Key takeaways
- Free and open source are not the same: HestiaCP, Virtualmin GPL, Webmin and CyberPanel publish source under a standard licence, while CloudPanel and aaPanel are free to use but not clearly under one.
- Every project listed here was pushed to in the last weeks according to GitHub on 30 October 2026, so activity is not what separates them. Licence, scope and support are.
- A hosting panel has root level control, so the security record and your patching habit matter more than the licence.
- Open source does not mean no cost: you pay in time, and some projects fund themselves with a paid edition.
"Open source" is often used for any free hosting panel, but the two are different. This guide checks the licence and the project's activity for each one on GitHub and its own pages, as of 30 October 2026, and says what each leaves to you. It does not claim a security ranking, because that needs a CVE search at the time you choose.
What open source means for a panel
A panel is open source when its code is published under a licence that lets you read, change and share it. That gives you three things: you can audit it, you can fix it if the project stops, and you cannot be locked out by a licence change on the version you already have. It does not give you support, a roadmap, or a guarantee that the code is safe.
The table
| Project | Licence (GitHub, 30 Oct 2026) | Latest release | Last push | Scope |
|---|---|---|---|---|
| HestiaCP | GPL-3.0 | 1.10.5, 14 Sep 2026 | 30 Oct 2026 | Web, mail, DNS, databases on one server |
| Virtualmin GPL | GPL-3.0 | 8.3.0, 29 Sep 2026 | 28 Oct 2026 | Hosting layer on Webmin; Professional is paid |
| Webmin | BSD-3-Clause | 2.670, 21 Sep 2026 | 29 Oct 2026 | General server admin |
| CyberPanel | GPL-3.0 | Releases page shows v1.9.1 (2019); the repo is pushed to regularly | 29 Oct 2026 | OpenLiteSpeed based hosting panel |
| ISPConfig | Described as open source on its site; we could not open its repository | Not confirmed | Not confirmed | Web, mail, DNS, multi server |
| CloudPanel | No licence detected on GitHub | v2.5.4, 1 Jul 2026 | 1 Jul 2026 | PHP, Node.js, static sites, no mail |
| aaPanel | Its own licence agreement (not a standard licence on GitHub) | 7.65.0, 22 Jan 2026 | 13 Oct 2026 | Hosting panel with a paid Pro |
| Coolify | Apache-2.0 | v4.5.3, 28 Oct 2026 | 29 Oct 2026 | Deploy tool for apps, not a hosting panel |
Sources: the GitHub pages and API for HestiaCP, Virtualmin GPL, Webmin, CyberPanel, CloudPanel, aaPanel and Coolify, and ISPConfig's site, all opened on 30 October 2026. The Webmin, Virtualmin and HestiaCP licence texts are also in their repositories.
Project by project
HestiaCP installs Apache2 and nginx with PHP-FPM, Bind for DNS, mail with anti-virus, anti-spam and webmail, MariaDB or PostgreSQL, Let's Encrypt with wildcards and a firewall with fail2ban. It is the most complete open source choice for one server. There is no commercial support, so the forum is your support line.
Virtualmin and Webmin are a long running pair. Webmin is BSD-3-Clause and Virtualmin GPL builds hosting features on it. The paid Professional edition adds resellers, WP Workbench for WordPress, resource limits and cloud DNS and mail options, from $7.50 a month on the shop page. It is open core: the free part is open, the upsell is paid.
ISPConfig lists Apache2 and nginx, Postfix and Dovecot, Bind and PowerDNS, and multi server management and mirrored clusters on its site. It targets people who run a hosting business on several servers. We could not read its repository (the host blocked our request), so check its licence on its own site.
CyberPanel is GPL-3.0 and built around OpenLiteSpeed. It had serious remote code execution vulnerabilities in 2024, as we noted in our free panel comparison. Keep it patched and limit access to the panel port.
CloudPanel is free and the code is on GitHub, but the repository did not show a licence on 30 October 2026. Treat it as free software, not necessarily open source, until you read its terms.
aaPanel publishes code with a custom "open source licence agreement" and sells Pro for $399 lifetime on the page we saw. Read the agreement before building a business on it.
Coolify is open source under Apache-2.0 but is a deploy platform for Docker apps. It belongs in the list for people searching "open source panel" who want to host apps, not shared hosting.
Maintenance health
Check three things for any panel you pick: the date of the last release, how fast security issues are fixed, and who maintains it. A repository that was updated last week with a release in September is alive. A project with one maintainer and no releases for a year is a risk even if the licence is perfect. You can read the issue tracker for how fast reports get answers.
What is closed but free
Some panels are free to use but not open source: the free tiers of commercial panels, and projects without a clear licence. They are fine to use, but you rely on the vendor continuing to offer the free version. RespireCloud is in this group: its free plan costs nothing, but it is not an open source panel, and the open source components inside it are listed on the licences page.
Verdict
- One server with mail, fully open source: HestiaCP.
- Many domains with a path to paid support: Virtualmin.
- A multi server hosting business: ISPConfig, after reading its licence and repository.
- Apps, not websites: Coolify.
Compare the free ones on features in the free control panel guide.
Questions
What is the best open source hosting control panel?
For one server with web, mail and DNS, HestiaCP is a strong default. For many domains with a paid option later, Virtualmin. For multi server mail and web clusters, ISPConfig.
Is CloudPanel open source?
It is free to use and its code is on GitHub, but the repository showed no detected licence file on 30 October 2026, so read its own terms before you assume you can modify or redistribute it.
Is Webmin the same as Virtualmin?
No. Webmin is a general server admin tool under the BSD-3-Clause licence. Virtualmin is a hosting layer built on it, with a GPL edition and a paid Professional edition.
Are open source panels secure?
Open source lets anyone read the code, but it does not make it safe. Look at the project's advisories and CVE history, keep the panel patched and limit who can reach it.
