Leaving Shared Hosting: The Best Free VPS Control Panels in 2026, Tested

The best free VPS control panels in 2026 are HestiaCP, CloudPanel, aaPanel and Webmin with Virtualmin, and the right one depends mostly on one question: do you want email on the same server? We installed all four on identical KVM virtual machines with 2 vCPUs and 3 GB of RAM. HestiaCP was the lightest full hosting panel, with web, mail, DNS and a database running in about 590 MB of RAM. CloudPanel is the tidiest choice for PHP and WordPress sites, but it has no mail server. Virtualmin does the most and used about 1.8 GB, more than half of it for the virus scanner. aaPanel is the most point-and-click, and its free edition sits next to a paid Pro tier.

Key facts, checked on 9 October 2026:

• cPanel costs $29.99 a month for one account, $35.99 for up to 5, $53.99 for up to 30 and $69.99 for up to 100, then $0.49 for each extra account, VAT excluded (cPanel pricing).
• CloudPanel 2.5.4 came out on 1 July 2026. It needs at least 2 GB of RAM and runs on Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04 (CloudPanel requirements, changelog).
• HestiaCP 1.10.5 is GPLv3 software for Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04. It needs 1 GB of RAM if you skip SpamAssassin and ClamAV (Hestia docs).
• aaPanel 8.0.6 is free. Its Pro edition costs $28.80 a month, $198 a year or $699 for life, and a banner on the same page advertised lifetime Pro for $399 (aaPanel pricing).
• Virtualmin GPL is free and runs on the BSD-licensed Webmin; Pro starts at $7.50 a month for 10 domains (Virtualmin shop). Fully supported systems include Debian 12 and 13 and Ubuntu 24.04 and 26.04 (OS support).

Why people leave cPanel and shared hosting

A control panel is a website that runs your server for you. You click "add site" and it writes the web server configuration, creates the database, gets a free Let's Encrypt SSL certificate and sets up mailboxes. On shared hosting the host owns the server and gives you a slice of cPanel. On a VPS (a virtual private server: your own virtual machine with its own IP address) you install the panel yourself.

People leave for two reasons. Shared plans split CPU and memory between many customers and limit PHP versions, cron jobs and background processes. And cPanel is priced per hosted account: a freelancer with 20 client sites needs the Pro tier at $53.99 a month, more than many VPS plans cost, before paying for the server. A free panel takes that line off the bill. You give up cPanel's polish, and with some panels the mail server.

How we tested

Each panel got its own fresh KVM virtual machine on our test server in Amsterdam, with 2 vCPUs, 3 GB of RAM and a 20 GB disk. We used the system each vendor recommends: Debian 13 for CloudPanel, HestiaCP and Virtualmin, and Ubuntu 22.04 for aaPanel, whose FAQ recommends it and lists Debian only up to 12. After the official installer and a reboot we recorded:

• Install time, from the first apt-get command to the success message.
• RAM in use, the "used" column of free -m. A fresh Debian 13 machine of the same size showed 316 MB used and 0.7 GB of disk.
• Open ports, from the firewall rules each panel wrote.
• Outbound connections, by logging every DNS lookup with tcpdump for 15 minutes at idle.

This is one run per panel, so treat install times as a rough guide; mirror speed and CPU change them.

The results side by side

Measured in our lab on 9 October 2026. The RAM figures include the database server (except for aaPanel, see below) and, for HestiaCP and Virtualmin, the full mail stack.

What each panel runs for you

HestiaCP: the closest thing to a free cPanel

HestiaCP, a community fork of the older VestaCP, gives each customer an account with websites, databases, mailboxes and DNS zones, much like cPanel. Every panel action is also a command; we counted 524, all starting with v-. Install it on a fresh server only:

# as root, on a fresh Debian 13 server
apt-get update && apt-get -y install ca-certificates wget
wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
bash hst-install.sh --interactive no --hostname panel.example.com --email you@example.com --username youradmin --password 'a-long-password' --clamav no --spamassassin no
reboot

The installer ended with "You have successfully installed Hestia Control Panel" and "IMPORTANT: You must restart the system before continuing!" After the reboot the panel answered on port 8083. Its firewall opened 21 and 12000 to 12100 (FTP), 22, 25, 465 and 587 (mail sending), 53 (DNS), 80 and 443, 110, 995, 143 and 993 (mail reading) and 8083. While it sat idle it made no outbound DNS lookups at all; the only lookups in our 15-minute capture were package mirrors, when we added a PHP version. A nightly cron job installs Hestia updates automatically; the installer's closing message says you can switch that off under Server, Updates.

Two things to know. Leaving ClamAV and SpamAssassin out keeps it near 600 MB. Hestia's docs recommend 4 GB of RAM, which is what you want if you add them back to host mail for other people. And extra PHP versions are one command each:

# as root
v-add-web-php 8.3
v-list-sys-php

The second command printed 8.3 and 8.5.

CloudPanel: fast PHP sites, no mail

CloudPanel runs websites and nothing else: Nginx, PHP-FPM, Varnish cache, Redis and MariaDB or MySQL. With no mail or DNS server, you pair it with an external mail provider and your registrar's DNS. The official install checks the script's SHA-256 checksum first:

# as root, on a fresh Debian 13 server
apt update && apt -y upgrade && apt -y install curl wget sudo
curl -sS https://installer.cloudpanel.io/ce/v2/install.sh -o install.sh; \
echo "8146dbe0a488e7088b04071b0c34d59aa0ab1fe9dcec382d395fd155c9e6c476 install.sh" | \
sha256sum -c && sudo DB_ENGINE=MARIADB_11.8 bash install.sh

It finished with "The installation of CloudPanel is complete!" and the address https://your-ip:8443. Open that page at once and create the admin user. The docs warn that until you do, a bot could do it first, so limit port 8443 to your own IP if you can.

We hit two traps worth knowing:

• Our first attempt failed with cat: /etc/pam.d/sshd: No such file or directory. Our minimal test image had no SSH server, and CloudPanel's package expects one. Normal VPS images have it; if yours does not, run apt -y install openssh-server first.
• The command line tool clpctl db:add did nothing and printed nothing until someone had opened the panel in a browser once. The first page load registers the database server inside CloudPanel.

The RAM figure is high for a panel without mail because CloudPanel installs and starts ten PHP-FPM versions, 7.1 to 8.5, each using 45 to 95 MB. MariaDB, FTP, Postfix and Varnish all listen on public addresses, but the UFW firewall only lets in 22, 80, 443 (TCP, and UDP for HTTP/3) and the panel range 8433 to 8443. The installer also adds a 2 GB swap file.

aaPanel: point and click, with a shop next door

aaPanel is the international version of the Chinese BT Panel. After install you get a dashboard with an app store, and you choose your web server, database and PHP there. The installer asks one question, which -y answers for you:

# as root, on a fresh Ubuntu 22.04 server
URL=https://www.aapanel.com/script/install_panel_en.sh && if [ -f /usr/bin/curl ];then curl -ksSO $URL ;else wget --no-check-certificate -O install_panel_en.sh $URL;fi;bash install_panel_en.sh -y

It printed "Congratulations! Installed successfully!" and a login address with a random port (16367 for us) and a random path such as /c41e992d. That hidden address is aaPanel's main defence against login scanners. Its firewall opened 20, 21, 22, 80, 443, 888, 39000 to 40000 and the panel port.

What we noticed in the code and the logs:

• The installer reports to aaPanel's servers: it calls an install counter (/api/setupCount/setupPanel) and asks aaPanel's API for the server's public IP.
• Parts of the panel ship as compiled binaries, so it is not fully open source.
• A comment in the code dated 19 June 2025 says forced binding to an aaPanel account was removed for module pages, and the redirects to the account page are commented out.
• We installed the web stack with the script the app store calls. PHP 8.3 came as a ready-made binary in about a minute, and a compiled Nginx 1.26 took almost 9 minutes. MariaDB 10.11 was compiled from source even in fast mode, on a single build thread; after 29 minutes it was 45% done and we stopped it. On a small VPS, expect a long first database install.

Webmin and Virtualmin: the most power, the most RAM

Webmin manages the whole Linux system: users, firewall, packages, services, cron. Virtualmin adds hosting on top: one "virtual server" per domain, with its own Linux user, website, database and mailboxes in /home/user/public_html, the same layout as cPanel. The official one-line installer needs curl and sudo, which normal VPS images already have; our minimal test image needed them added first.

# as root, on a fresh Debian 13 server
sudo sh -c "$(curl -fsSL https://download.virtualmin.com/virtualmin-install)" -- --bundle LAMP --hostname panel.example.com --force

It ran 20 configuration steps and ended with "Installation Complete!" and the address https://panel.example.com:10000. Adding a site with a database from the command line worked first time:

# as root
virtualmin create-domain --domain shop.example.com --pass 'a-long-password' --unix --dir --web --mysql

It ended with "All done!" and created /home/shop/public_html.

The full install is heavy. The ClamAV virus scanner alone held 973 MB, and the two small web servers behind Webmin and Usermin another 227 MB. Its nftables firewall opens the widest range of the four, including 2222 (SFTP through ProFTPd), 10000 to 10100, 20000 (Usermin, the webmail and user panel) and 49152 to 65535 for passive FTP. The installer's --type mini option installs a smaller stack; the script lowers its memory check from about 1.5 GB to 1 GB for it.

Licences, phoning home and upsells

Checking for news and updates is normal, but it tells you who you depend on. Open source HestiaCP and Virtualmin can be forked and kept alive by others; CloudPanel and aaPanel stay free only as long as their companies choose.

Moving a WordPress site off shared hosting

We tested this path end to end. The old host was a HestiaCP account with the site in ~/public_html, the same layout as cPanel, and the new server ran CloudPanel. Find the database name, user and password in the site's wp-config.php first.

1. On the old host, pack the database and the files:

# on the old host, as your hosting account user over SSH
cd ~/public_html
mysqldump --single-transaction --no-tablespaces -u DB_USER -p DB_NAME > ~/wp-db.sql
tar -czf ~/wp-files.tar.gz .

Type the database password when asked. Our test site of 116 MB became a 34 MB archive and a 92 KB SQL file ending with "Dump completed". On MariaDB 11.8, mysqldump also warns that its name is deprecated in favour of mariadb-dump; the dump still works. If the old host has no SSH, export the database from phpMyAdmin and download the files by SFTP instead.

2. On the new CloudPanel server, create the site and an empty database:

# on the new server, as root
clpctl site:add:php --domainName=www.example.com --phpVersion=8.4 --vhostTemplate='WordPress' --siteUser=shop --siteUserPassword='a-long-password'
clpctl db:add --domainName=www.example.com --databaseName=shopwp --databaseUserName=shopwp --databaseUserPassword='another-long-password'

Expected output: "Site www.example.com has been added." and "Database shopwp has been added." If db:add prints nothing, open the panel in your browser once and run it again.

3. Pull the two files across and unpack them, as the new site user:

# on the new server, as the site user "shop"
mkdir -p ~/tmp && cd ~/tmp
scp OLD_USER@OLD_SERVER_IP:wp-db.sql OLD_USER@OLD_SERVER_IP:wp-files.tar.gz .
cd ~/htdocs/www.example.com
rm index.php
tar -xzf ~/tmp/wp-files.tar.gz

4. Import the database and point WordPress at it. CloudPanel ships WP-CLI (2.12.0 in our test):

# on the new server, as root
clpctl db:import --databaseName=shopwp --file=/home/shop/tmp/wp-db.sql

# then as the site user "shop"
cd ~/htdocs/www.example.com
wp config set DB_NAME shopwp
wp config set DB_USER shopwp
wp config set DB_PASSWORD 'another-long-password'
wp config set DB_HOST 127.0.0.1
wp post list --fields=ID,post_title

We got "Import into database shopwp was successful." and our test post, "Moved without losing this post", in the list.

5. Test the new server before you touch DNS. This asks the new IP for your domain without changing anything public:

# on your own computer
curl -sk --resolve www.example.com:443:NEW_SERVER_IP https://www.example.com/ | grep -o '<title>[^<]*'

It should print your site's title. We ran the same check on the new server itself against 127.0.0.1 and got our test site's title back. The switch itself follows the usual routine: a day before, lower your DNS TTL (how long other servers cache the record) to 300 seconds; then point the A and AAAA records at the new server and issue a Let's Encrypt certificate in the panel. Our WordPress on a VPS guide covers securing the site afterwards. If the old site used http:// addresses, wp search-replace http://www.example.com https://www.example.com --skip-columns=guid fixes them. Add --dry-run first, as we did; it found 5 to change. For the certificate side in more depth, see our guide to reverse proxies and SSL, and keep an off-server copy with restic backups.

The same path works for the other panels; only the panel's own tools in steps 2 and 4 change. On HestiaCP the site and database come from v-add-web-domain and v-add-database (we used both to build our test source site), on Virtualmin from the virtualmin create-domain command above, and on aaPanel from its "Add site" form. Import the SQL file there with the panel's phpMyAdmin or database page.

Which free panel to pick

• You want cPanel's model on a budget, with several users, websites, mail and DNS on one server: take HestiaCP. It is fully open source and had the smallest RAM footprint of the four with a database running.
• You run WordPress, Laravel or Node.js sites and your email already lives with another provider: CloudPanel is the cleanest web-only panel, and it still offers PHP 7.1 for legacy sites.
• You would rather click than type and like an app store with one-click installs: aaPanel fits, but check what the free edition covers before you rely on a feature.
• You want the most control, with full mail filtering, DKIM, Webmin for every other corner of Linux and resellers on the Pro tier: Virtualmin. Give it 4 GB of RAM if you keep ClamAV.
• You run one app in containers: skip the panel. It adds little to Docker on a VPS.

Which server size each panel needs

Take our idle numbers and add room for your sites. HestiaCP without ClamAV and SpamAssassin runs a few small sites on VPS Nano (1 vCPU, 1 GB), but VPS Micro (2 vCPU, 2 GB) is the comfortable start. CloudPanel's own minimum is 2 GB, and aaPanel used about 305 MB before a database was added, so both start at VPS Micro. Virtualmin with ClamAV belongs on VPS Mini (4 vCPU, 4 GB) or larger. An agency with dozens of client sites should look at VDS Small (4 vCPU, 8 GB, 240 GB NVMe, 10 Gb/s).

Every RS Computers plan is a KVM VPS with NVMe storage, unmetered traffic and its own IPv4 and IPv6 addresses, in Amsterdam, Dublin or Prishtina. To send mail from HestiaCP or Virtualmin, ask us on Telegram to open outbound port 25, which is blocked on new servers. You can move to a bigger plan later from the client area with a short reboot.

Frequently asked questions

What is the best free alternative to cPanel?

HestiaCP is the closest free alternative to cPanel in 2026. It is open source under GPLv3 and gives each user websites, databases, mail and DNS. In our lab it used about 590 MB of RAM at idle on Debian 13 with ClamAV and SpamAssassin turned off.

Which free control panel uses the least RAM?

With a database running, HestiaCP used the least of the four we tested: about 590 MB with web, mail and DNS. aaPanel used about 305 MB, but without a database. CloudPanel used about 1.1 GB because it starts ten PHP versions, and Virtualmin's full install about 1.8 GB, of which the ClamAV virus scanner took 973 MB.

Does CloudPanel include an email server?

No. CloudPanel manages websites, databases, SSL and users, but it has no mail server and no DNS server. Use a separate mail provider, or a dedicated mail server such as mailcow on its own VPS.

Is aaPanel safe to use?

aaPanel hides its login behind a random port and a secret path, which keeps it away from simple scanners. It is free but not fully open source, its installer reports installs to aaPanel's servers, and a paid Pro tier sits next to the free edition. Keep it updated and limit the panel port to your own IP.

Can I install a control panel on a server that already hosts sites?

No. All four panels expect a fresh operating system and rewrite the web server, database and firewall settings. Install the panel on a new VPS, then move your sites across and switch DNS when the new copy works.

Try one this afternoon

A panel install takes 3 to 7 minutes, so the fastest way to choose is to try two of them. Pick a plan on the VPS plans page, install HestiaCP if you need mail or CloudPanel if you only need websites, and move one WordPress site with the steps above. Availability by city is on the plans page. If you would rather have us install the panel for you, that setup work is quoted per job: message us on Telegram or email us.

← All articles