Key takeaways
- VestaCP's repository says it is back under active development since 25 February 2024, with commits in October 2026, so the question is trust, not whether it is dead.
- HestiaCP started from the VestaCP code and restores Vesta backups with v-restore-user, which makes it the shortest move.
- A server built from VestaCP's installer in May or June 2018 may have been compromised, so audit it before copying anything off it.
- Move to a fresh server, copy data over, test through your hosts file and keep the old server until mail is settled.
People search for a VestaCP alternative for two reasons. The panel had a long quiet period, and it has a bad security history. Both are fair reasons to look around. This post gives the facts as of 30 October 2026, the main choices, and a safe way to move.
Why people leave VestaCP
Two things come up again and again.
The first is the 2018 supply chain compromise. CVE-2018-25117 describes malicious code in VestaCP's Debian installer, in commits from 31 May to 13 June 2018. Servers installed from it could be infected with a DDoS bot, and administrator credentials were sent out. If your server was installed then, the safe assumption is that it was compromised. Reinstall rather than clean it.
The second is the gap. The project's README says "Vesta is back under active development as of 25 February 2024", which tells you it was not before. Its repository shows releases and commits as recently as 22 October 2026, and it is not archived. So "abandoned" is no longer accurate. What you have to decide is how much weight to give a history of a compromise and a long pause. Its GitHub page lists no published security advisories, which is not the same as none being needed.
The main alternatives
| Panel | What it is | Good for | Check before choosing |
|---|---|---|---|
| HestiaCP | Free, GPLv3, based on VestaCP | Web, mail and DNS on one small server, with the same feel as Vesta | Fresh install only; Debian 12 or 13, Ubuntu 22.04, 24.04 or 26.04 |
| CloudPanel | Free panel for sites on a cloud or dedicated server | PHP, Node.js and Python sites | Its docs do not say it runs DNS; check mail support yourself |
| RespireCloud | Self hosted panel for Linux | Several accounts, resellers, an importer with a preview | Free edition holds 1 account; paid editions cost money, see pricing |
HestiaCP's requirements page and its README, which says it is "based on the VestaCP project", were read on 30 October 2026. CloudPanel's documentation lists PHP, Node.js and Python sites. For more panels and their trade offs, see our free control panel for a VPS roundup.
Which one should you pick
- You want the least change: HestiaCP. The commands and the layout will feel familiar, and the move is a documented restore.
- You only host websites, no mail: CloudPanel is worth a look. Read its requirements page first.
- You host for customers and want a preview and rollback: a panel with an importer, which is where RespireCloud fits. It is not the answer for a single hobby site on a tiny server.
- You want to stay: you can. Update to the current release, run it behind a firewall, limit who can reach its port and keep it patched. Staying is a decision, not a default.
Move off safely
- Decide whether the old server is trusted. If it was installed in the 2018 window or you see unknown cron jobs, processes or users, treat everything on it as suspect. Move only data you can check: site files, database dumps, mail.
- Build a new server. Install the new panel on a fresh machine. HestiaCP in particular must go on a fresh OS install.
- Back up on Vesta.
v-backup-user USERNAMEmakes a backup. - Restore on HestiaCP. Copy the file into
/backupon the new server and runv-restore-user USERNAME BACKUPFILE.tar. HestiaCP's backup documentation says only HestiaCP and VestaCP backups can be restored, and that a backup needs free space of about twice the user's disk usage. - For another panel, copy files with rsync, dump databases with mysqldump and copy Maildir folders, as in our Plesk move guide.
- Test. Edit your hosts file, open every site, send and receive mail, check cron jobs.
- Switch DNS after lowering the TTL a few days earlier. Keep the old server until mail is settled, but disconnect it from the internet afterwards if you suspect it.
Clean up the security side
Rotate every password that touched the old server: panel, SSH, database, mail and any API keys stored in site config files. Replace SSH keys. Scan the site files you copy for code you did not write, particularly in wp-content and upload folders. Set up a firewall on the new server and enable automatic security updates. Our hosting panel security checklist lists the rest.
If you want help with the move itself, see the migration page.
Questions
Is VestaCP still maintained?
Its repository README says it is back under active development as of 25 February 2024, and its releases and commits continued in October 2026. Whether that is enough for your server is a risk decision, given its history.
Is HestiaCP a drop in replacement for VestaCP?
It is based on VestaCP and restores Vesta backups, but it is a separate project with different defaults. Test your sites on a fresh Hestia server before you switch DNS.
Can I upgrade a VestaCP server to HestiaCP in place?
I found no documented in place route in HestiaCP's docs, which describe restoring a backup on a fresh install. Use a new server and move accounts across.
How do I know if my VestaCP server was part of the 2018 compromise?
Check when and how it was installed. The compromise affected the Debian installer between 31 May and 13 June 2018. If yours was installed in that window, treat it as untrusted, reinstall and rotate every password and key.
Which alternative is best for one WordPress site?
Any of them can do it. Choose by what you will maintain: HestiaCP if you also host mail and DNS, CloudPanel if you want a modern web only stack, RespireCloud if you want a managed import and preview.
