# cPanel vs CyberPanel (2026): Cost, Features and Security

Source: https://srvscripts.com/guides/cpanel-vs-cyberpanel/
Updated: 2026-10-07
Publisher: srvScripts (https://srvscripts.com/)

**Short answer:** CyberPanel is free and open source (GPLv3) and built around OpenLiteSpeed; cPanel is a paid licence (from $29.99/month for one account on a VPS, checked 7 October 2026) with Apache by default and the largest ecosystem of hosting tools, migrations and support. Pick CyberPanel for a single-owner VPS where cost matters and you can harden it yourself; pick cPanel for selling hosting to customers, for reseller setups, or when you need vendor support and well-trodden migration paths. Both had actively exploited authentication bypass flaws in the last two years, so whichever you choose, keep it updated and restrict who can reach the panel ports.

Prices come from the vendors’ own pages, checked on 7 October 2026 (linked below). The cPanel details were checked on our lab server (AlmaLinux 9.8, cPanel & WHM 11.138); we do not run CyberPanel in our labs, so its details come from its website, knowledge base and GitHub repository on the same day.

## Who each panel suits

|  | cPanel & WHM | CyberPanel |
| --- | --- | --- |
| Licence | Proprietary, monthly or annual licence per server, priced by number of cPanel accounts | Open source core (GPLv3), free; optional paid add-ons |
| Best fit | Hosting providers, resellers, agencies with many client accounts, teams that want vendor support | Developers and site owners running their own VPS; small agencies on a budget; OpenLiteSpeed/LSCache users |
| Web server | Apache (EasyApache 4) by default; LiteSpeed Enterprise as a paid option | OpenLiteSpeed by default; LiteSpeed Enterprise through a LiteSpeed + CyberPanel licence |
| Weak spots | Licence cost grows with the number of accounts | Smaller ecosystem, fewer third-party integrations, serious security incidents in 2024 and 2026 |

## Cost: prices compared

Prices last checked: 7 October 2026, on [cpanel.net/pricing](https://cpanel.net/pricing/), [CyberPanel’s add-ons page](https://cyberpanel.net/cyberpanel-addons) and [LiteSpeed’s CyberPanel bundle store page](https://store.litespeedtech.com/store/index.php?rp=/store/litespeed-web-server-cyberpanel-bundle). cPanel prices are cPanel’s own direct prices excluding VAT; data centres and resellers sell cPanel licences at their own prices, which can be higher or lower, so check your provider.

| Product | Price shown | What you get / limits |
| --- | --- | --- |
| cPanel Solo | $29.99/mo monthly, or $27.46/mo billed annually | 1 account; Cloud/VPS only |
| cPanel Admin | $35.99/mo, or $32.96/mo annually | Up to 5 accounts; Cloud/VPS only |
| cPanel Pro | $53.99/mo, or $49.46/mo annually | Up to 30 accounts; Cloud/VPS only |
| cPanel Premier | $69.99/mo (billed monthly) | 100 accounts, then $0.49 per extra account; Cloud/VPS and Metal/Dedicated |
| CyberPanel core | $0 | Websites, Postfix/Dovecot mail, PowerDNS, PHP, SSL, file manager, databases, Docker manager, FTP, cron, basic firewall, OpenLiteSpeed |
| CyberPanel premium add-ons (all 6) | $59/year or $169 lifetime (the page also advertises plans “starting at just $7.99/month”) | SSL V2, WordPress Manager Pro, Backup V2, Email Debugger, Root File Manager, Rspamd Manager; licence tied to the server IP |
| CyberPanel .htaccess Module | $59/year or $199 lifetime | Apache .htaccess compatibility for OpenLiteSpeed; add-ons + module bundle $99/year |
| LiteSpeed + CyberPanel bundles | From $0/mo (Free Starter), $11 (Site Owner), $17 (Site Owner Plus), $28 (Web Host Lite), $38 (Web Host Essential), $48 (Web Host Professional), $70 (Web Host Enterprise), $97/mo (Web Host Elite) | LiteSpeed Enterprise with CyberPanel on one server; leased only, no owned option; Free Starter is 1 domain and 2 GB RAM; 12 months for the price of 11 on annual billing |

Two things make the comparison less simple than it looks. First, cPanel counts accounts, not domains: one account can hold many addon domains, so an owner with ten personal sites may fit in Solo or Admin. Second, a cPanel server that wants LiteSpeed Enterprise needs a separate LiteSpeed licence on top of the cPanel one, while CyberPanel’s LiteSpeed bundles include the panel side. For example, ten client sites as ten separate accounts need cPanel Pro ($53.99/month monthly); on CyberPanel the same sites cost $0 with OpenLiteSpeed, or $59/year if you want the add-ons. Our [cPanel pricing guide](/guides/cpanel-pricing-2026-licensing/) explains the account tiers in more detail.

## Features side by side

| Area | cPanel & WHM | CyberPanel |
| --- | --- | --- |
| Web server | Apache 2.4 via EasyApache 4 (our lab: ea-apache24); LiteSpeed Enterprise optional | OpenLiteSpeed; switch to LiteSpeed Enterprise in Server Status > LiteSpeed Status with a licence key |
| .htaccess | Native (Apache) or LiteSpeed Enterprise | OpenLiteSpeed supports rewrite rules; full .htaccess compatibility is the paid module |
| Mail | Exim with Dovecot | Postfix with Dovecot; Rspamd manager is a paid add-on |
| DNS | PowerDNS or BIND (setupnameserver lists both) | PowerDNS |
| Accounts and resellers | WHM with packages, resellers, feature lists, per-account isolation tools | Users and packages; fewer hosting-business features than WHM |
| Backups | Built-in WHM backups, plus JetBackup and other paid plugins | Local and remote backups; incremental Backup V2 (SFTP, S3, Google Drive) is a paid add-on |
| WordPress | WP Toolkit; WP Squared is a separate WordPress-only product | WordPress Manager; staging/cloning in the Pro add-on |
| Extras | Large plugin market (Imunify360, CloudLinux, JetBackup, LiteSpeed) | Docker manager, n8n manager |
| Operating systems | AlmaLinux, CloudLinux and Ubuntu; check cPanel’s system requirements for the exact versions in each release | Ubuntu 22.04/24.04, AlmaLinux 8/9/10, Rocky 8/9, RHEL 8/9, CloudLinux 8 and others, per its GitHub README |
| Support | Vendor ticket support | Community forum and documentation; paid services from the CyberPanel team |

## OpenLiteSpeed vs LiteSpeed Enterprise on CyberPanel

CyberPanel installs OpenLiteSpeed, the free open-source edition. It is fast and works with LSCache, but it reads `.htaccess` rewrite rules differently from Apache and needs a restart for some changes, which is why CyberPanel sells a separate .htaccess module. If a site needs full Apache compatibility, you can move the same CyberPanel server to LiteSpeed Enterprise: CyberPanel’s [knowledge base](https://cyberpanel.net/KnowledgeBase/?p=249) describes entering the licence key under Server Status > LiteSpeed Status and choosing Switch. LiteSpeed’s [licence documentation](https://docs.litespeedtech.com/licenses/products/lswscp/) says the CyberPanel bundles have the same limits as the matching non-CyberPanel licences and are currently available as leased licences only. For the server-level differences, see [LiteSpeed vs OpenLiteSpeed](/guides/litespeed-vs-openlitespeed/).

## Security track record

Both panels run as root-level services and both have had serious, exploited bugs. The facts, from NVD and reporting at the time:

- **CyberPanel, October 2024:** [CVE-2024-51567](https://nvd.nist.gov/vuln/detail/CVE-2024-51567) and CVE-2024-51378 (CVSS 10.0) let unauthenticated attackers bypass login and run commands because a security middleware only filtered POST requests; CVE-2024-51568 was a similar unauthenticated command injection in the file manager upload. [BleepingComputer reported](https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/) on 29 October 2024 that the PSAUX ransomware campaign hit over 22,000 exposed CyberPanel instances; the fix shipped in 2.3.8. CISA added CVE-2024-51567 to its Known Exploited Vulnerabilities catalogue on 7 November 2024.

- **CyberPanel, 2026:** NVD lists [CVE-2026-71966](https://nvd.nist.gov/vuln/detail/CVE-2026-71966) (published 10 August 2026, CVSS 8.8), an authenticated command injection in the remote backup transfer feature of 2.4.3, and CVE-2026-65916/65917 (published 23 July 2026), which let authenticated panel users touch other tenants’ backups. These need a logged-in user, but matter on any server with more than one customer.

- **cPanel, April 2026:** [CVE-2026-41940](https://nvd.nist.gov/vuln/detail/CVE-2026-41940), an authentication bypass in the cPanel and WHM login flow (published 29 April 2026), was added to CISA’s Known Exploited Vulnerabilities catalogue on 30 April 2026. Fixed builds are listed in our [cPanel CVE build numbers](/guides/cpanel-cve-build-numbers-2026/) guide.

The practical difference is process, not a clean record. cPanel publishes fixed build numbers per update tier and can update itself nightly; CyberPanel’s NVD entries point to fix commits on GitHub, so you need to follow its repository and update deliberately. On either panel, limit the admin ports (2087 for WHM, 8090 for CyberPanel) to known IPs, use two-factor login where the panel offers it, and keep off-server backups.

## Migration path in each direction

### cPanel to CyberPanel

CyberPanel has an importer for standard cPanel account backups (the `.tar.gz` files made by `pkgacct` or WHM backups; see [cPanel pkgacct and restorepkg](/guides/cpanel-restorepkg-pkgacct-cli/)). Its [knowledge base](https://cyberpanel.net/KnowledgeBase/home/auto-import-cpanel-sites-to-cyberpanel/) gives this command, pointed at a folder of backups:

```
/usr/local/CyberCP/bin/python /usr/local/CyberCP/plogical/cPanelImporter.py --path /home/backup
```

The importer’s source code has steps for the main site, addon and subdomains, DNS records, SSL, databases, email accounts, cron jobs and file permissions. The knowledge base does not list limits, so migrate one test account first, then check PHP version, mail logins, cron jobs and any `.htaccess` rules (OpenLiteSpeed handles them differently).

### CyberPanel to cPanel

cPanel’s [Transfer Tool](https://support.cpanel.net/hc/en-us/articles/4402530377495-What-control-panels-does-the-Transfer-Tool-support) supports cPanel, DirectAdmin, Ensim and Plesk as sources, not CyberPanel, and cPanel’s free migration service covers Plesk and DirectAdmin. Moving from CyberPanel is a manual job: create the accounts in WHM, copy files with `rsync`, dump and import databases with `mariadb-dump`, move mail with an IMAP sync tool, and re-create DNS and cron entries. Lower DNS TTLs a day before and follow [our zero-downtime migration checklist](/guides/migrate-cpanel-accounts-new-server/) for the cut-over. If you would rather not do it yourself, our [services](/services/) include panel migrations.

## Which should you choose?

| Situation | Better fit | Reason |
| --- | --- | --- |
| Selling shared hosting or reseller accounts | cPanel | WHM packages and resellers, customer-familiar interface, billing integrations, vendor support |
| One owner, a few sites on a VPS, tight budget | CyberPanel | $0 licence; OpenLiteSpeed and LSCache perform well for WordPress |
| Agency with 10 to 30 client accounts | Either; price both | cPanel Pro costs $53.99/month; CyberPanel is cheaper but you carry more of the admin and security work |
| Sites that rely on complex Apache .htaccess | cPanel (Apache or LiteSpeed Enterprise), or CyberPanel with LiteSpeed Enterprise or the .htaccess module | OpenLiteSpeed alone may break some rules |
| Compliance or contractual need for vendor support | cPanel | Ticket support and published security build numbers |
| Docker or n8n alongside websites | CyberPanel | Built-in Docker and n8n managers |

**Official documentation:** [cPanel pricing](https://cpanel.net/pricing/) · [CyberPanel add-ons and pricing](https://cyberpanel.net/cyberpanel-addons) · [LiteSpeed + CyberPanel bundle](https://store.litespeedtech.com/store/index.php?rp=/store/litespeed-web-server-cyberpanel-bundle) · [NVD: CVE-2024-51567](https://nvd.nist.gov/vuln/detail/CVE-2024-51567)

**Related:** [cPanel Pricing 2026: Licensing Explained Without Mistakes](/guides/cpanel-pricing-2026-licensing/) · [LiteSpeed vs OpenLiteSpeed for Hosting Servers: Which to Pick](/guides/litespeed-vs-openlitespeed/) · [cPanel restorepkg and pkgacct: Backup and Restore from CLI](/guides/cpanel-restorepkg-pkgacct-cli/) · [cPanel CVE Build Numbers 2026: Is Your Server Safe?](/guides/cpanel-cve-build-numbers-2026/) · [Migrate cPanel accounts to a new server without customers noticing](/guides/migrate-cpanel-accounts-new-server/)

**See also:** [Hosting Control Panel Pricing 2026: cPanel vs DirectAdmin vs Plesk](/guides/control-panel-pricing-2026/) · [Best cPanel Alternatives in 2026: Free and Paid Panels Compared](/guides/best-cpanel-alternatives/) · [cPanel vs DirectAdmin (2026): Price, Features and Migration](/guides/cpanel-vs-directadmin/)

## Frequently asked questions

### Is CyberPanel really free?

Yes. The core panel is open source under the GPLv3 and costs nothing. Optional add-ons cost $59 a year or $169 lifetime, and the .htaccess module is sold separately (prices checked 7 October 2026).

### How much does cPanel cost in 2026?

On cPanel’s own site on 7 October 2026: Solo $29.99/month (1 account), Admin $35.99 (5), Pro $53.99 (30) and Premier $69.99 (100 accounts, then $0.49 each), excluding VAT. Annual billing is cheaper for Solo, Admin and Pro, and resellers set their own prices.

### Is CyberPanel safe to use?

It can be, if you update it promptly and restrict access to port 8090. It had a critical, mass-exploited authentication bypass in October 2024 and further backup-related flaws in 2026, so treat updates as urgent.

### Does CyberPanel support LiteSpeed Enterprise?

Yes. You can switch an OpenLiteSpeed install to LiteSpeed Enterprise with a licence key from the LiteSpeed + CyberPanel bundles, which are leased only and start with a free one-domain Starter licence.

### Can I migrate from cPanel to CyberPanel?

Yes. CyberPanel’s cPanelImporter.py restores standard cPanel account backups from a folder. Test one account first and check mail, cron, PHP and .htaccess behaviour before moving the rest.

### Can cPanel import CyberPanel accounts?

Not with the Transfer Tool, which supports cPanel, DirectAdmin, Ensim and Plesk. Moving from CyberPanel to cPanel is a manual migration of files, databases, mail and DNS.