to-day tasks. The line is clear from the start:
| Task | Who | How |
|---|---|---|
| Adding websites, domains and subdomains | You | From the panel |
| Creating databases and FTP accounts | You | From the panel |
| Choosing the PHP version for each website | You | From the panel, among the ones we leave installed |
| Operating system, services and patches | Us | On a schedule, with announced windows |
| Server and panel security | Us | Firewall, Fail2ban, access and reviews |
| Off-site backups and restores | Us | Daily, encrypted and tested |
| Not included | Separate provider, or a separate quote |
Why is email kept separate?
Both panels can install a complete mail server, but it is the part that takes the most work and the one that fits worst on a web server. You have to look after the IP’s reputation so messages do not end up in spam, maintain SPF, DKIM and DMARC for every domain, filter spam and viruses, and make sure a stolen password does not turn the server into a spam sender. On top of that, several cloud providers block or restrict sending email on port 25. That is why we install the panel without email and recommend a specialist provider for the mailboxes. If you still want it on your server, we quote for it separately, with its own scope.
What problems do we come across most often?
- Backups only on the same disk: the panel takes them, but they stay on the server they are meant to protect.
- Unsupported PHP versions: old websites that force you to keep a PHP release with no security patches.
- Panel open to the internet: with the admin user and no two-factor authentication.
- Abandoned websites: sites nobody updates, through which an attacker gets into the rest of the server.
- Full disk: logs, local backups and temporary files that nobody cleans up.
- Email installed and left unattended: the IP ends up on blacklists and messages from every website stop arriving.
How do we handle backups and updates?
The panel takes a daily backup of each user, with their websites and databases, and we send it encrypted off the server, to object storage or to another server. We regularly restore a website in a test environment to check that it loads and that the database is complete. System and service updates follow a schedule; panel updates, especially major versions, we apply after reading the release notes and testing them on a test server, because they change the configuration of the services underneath.
Who is it for?
For an agency or a developer hosting their clients’ websites who wants to stop paying for cPanel or Plesk licences. For a company with several websites of its own that wants to add them without depending on anyone. And for anyone who set up a server with a panel years ago and does not know whether their backups work. If your websites are high-traffic WordPress sites or a shop, managed WordPress and WooCommerce may suit you better; if they are containerised applications, managed Coolify and Dokploy. If you want someone to answer for the server every month, that is covered by SRE as a service.
- PanelHestiaCP or Virtualmin
- NginxHTTPS per domain
- PHP-FPMOne version per website
- MariaDBDatabases
- BackupsOff the server
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- AWS
- Google Cloud
- DigitalOcean
- OVH
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | Cloud or dedicated server with the panel, and backups in Hetzner Object Storage or a Storage Box. | One of the most affordable options in Europe for hosting lots of small websites. |
| AWS | EC2 or Lightsail instance with the panel and backups in S3. | |
| Google Cloud | Compute Engine with the panel and backups in Cloud Storage. | |
| DigitalOcean | Droplet with the panel and backups in Spaces. | |
| OVH | VPS or dedicated server with the panel and backups in OVHcloud Object Storage. | |
| Own server | The panel on your own server or on a virtual machine, with a public IP or behind a proxy. | Backups always leave the building. |
What is included
- HestiaCP or Virtualmin installed on a clean server in your account, in your name.
- Nginx, Apache or PHP-FPM with several PHP versions to choose from per website, and automatic HTTPS certificates.
- MariaDB or MySQL, and PostgreSQL if you need it, accessible only from the server itself.
- Panel with restricted access, two-factor authentication and separate users for each person or each of your clients.
- Firewall, Fail2ban, key-only SSH and system patches applied on a schedule.
- Daily backups of websites and databases off the server, with regular test restores.
- Updates to the panel and its services tested before they are applied.
- Monitoring of services, disk, load and certificates, with alerts.
Frequently asked questions
Does it include email?
Not by default. Running your own mail server means looking after the IP's reputation, SPF, DKIM and DMARC records, spam filtering and antivirus, and many cloud providers block or restrict sending on port 25. That is why we install the panel without email and recommend a separate email provider. If you still want it on your server, we quote for it separately.
HestiaCP or Virtualmin: which do you recommend?
HestiaCP is simpler and has a cleaner interface; it runs on Debian and Ubuntu and is a good choice for hosting PHP websites without complications. Virtualmin is more complete and configurable, also supports Red Hat family distributions and relies on Webmin to administer the system. If you have no preference, in most cases we start with HestiaCP.
Can we migrate our websites from cPanel or Plesk?
Yes. Both panels have tools to import cPanel backups, although they do not bring everything across. We review each website, move it to the new server, test it on a temporary domain and we switch the DNS once it responds the same. Whatever does not travel on its own, such as scheduled tasks or custom configuration, we move by hand.
What can we do from the panel and what do you do?
You add websites and domains, create databases and FTP accounts, change the PHP version of each website and manage your clients' users, if you have any. We take care of what sits underneath: the operating system, services, security, updates, backups and alerts. If a particular website breaks because of its own code, we let you know what we have seen.
Is there any licence to pay for?
With HestiaCP, no: it is free software and has no paid edition. Virtualmin has a free GPL edition, which is the one we normally use, and a paid Pro edition with extra features; if you need it, you take out the licence yourselves and it is in your name. You pay your provider for the server, as always.
Tell us about your case
In a free 20-minute call we look at where you are and where to start. No commitment.
Official documentation consulted
The technical details on this page are based on:
Reviewed on