Features

One panel for the whole server.

Every feature below ships in the free download. Nothing is held back for a paid edition, because there isn't one.

Coming from another panel? Compare ArcPanel with cPanel, aaPanel, CyberPanel, CloudPanel or read ArcPanel and HestiaCP.

New in ArcPanel 2.0

Beyond the HestiaCP baseline

A new web interface

Every page rebuilt on Laravel at the root URL: a role-aware shell, command palette, notification tray, Nocturne and Light themes.

Node.js platform

Per-user Node versions with pnpm and yarn, and Node apps kept alive by pm2 behind NGINX and SSL.

Docker app store

Six curated apps pinned by digest, run as the hosting user, with snapshots and automatic rollback.

Resellers and ports

A reseller role with its own customers, and a port registry that hands out ports to users and apps.

01

Web domains

Host each site with the stack it needs, picked from a catalog of templates.

  • NGINX alone or in front of Apache2, PHP-FPM 7.4 to 8.5 per domain
  • PHP Manager: versions with end-of-life dates, extensions, php.ini and PHP-FPM profiles per version
  • Template picker with cards: static, SPA, Next.js, Nuxt, Ghost, Strapi
  • Django, Flask and FastAPI, Rails, Go, Laravel Octane, hardened WordPress
  • Template variables, such as a backend port from the port registry
  • Aliases, redirects, caching, statistics and downloadable logs
  • Quick Install for WordPress, Nextcloud, Joomla and 20 more, run in the background
02

Node.js and Docker apps

Modern apps next to classic PHP sites, on the same domains and certificates.

  • Node.js versions per user from a signed cache, with pnpm and yarn
  • Node apps under pm2: status, CPU and memory, logs, environment
  • App processes: Laravel Octane, queue workers and Horizon, Gunicorn, Uvicorn, Celery, Puma, Sidekiq or Go binaries, each in its own systemd unit as the hosting user
  • Docker store: Uptime Kuma, n8n, Gitea, Vaultwarden, Miniflux, Redis
  • Containers run as the hosting user, without capabilities, inside the user's limits
  • Updates take a data snapshot first and roll back if the app fails its health check
  • System runtimes for admins: Python 3, Go, Ruby, FFmpeg, ImageMagick, build tools
03

SSL and DNS

Certificates and zones that look after themselves.

  • Let's Encrypt with automatic renewal, wildcards included
  • Your own certificates, and a CSR generator
  • BIND zones with templates and DNSSEC
  • DNS clustering across several servers
04

Mail

A complete mail server, filters included.

  • Exim and Dovecot with IMAP and POP3
  • DKIM signing, and the MX, SPF, DKIM and DMARC records to publish
  • ClamAV, SpamAssassin and Sieve filters
  • Forwarders, autoresponders, catch-all, rate limits per account
  • Roundcube or SnappyMail webmail
05

Databases and cron

The engines your applications expect, and the jobs that keep them tidy.

  • MariaDB or MySQL 8, and PostgreSQL
  • phpMyAdmin and phpPgAdmin with single sign-on
  • Cron jobs per user
  • Database limits per hosting package
06

Users and resellers

Share one server safely between many owners.

  • Administrator, reseller and user roles
  • Customers page for resellers, with usage bars and quick actions
  • Hosting packages with quotas, bounded by the reseller's own package
  • Login-as for support work
  • Port registry: allocations, sub-allocations and public ports
  • Two-factor login, SSH keys and access keys per user
07

Files and backups

Work on files in the browser, and get data back when you need it.

  • File manager with resumable uploads, zip and extract, search
  • Code editor and previews for images, PDFs and media
  • Scheduled backups to local, FTP, SFTP, Backblaze B2 or Rclone targets
  • Incremental restic backups with a snapshot browser
  • Database dumps of Docker apps taken before each backup
  • Import accounts from cPanel and DirectAdmin
08

Security

Hardened defaults, managed from the panel.

  • nftables firewall for IPv4 and IPv6, with IP lists and country blocklists
  • Fail2Ban for SSH, mail, FTP and the panel
  • Every action goes through a v-* command; the web UI never runs as root
  • Users only ever see what they own, checked on every request
  • Malware scan for PHP webshells, an optional plugin run as the hosting user every night; findings are reported, never removed on their own
09

Server and automation

Run the server from the browser — or script all of it.

  • Services, server settings and configuration editors
  • PHP versions and package updates as background tasks
  • Logs, statistics and a task monitor
  • Web terminal and global search
  • More than 500 v-* commands and a REST API with access keys
  • Access keys limited to addresses and given an expiry, and monitoring keys that never read files or secrets
  • AI agent skills and the arc CLI for REST API v2
  • White label: your logo and name on the panel
On the roadmap

What we are planning next

Planned for ArcPanel 3.0, after 2.6; not released yet. Ideas are welcome on GitHub.

Job Center

Every long-running task as a job, with live logs, cancel and retry.

Alerts

Full disks, stopped services and expiring certificates sent to email, Telegram, Slack, Discord or Mattermost.

Server and Site Doctor

Read-only checks of the server and every domain that explain a problem and offer the fix.

Git deploy

Deploy a site from a repository or from your CI, with releases and rollback.

See the full roadmap →

See it on your own server.

Pick your services, copy one command, log in.

Install ArcPanel Read the docs