Move a cPanel account to HestiaCP, step by step

HestiaCP can take over a cPanel account without a hand rebuild of every site. It comes with a script for it, and this post walks through using it on one account. What the script does is taken from its source in the HestiaCP repository (the main branch, which matches release 1.10.5 of 14 September 2026), read on 30 October 2026. I have not run it on a clean install for this post, so treat the first account as your test run. The wider order of a safe move is in Moving from cPanel without downtime.

What you need

• A cPanel server where you are root, or a host who will make a full backup for you.
• A fresh server running HestiaCP. Its requirements at the time of writing are Debian 12 or 13, or Ubuntu 22.04, 24.04 or 26.04 LTS, on a fresh install.
• rsync and file on the HestiaCP server, which the script checks for. Install them with apt-get install rsync file.
• Free disk space on /backup, because the script unpacks the archive there before importing.

Package the account on cPanel

cPanel's pkgacct script makes the full account archive. Its documentation gives the form pkgacct [options] USERNAME DIRECTORY, and says the archive covers the account's files, databases, mail, domains and more unless you skip them with options such as --skipmail.

/usr/local/cpanel/scripts/pkgacct USERNAME /home

The archive is normally named cpmove-USERNAME.tar.gz in the directory you gave. Check the output of the command for the exact name. It must be a gzip file, as the import script refuses anything else.

Copy it to the new server:

scp /home/cpmove-USERNAME.tar.gz root@NEW:/backup/

Import it into HestiaCP

On the HestiaCP server, as root:

v-import-cpanel /backup/cpmove-USERNAME.tar.gz

From reading the script, this is what it does in order:

1. Unpacks the archive in a temporary folder under /backup.
2. Finds the cPanel username and stops if that user already exists on the HestiaCP server.
3. Creates the HestiaCP user with the cPanel contact email and the account password hash, and uses the cPanel plan name as the package if a package of that name exists, else default.
4. Restores the databases and their users, and changes a MySQL 8 collation that MariaDB does not know. If a database name already exists, it prints an error for that one.
5. Creates the main domain, add-on domains, subdomains and parked domains, and copies each site's files with rsync.
6. Sets the PHP version to the same one if that version is installed, or tells you to set it by hand.
7. Tries to import SSL certificates.
8. Creates mail domains and mailboxes, moves the mail folders, decompresses gzipped messages and sets each mailbox password from the backup.
9. Reads the account's cron file and rewrites cPanel ea-php paths to a HestiaCP path where it can.

An optional second argument, yes, also replaces the MX records in HestiaCP's DNS with those of the cPanel zone. Leave it off unless you know why you want it.

What does not convert cleanly

The script's own header lists two known issues: certificate import "fails at the moment" because of format changes on the cPanel side, and DKIM is not updated. Plan for both. Issue a new Let's Encrypt certificate for each domain in HestiaCP after the import, and check the DKIM record for each mail domain before you send from it.

Other things to check by hand: .htaccess rules that depend on a cPanel module, cron lines that call a PHP version you have not installed, email forwarders and autoresponders (look at each one), and anything outside the home directory. If you ran Node or Python apps under cPanel, they are not part of this script.

Test before you change DNS

Put the new server's address in your own hosts file for the domain and open the site:

203.0.113.10  example.com www.example.com

Log in to the admin area, test a form, open the databases, send mail to and from a mailbox and log in with its old password. Look at the cron list in HestiaCP.

Switch DNS

A few days before, lower the TTL on the records you will change. When the account checks out, run pkgacct once more for a final copy if the site changed, and import it into a clean user, or sync only the changed files and database. Then change the A record, check mail arrives and keep the cPanel server until you are sure. The order is the same as in the cPanel move guide linked at the top.

For a side by side look at the two panels, see the HestiaCP comparison. If you have many accounts to move, or you want a preview and rollback, the migration page describes how RespireCloud's importer reads the same cPanel backup, and the cPanel guide has the longer version.