Secure your administrator account
Two-factor authentication is required for administrators. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password…), then enter the 6-digit code to finish.
Loading…
Loading…
What each plan gives your customers. These limits are set by the administrator.
| Package | Disk | Bandwidth | Websites | Databases |
|---|---|---|---|---|
| Loading… | ||||
| Username | Domain | Package | Status |
|---|
Set how your customers see the panel after they log in — your name, logo and accent colour (both light & dark). It applies only to your own customers. The shared login page is unchanged.
Run everything under your OWN brand on this shared server: your customers log in at panel.<yourdomain> and their DNS is served by your nameservers — they never see the provider. All records below point to server IP ….
…
Open
This is your own branded panel on your own domain — use it instead of the provider's panel. HTTPS issues automatically once panel.<yourdomain> points to the server IP above.
Where you are emailed if something goes wrong with your own domain on this server — today, if your nameserver domain ends up with no DNS zone here and stops resolving, which takes your panel, site and email down with it. The same alert also appears as a red banner in your panel. An outage alert repeats once a day until it is fixed, and you get a note when it clears. Leave this empty and the alert goes to the server's administrator instead — it is never simply dropped.
Protect your reseller login with a second factor from your phone's authenticator app. It applies only to your own login.
A few steps and customers can buy from you. This card disappears once you're ready.
| Username | Domain | Package | Status | |
|---|---|---|---|---|
| Loading… | ||||
A package is a hosting plan — it sets what each account on it may use: disk, bandwidth, databases, and per-account CPU, memory and database limits. Leave a field at 0 for unlimited. Saving a package applies the new limits to every account already using it.
| Name | Disk | Bandwidth | Domains | DBs | CPU cap | RAM cap | DB conns | |
|---|---|---|---|---|---|---|---|---|
| Loading… | ||||||||
Create a reseller and choose what they may sell. They log in to their own limited panel and see only their own accounts.
| Username | Packages | Max accounts | Used | Alert email | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Sell hosting to your own customers: enter your gateway credentials, turn a gateway on, and create plans. Secrets are stored server-side and never shown again.
Enter your PayPal REST app credentials (from the PayPal Developer site — no coding). Leave a secret blank to keep the saved one. Once saved, PayPal shows as configured and you can switch it on above. How do I get these? ↗
| Plan | Package | Price | Cycle | Status | |
|---|---|---|---|---|---|
| Loading… | |||||
Enter a license key to activate a paid plan — no reinstall needed. Get one from your MaxiCP provider portal.
Applies the latest signed release and restarts the panel — accounts, data and hosted sites are untouched. Updates also apply automatically each day.
Upload a cPanel account backup (cpmove-*.tar.gz) — no SSH needed. Preflight shows what will be imported; Import recreates the account (isolated user, files, databases, mail, DNS, domains, PHP version). The archive is treated as untrusted — only the account's own space is written.
Your business name, logo and accent on the public signup page (/signup) — so customers buy under YOUR brand, not "MaxiCP".
…
Open
Customers pick a plan and pay here; their account is created automatically once payment is verified. It needs at least one active plan and one enabled payment method.
These are the nameservers your customers point their domains to. The panel serves DNS for every hosted domain — but the nameserver names only work once you register them at your own domain's registrar. Below is a live check of whether they resolve to this server, and whether this server actually serves a DNS zone for the domain they live under. Both halves matter: if you delegate that domain here while this server has no zone for it, every lookup is refused and the whole domain — website, email and this panel's address — goes offline.
ns1 → your server IP and ns2 → your server IP.ns1.<domain> and ns2.<domain> → your server IP.ns1/ns2.<domain>: add that domain here as a hosting account first, so this server serves a DNS zone for it. Glue alone is not enough — a domain delegated to a server that has no zone for it stops resolving entirely. The check above tells you which case you are in.Whether email from this server can actually reach the outside world. Delivery to a recipient's mail server always uses port 25 — that is the SMTP standard, not a setting — and many hosting providers block it to stop spam. When they do, messages sit in the queue for days and then bounce, which looks exactly like "sent but never arrived". If that is your situation, point outgoing mail at a relay below and it starts working immediately.
Where this server emails you when something needs you — today, when a domain pointed at your nameservers has no DNS zone here and goes offline. Alerts are also shown in the panel and written to the server log; email is the one that reaches you when you are not looking at the panel. An outage alert repeats once a day until it is fixed, and you get a note when it clears. Leave this empty to turn alert email off. Mail is handed to this server's own mail service — send a test to confirm it actually leaves the machine.
Maximum file size for phpMyAdmin → Import, server-wide (phpMyAdmin runs one shared pool for every account on this server). For any-size restores, use the customer's Databases → “Import / Restore” instead — it streams straight to MySQL with no size limit and bypasses phpMyAdmin.
Choose which optional PHP extensions your customers may see and toggle for their own accounts. Visible shows it in the customer's PHP panel; Locked forces it on (customers can't turn it off). An extension is installed per PHP version — pick the version below, then Install the ones your customers need; it stays off until each account switches it on. Always on means PHP already loads it for every account on that version (built into PHP, or enabled server-wide by its package), so it cannot be toggled per account. ionCube Loader and SourceGuardian are fetched from their vendors for that exact PHP version; like every Zend extension (OPcache, Xdebug) they can only be enabled for the whole version — PHP itself offers no way to load a Zend extension for one account — so installing one turns it on for every account on that version.
| Extension | Group | State | Visible | Locked | |
|---|---|---|---|---|---|
| Loading… | |||||
Install additional PHP versions for the customers on this server. A newly installed version appears automatically in the PHP switcher of every customer hosted here — nothing else to configure. (Each server is managed separately: if you run more than one server, install the version on each where you want it available.) Installing runs in the background and takes about 1–2 minutes; the row flips to installed when it finishes. Versions come from the official ondrej/php repository; each adds roughly 30–60 MB of disk plus a running FPM process. A version can only be removed once no account still uses it. PHP 5.6 is offered for legacy apps only — it is end-of-life (no upstream security fixes), so use it only when an old site truly needs it.
| Version | State | Accounts | |
|---|---|---|---|
| Loading… | |||
Install optional software and services on this server — the tools your customers ask for: FFmpeg & ImageMagick (media), Redis/Memcached (caching), ClamAV (the antivirus behind the Virus Scan tool), plus Git, Composer, Ghostscript, wkhtmltopdf, rclone, Python, Go, Ruby, LibreOffice and ExifTool. Installing runs the server's own package manager (apt/dnf) and takes from a few seconds to a couple of minutes; large items like LibreOffice can be a few hundred MB. Items marked Managed ship with the panel (Apache, PHP, MariaDB) or are handled elsewhere (Node under App Servers) and can't be changed here. Once a tool is installed it is available to every account on this server.
| Software | Tier | State | |
|---|---|---|---|
| Loading… | |||
| Name | Size | Modified |
|---|
| Name | Original location | Deleted |
|---|
| Name | Location | Size | Modified |
|---|
| Name | Full name |
|---|
| User | Full username |
|---|
The account holder signs into this panel with username and the password you set here.
Change the plan or the primary domain for this account. The username can't be changed — it's the account's identity on the server.
Changing the primary domain rebuilds the site's DNS zone and re-issues HTTPS for the new domain. Email set up under the old domain is not moved.
A backup is one archive containing the account's website files and its databases. Stored on this server. You can download it to keep an off-server copy. Restoring overwrites the current files and databases with the backup's contents — you'll be asked to confirm first.
| Backup file | Size | Created | |
|---|---|---|---|
| Loading… | |||
Download or restore just your databases or just your website files — you don't need a full account backup. Restoring overwrites the matching data, so you'll be asked to confirm first.
Every database on your account — click one to download a compressed .sql.gz dump.
Streams a .sql or .sql.gz dump straight into MySQL — any size.
Saves your account's website files and databases together as one .tar.gz archive you can keep off-server.
Upload a .zip, .tar.gz or .tgz archive of your site; its contents are extracted into your web root (public_html) — the same place a full restore puts files.
| Address | Quota (MB) | |
|---|---|---|
| Loading… | ||
Each rule: if the chosen header contains your text, do the action. Rules run in order.
| From | Forwards to | |
|---|---|---|
| Loading… | ||
Install a web app with one click. Files are placed as the account's own user, and an isolated database is created automatically. Leave the password blank to have a strong one generated (shown once).
| App | Location | Admin | |
|---|---|---|---|
| Loading… | |||
Run a Node.js, Python or Ruby app on your account. It runs as your own user behind an Apache reverse proxy on the domain you choose (point that domain's DNS at this server). Put your code under your home directory first, then create the app and “Install deps” if it uses npm/pip/bundler packages. Python apps are served by gunicorn — the entry point is module:callable (e.g. app:app). Ruby (Rack) apps are served by puma — the startup file is your rackup config (e.g. config.ru), and a Gemfile is bundle-installed automatically.
| App | Status | |
|---|---|---|
| Loading… | ||
Install CPAN modules into your account's own Perl library (~/perl5) — nothing is installed system-wide. Use them from your scripts with use local::lib '~/perl5';, or add ~/perl5/lib/perl5 to PERL5LIB. Installing a module also pulls its dependencies (tests skipped).
| Installed module | |
|---|---|
| Loading… | |
| Amount | Status | Method | Issued |
|---|---|---|---|
| Loading… | |||
Scheduled tasks that run as your account. Schedule = cron format (minute hour day month weekday), e.g. */15 * * * *, or a keyword like @daily.
| Schedule | Command | |
|---|---|---|
| Loading… | ||
Choose the PHP version this site runs on. Only versions installed on this server are offered. The default for new sites is PHP 8.3 (stable, widely compatible); a newer version is available if an app needs it. The site keeps running as your own account user.
Common php.ini directives for this account only — applied to its own PHP-FPM pool. Each value is capped by your plan's ceiling. Changes take effect immediately.
Optional PHP extensions for this account only — each is enabled in your own PHP-FPM pool, never for other accounts. Only extensions installed for your PHP version are shown; greyed-out ones are always on and cannot be switched off. Need one that isn't listed? Ask your provider to install it for your PHP version. Changes take effect immediately.
The most recent entries from this site's own access log (every request) and error log (Apache + PHP errors). These are private to this account. Log lines contain visitor-supplied text and are shown exactly as recorded.
A summary of this site's own access log, generated with GoAccess. Numbers cover the whole retained log. Page URLs, referrers and browser strings come from visitors and are shown exactly as recorded.
Upload/download your website files with any client (FileZilla, WinSCP, Cyberduck). The login is this account's own user, locked to its own files — it cannot reach any other account. SFTP & FTP share the same username and password; setting a password on either updates both.
Turn this on if your FTP program only offers plain "FTP". Prefer FTPS (explicit TLS) — same port, encrypted. Plain FTP works too but sends your password unencrypted.
A shell login lets this account run commands on the server over SSH — git, composer, wp-cli, npm — as its own Linux user, so it can only touch its own files, just like its website does. It is off by default and only the account's provider can turn it on.
Granting a shell lifts this account's SFTP chroot: SFTP and SCP keep working over the same login, but the account is no longer confined to its home folder by SSH. Turning shell access off puts the chroot back.
Shell access is granted by your hosting provider — contact them if you need it.
Password-protect a folder in your site. Visitors must sign in (HTTP Basic authentication) before they can open anything inside it.
| Folder | Username | |
|---|---|---|
| Loading… | ||
Deny access to your site from specific addresses. One entry per line — an IPv4/IPv6 address or a CIDR range (e.g. 203.0.113.4 or 10.0.0.0/8). Saving replaces the whole list.
Stop other websites from embedding your files. Requests for the protected file types are only served when the referer is your own site or one of the allowed domains.
Add SSH public keys for password-less, key-based SFTP login (ssh-ed25519 / ssh-rsa / ecdsa). Keys take effect once SFTP is enabled for this account.
| Type | Label | Key | |
|---|---|---|---|
| Loading… | |||
Scans this account's home directory with ClamAV and reports anything suspicious. Nothing is deleted or quarantined automatically — review findings and remove files yourself via the File Manager. Large sites can take a few minutes.
| File | Signature |
|---|
Shows which folders and databases use your disk. Sizes are measured live and shown relative to your largest item, so you can see at a glance where space is going. Nothing is changed or deleted — to free space, remove files in the File Manager or drop unused databases.
| Location | Size | Usage |
|---|
This panel serves your sites with Apache, so your .htaccess files work as they are — rewrites, redirects, protected files, basic-auth and headers all take effect with no translation. One thing needs care: PHP runs as your own user through PHP-FPM, so php_value and php_flag lines are not understood and would make Apache return a 500 for the whole folder. This check finds those lines and safely switches them off, then lists them below so you can set the same values in PHP Settings, where they really apply. It runs on its own right after a cPanel import; run it again here whenever you change an .htaccess.
| Line | Directive | What happened |
|---|
Incoming mail is scored by the server's spam filter (rspamd); messages at or above the threshold are tagged and moved to Junk. Mail is never rejected — turning filtering off simply delivers everything to the Inbox. Changes apply to all mailboxes on this account's domains, for new incoming mail.
Customize the page visitors see for each error (e.g. a branded 404). Leave a code blank to use the server default — it's plain HTML served from your own site.
Add extra sites to this account: an addon domain or a subdomain (each gets its own folder in your account, served as your user), or a redirect to another URL.
| Domain | Type | Location / target | |
|---|---|---|---|
| Loading… | |||
| Name | Type | Value | TTL | |
|---|---|---|---|---|
| Loading… | ||||
Cryptographically signs this zone so resolvers can detect tampering with your DNS answers.
Add this DS record at your domain registrar to complete DNSSEC. Until the registrar publishes it, signing has no effect at the parent zone.
Paste a certificate you already own (PEM format). It must match the domain and its private key.
Type below to confirm.