The day cPanel changed its pricing

In June 2019, cPanel quietly announced a pricing overhaul that would change the economics of shared hosting forever. Licenses that used to cost a fixed monthly fee were restructured to charge per cPanel account — meaning every customer you hosted added to your bill.

For small hosters running a few dozen sites, the impact was manageable. For agencies and developers managing hundreds of client sites, the monthly invoice suddenly multiplied by a factor of three, five, or ten.

The community reacted with frustration. Threads on WHT and Reddit documented operators scrambling to migrate clients to alternatives. Some stuck around despite the cost increase. Others started looking for something different.

We were among those looking for something different.

What the free panels get right — and where they fall short

After the cPanel price shock, several free and open-source panels gained traction: HestiaCP, CloudPanel, CyberPanel, and aaPanel each attracted their share of users.

They're genuinely useful for simple setups. But after running production hosting for a few years, we kept hitting the same walls:

White-label and reseller accounts — HestiaCP has basic multi-user support, but building a proper reseller offering with branded sub-accounts, per-reseller site limits, and isolated billing is either not supported or requires significant custom work.

Modern developer workflows — Git deploy with signed webhooks, Docker container management, staging environments with one-click push-to-production: these features are either absent or bolted on as afterthoughts in most free panels.

UI quality — CloudPanel has a clean design, but the others still ship interfaces that feel like 2012. A developer who works in VS Code and deploys via GitHub Actions will notice.

Security posture — CyberPanel has had a series of high-profile vulnerabilities. aaPanel ships with telemetry that makes European privacy-conscious operators uncomfortable. These aren't dealbreakers, but they're worth noting.

None of this is a criticism of the teams behind these panels — building a full hosting control panel is genuinely hard, and they've done it for free. But after evaluating the options, we concluded that the combination of agency features + modern dev workflows + clean UI + trustworthy security didn't exist in a single product.

What we set out to build

ShadowPanel started as an internal tool. We needed a panel for hosting client sites that:

Ran on our own VPS — no per-account phone-home, no dependency on a third-party control plane.
Covered the full stack — DNS, email, SSL, databases, backups, firewalls — not a deployer that stops at Nginx.
Supported agency workflows — white-label with custom logo and colors, reseller sub-accounts, per-reseller site quotas.
Felt modern — React UI, dark/light mode, tab-based site management, real-time notifications over SSE.
Was priced fairly — a one-time or annual flat license, not a per-server or per-account subscription that scales against you.

After building it, we decided to release it.

How ShadowPanel works

Every ShadowPanel installation includes:

Site management

Each site gets its own PHP-FPM pool running as a dedicated Linux user, with open_basedir enforcement to prevent cross-site file access. PHP versions from 5.6 to 8.4 can be assigned per site. Nginx vhosts are managed automatically — no manual config editing.

SSL

Let's Encrypt certificates are issued on site creation and automatically renewed when they reach a 30-day expiry threshold. Wildcard certificates are supported.

Databases

Each site gets an isolated MySQL/MariaDB database and dedicated user, provisioned by the privileged daemon — no shared root credentials.

Email

Full email stack via Postfix and Dovecot: create mailboxes, set passwords, access webmail. DNS records are created automatically.

DNS

BIND9 zones and records managed through the panel UI, with support for Hetzner DNS API if you prefer external DNS.

Backups

On-demand and scheduled backups to S3-compatible storage (Pro/Agency). Archives are optionally encrypted with AES-256 GPG.

Security

UFW firewall management, Fail2ban configuration, and CrowdSec integration — all visible and manageable from the dashboard.

Architecture: why we take privilege separation seriously

The part we're most proud of is the architecture. Most panels run everything as root or as a single privileged process. ShadowPanel splits responsibility:

Browser → HTTPS → Nginx
                     └→ Unix socket → API process (user: shadowpanel)
                                          └→ Unix socket → Daemon (user: root)

The API handles authentication, validation, rate limiting, and business logic. It never touches the filesystem or executes commands directly.

The Daemon exposes a strict whitelist of typed, Zod-validated commands via a Unix socket. Every command uses execFile — never exec, never shell string concatenation. A compromised API process cannot escalate privileges beyond what the whitelist allows.

Admin actions that mutate licenses or roles require a second-factor check embedded in the JWT. Redis cache entries for user permissions are HMAC-SHA256 signed so a Redis write-compromise cannot escalate a user to admin.

What ShadowPanel doesn't do yet

Honesty matters here. ShadowPanel is a relatively young product. As of today:

No Windows support — Ubuntu 22.04 and 24.04 LTS only.
No OpenLiteSpeed — Nginx + PHP-FPM only. LiteSpeed is not on the roadmap for now.
No built-in CDN — you'll need to configure Cloudflare or a similar CDN separately.
No marketplace — there's no plugin ecosystem yet. Extensions are on the roadmap.
Community support only on the free tier — paid plans include priority support via email.

We'd rather you install it knowing this than discover it after migration.

Getting started — free tier, no credit card

ShadowPanel's free tier supports 3 websites on a single server, with no time limit and no credit card required.

Install on a fresh Ubuntu 22.04 or 24.04 VPS:

curl -fsSL https://shadowpanel.de/install.sh | bash

The installer takes 5–10 minutes and prints your admin credentials at the end. Open https://<your-domain>:2087 to log in.

If you need more than 3 sites or want Pro features (Git deploy, Docker, staging, auto-backups, 1-click installer), see the pricing page.

Follow along

We ship updates regularly. Subscribe to the changelog to get notified of new releases. If you run into issues, open a support ticket or join the Discord community.

We built this because we needed it ourselves. We hope it's useful to you too.

Self-hosted cPanel alternative: why we built ShadowPanel