Loading…
What each plan gives your customers. These limits are set by the administrator.
| Package | Disk | Bandwidth | Websites | Databases |
|---|---|---|---|---|
| Loading… | ||||
| Username | Domain | Package | Status |
|---|
Set how your customers see the panel after they log in — your name, logo and accent colour (both light & dark). It applies only to your own customers. The shared login page is unchanged.
Run everything under your OWN brand on this shared server: your customers log in at panel.<yourdomain> and their DNS is served by your nameservers — they never see the provider. All records below point to server IP ….
…
Open
This is your own branded panel on your own domain — use it instead of the provider's panel. HTTPS issues automatically once panel.<yourdomain> points to the server IP above.
Where you are emailed if something goes wrong with your own domain on this server — today, if your nameserver domain ends up with no DNS zone here and stops resolving, which takes your panel, site and email down with it. The same alert also appears as a red banner in your panel. An outage alert repeats once a day until it is fixed, and you get a note when it clears. Leave this empty and the alert goes to the server's administrator instead — it is never simply dropped.
Protect your reseller login with a second factor from your phone's authenticator app. It applies only to your own login.
A few steps and customers can buy from you. This card disappears once you're ready.
| Username | Domain | Package | Status | |
|---|---|---|---|---|
| Loading… | ||||
A package is a hosting plan — it sets what each account on it may use: disk, bandwidth, databases, and per-account CPU, memory and database limits. Leave a field at 0 for unlimited. Saving a package applies the new limits to every account already using it.
| Name | Disk | Bandwidth | Domains | DBs | CPU cap | RAM cap | DB conns | |
|---|---|---|---|---|---|---|---|---|
| Loading… | ||||||||
Create a reseller and choose what they may sell. They log in to their own limited panel and see only their own accounts.
| Username | Packages | Max accounts | Used | Alert email | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Sell hosting to your own customers: enter your gateway credentials, turn a gateway on, and create plans. Secrets are stored server-side and never shown again.
…
Open
Customers pick a plan and pay here; their account is created automatically once payment is verified. It needs at least one active plan and one enabled gateway (below).
Enter your PayPal REST app credentials (from the PayPal Developer site — no coding). Leave a secret blank to keep the saved one. Once saved, PayPal shows as configured and you can switch it on above. How do I get these? ↗
| Plan | Package | Price | Cycle | Status | |
|---|---|---|---|---|---|
| Loading… | |||||
Your business name, logo and accent on the public signup page (/signup) — so customers buy under YOUR brand, not "MaxiCP".
Enter a license key to activate a paid plan — no reinstall needed. Get one from your MaxiCP provider portal.
Applies the latest signed release and restarts the panel — accounts, data and hosted sites are untouched. Updates also apply automatically each day.
Upload a cPanel account backup (cpmove-*.tar.gz) — no SSH needed. Preflight shows what will be imported; Import recreates the account (isolated user, files, databases, mail, DNS, domains, PHP version). The archive is treated as untrusted — only the account's own space is written.
These are the nameservers your customers point their domains to. The panel serves DNS for every hosted domain — but the nameserver names only work once you register them at your own domain's registrar. Below is a live check of whether they resolve to this server, and whether this server actually serves a DNS zone for the domain they live under. Both halves matter: if you delegate that domain here while this server has no zone for it, every lookup is refused and the whole domain — website, email and this panel's address — goes offline.
ns1 → your server IP and ns2 → your server IP.ns1.<domain> and ns2.<domain> → your server IP.ns1/ns2.<domain>: add that domain here as a hosting account first, so this server serves a DNS zone for it. Glue alone is not enough — a domain delegated to a server that has no zone for it stops resolving entirely. The check above tells you which case you are in.Whether email from this server can actually reach the outside world. Delivery to a recipient's mail server always uses port 25 — that is the SMTP standard, not a setting — and many hosting providers block it to stop spam. When they do, messages sit in the queue for days and then bounce, which looks exactly like "sent but never arrived". If that is your situation, point outgoing mail at a relay below and it starts working immediately.
Where this server emails you when something needs you — today, when a domain pointed at your nameservers has no DNS zone here and goes offline. Alerts are also shown in the panel and written to the server log; email is the one that reaches you when you are not looking at the panel. An outage alert repeats once a day until it is fixed, and you get a note when it clears. Leave this empty to turn alert email off. Mail is handed to this server's own mail service — send a test to confirm it actually leaves the machine.
Maximum file size for phpMyAdmin → Import, server-wide (phpMyAdmin runs one shared pool for every account on this server). For any-size restores, use the customer's Databases → “Import / Restore” instead — it streams straight to MySQL with no size limit and bypasses phpMyAdmin.
Choose which optional PHP extensions your customers may see and toggle for their own accounts. Visible shows it in the customer's PHP panel; Locked forces it on (customers can't turn it off). An extension is installed per PHP version — pick the version below, then Install the ones your customers need; it stays off until each account switches it on. Always on means PHP already loads it for every account on that version (built into PHP, or enabled server-wide by its package), so it cannot be toggled per account. ionCube Loader and SourceGuardian are fetched from their vendors for that exact PHP version; like every Zend extension (OPcache, Xdebug) they can only be enabled for the whole version — PHP itself offers no way to load a Zend extension for one account — so installing one turns it on for every account on that version.
| Extension | Group | State | Visible | Locked | |
|---|---|---|---|---|---|
| Loading… | |||||
Install additional PHP versions for the customers on this server. A newly installed version appears automatically in the PHP switcher of every customer hosted here — nothing else to configure. (Each server is managed separately: if you run more than one server, install the version on each where you want it available.) Installing runs in the background and takes about 1–2 minutes; the row flips to installed when it finishes. Versions come from the official ondrej/php repository; each adds roughly 30–60 MB of disk plus a running FPM process. A version can only be removed once no account still uses it. PHP 5.6 is offered for legacy apps only — it is end-of-life (no upstream security fixes), so use it only when an old site truly needs it.
| Version | State | Accounts | |
|---|---|---|---|
| Loading… | |||
| Name | Size | Modified |
|---|
| Name | Original location | Deleted |
|---|
| Name | Full name |
|---|
| User | Full username |
|---|
The account holder signs into this panel with username and the password you set here.
A backup is one archive containing the account's website files and its databases. Stored on this server. You can download it to keep an off-server copy. Restoring overwrites the current files and databases with the backup's contents — you'll be asked to confirm first.
| Backup file | Size | Created | |
|---|---|---|---|
| Loading… | |||
| Address | Quota (MB) | |
|---|---|---|
| Loading… | ||
Each rule: if the chosen header contains your text, do the action. Rules run in order.
| From | Forwards to | |
|---|---|---|
| Loading… | ||
Install a web app with one click. Files are placed as the account's own user, and an isolated database is created automatically. Leave the password blank to have a strong one generated (shown once).
| App | Location | Admin | |
|---|---|---|---|
| Loading… | |||
Run a Node.js, Python or Ruby app on your account. It runs as your own user behind an Apache reverse proxy on the domain you choose (point that domain's DNS at this server). Put your code under your home directory first, then create the app and “Install deps” if it uses npm/pip/bundler packages. Python apps are served by gunicorn — the entry point is module:callable (e.g. app:app). Ruby (Rack) apps are served by puma — the startup file is your rackup config (e.g. config.ru), and a Gemfile is bundle-installed automatically.
| App | Status | |
|---|---|---|
| Loading… | ||
Install CPAN modules into your account's own Perl library (~/perl5) — nothing is installed system-wide. Use them from your scripts with use local::lib '~/perl5';, or add ~/perl5/lib/perl5 to PERL5LIB. Installing a module also pulls its dependencies (tests skipped).
| Installed module | |
|---|---|
| Loading… | |
| Amount | Status | Method | Issued |
|---|---|---|---|
| Loading… | |||
Scheduled tasks that run as your account. Schedule = cron format (minute hour day month weekday), e.g. */15 * * * *, or a keyword like @daily.
| Schedule | Command | |
|---|---|---|
| Loading… | ||
Choose the PHP version this site runs on. Only versions installed on this server are offered. The default for new sites is PHP 8.3 (stable, widely compatible); a newer version is available if an app needs it. The site keeps running as your own account user.
Common php.ini directives for this account only — applied to its own PHP-FPM pool. Each value is capped by your plan's ceiling. Changes take effect immediately.
Optional PHP extensions for this account only — each is enabled in your own PHP-FPM pool, never for other accounts. Only extensions installed for your PHP version are shown; greyed-out ones are always on and cannot be switched off. Need one that isn't listed? Ask your provider to install it for your PHP version. Changes take effect immediately.
The most recent entries from this site's own access log (every request) and error log (Apache + PHP errors). These are private to this account. Log lines contain visitor-supplied text and are shown exactly as recorded.
A summary of this site's own access log, generated with GoAccess. Numbers cover the whole retained log. Page URLs, referrers and browser strings come from visitors and are shown exactly as recorded.
Upload/download your website files with any client (FileZilla, WinSCP, Cyberduck). The login is this account's own user, locked to its own files — it cannot reach any other account. SFTP & FTP share the same username and password; setting a password on either updates both.
Turn this on if your FTP program only offers plain "FTP". Prefer FTPS (explicit TLS) — same port, encrypted. Plain FTP works too but sends your password unencrypted.
A shell login lets this account run commands on the server over SSH — git, composer, wp-cli, npm — as its own Linux user, so it can only touch its own files, just like its website does. It is off by default and only the account's provider can turn it on.
Granting a shell lifts this account's SFTP chroot: SFTP and SCP keep working over the same login, but the account is no longer confined to its home folder by SSH. Turning shell access off puts the chroot back.
Shell access is granted by your hosting provider — contact them if you need it.
Password-protect a folder in your site. Visitors must sign in (HTTP Basic authentication) before they can open anything inside it.
| Folder | Username | |
|---|---|---|
| Loading… | ||
Deny access to your site from specific addresses. One entry per line — an IPv4/IPv6 address or a CIDR range (e.g. 203.0.113.4 or 10.0.0.0/8). Saving replaces the whole list.
Stop other websites from embedding your files. Requests for the protected file types are only served when the referer is your own site or one of the allowed domains.
Add SSH public keys for password-less, key-based SFTP login (ssh-ed25519 / ssh-rsa / ecdsa). Keys take effect once SFTP is enabled for this account.
| Type | Label | Key | |
|---|---|---|---|
| Loading… | |||
Scans this account's home directory with ClamAV and reports anything suspicious. Nothing is deleted or quarantined automatically — review findings and remove files yourself via the File Manager. Large sites can take a few minutes.
| File | Signature |
|---|
This panel serves your sites with Apache, so your .htaccess files work as they are — rewrites, redirects, protected files, basic-auth and headers all take effect with no translation. One thing needs care: PHP runs as your own user through PHP-FPM, so php_value and php_flag lines are not understood and would make Apache return a 500 for the whole folder. This check finds those lines and safely switches them off, then lists them below so you can set the same values in PHP Settings, where they really apply. It runs on its own right after a cPanel import; run it again here whenever you change an .htaccess.
| Line | Directive | What happened |
|---|
Incoming mail is scored by the server's spam filter (rspamd); messages at or above the threshold are tagged and moved to Junk. Mail is never rejected — turning filtering off simply delivers everything to the Inbox. Changes apply to all mailboxes on this account's domains, for new incoming mail.
Customize the page visitors see for each error (e.g. a branded 404). Leave a code blank to use the server default — it's plain HTML served from your own site.
Add extra sites to this account: an addon domain or a subdomain (each gets its own folder in your account, served as your user), or a redirect to another URL.
| Domain | Type | Location / target | |
|---|---|---|---|
| Loading… | |||
| Name | Type | Value | TTL | |
|---|---|---|---|---|
| Loading… | ||||
Cryptographically signs this zone so resolvers can detect tampering with your DNS answers.
Add this DS record at your domain registrar to complete DNSSEC. Until the registrar publishes it, signing has no effect at the parent zone.
Paste a certificate you already own (PEM format). It must match the domain and its private key.
Type below to confirm.