A container set per account
Each hosting account runs in its own set of containers: web (PHP), MariaDB, SFTP, a web file manager, Adminer and a cron runner. The set has its own network. CPU and memory limits are set on each container.
// Features
Everything the panel runs
Hosting, DNS, mail, databases and deploys, plus reseller tools. Each hosting account runs in its own set of containers.
Hosting, PHP and apps
The account and the sites on it.
Hosting accounts
Create, suspend and delete accounts from the admin console. Suspending an account stops its containers.
Plans
Starter, business and enterprise plans set limits for disk, bandwidth, domains, mailboxes, databases and VPN. Disk use is reported against the plan. Count limits, such as domains and databases, are enforced.
PHP and the web server
PHP 8.2, 8.3 and 8.4, each on NGINX or Apache. Apache honours .htaccess. Admins, resellers and clients can switch the runtime.
Cron jobs
Scheduled jobs call the site over HTTP with wget or curl, and they keep logs. They do not get a shell.
Extra Docker apps
On plans that allow custom Docker apps, clients can run extra containers from a catalog: WordPress, Ghost, n8n, Nextcloud, Gitea, Uptime Kuma, Vaultwarden, Grafana and NGINX. These are separate containers, not an installer into the document root.
Dedicated IPs
An address pool. Assign an address to an account and the proxy and DNS follow it.
Domains and DNS
Names, zones and redirects.
Domains on the account
A primary domain, addon domains with a shared or separate document root, subdomains, aliases, and 301 or 302 redirects.
Ownership check
A new domain needs a DNS TXT record at _smashpanel-verify.example.com. Zones this server hosts publish that record for you.
Authoritative DNS
A zone is created with the account, with an A record to the server. Edit A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, PTR, TLSA and HTTPS records in the admin console or the client portal.
Nameservers
When a domain is delegated here, the panel shows ns1 and ns2 guidance. You can also keep DNS elsewhere and point only an A record at the server.
SSL
Certificates for the names you host.
Automatic Let's Encrypt
The edge proxy issues and renews certificates with the HTTP-01 check. The portal shows the certificate as active or pending.
What pending means
The name's A record must point at this server, and port 80 must be reachable, before a certificate can be issued.
Email with Mailcow
Optional. Mailcow runs as its own stack and needs about 8 GB of RAM.
Mailboxes and webmail
Clients create, delete and reset mailboxes and set quotas. Webmail is SOGo.
Deliverability records
SPF, DKIM and DMARC can be written into the DNS zone. Each client can have a mail domain admin, and mail certificates are set up per customer.
Admin mail tools
Forwarders, autoresponders, catch-all, spam score and a remote MX are available to administrators.
What mail does not cover
Mail does not move with cluster failover. An account created through the Reseller API does not get mail automatically.
Databases
A database server for the account, not a shared one.
MariaDB 11
Each hosting account has its own MariaDB server. Clients create and delete databases and users, and set privileges.
Adminer
Adminer is served at /adminer/ on the site. Apps on the account connect to the database host named db.
Passwords at rest
Database passwords are encrypted at rest with AES-256-GCM.
File manager and SFTP
Browser access and a dedicated SFTP port.
Web file manager
Filebrowser is served at /files/ on the site. A unique user is created when the account is provisioned. There is no default password.
SFTP
Each account has an SFTP container on its own port in the range 22000–22999. Extra SFTP accounts can be added from the panel.
Turn services off
Clients and admins can switch off the file manager, Adminer, SFTP, cron or MariaDB when they are not needed.
Staging and GitHub deploy
A staging hostname, and deploys from GitHub.
Staging sites
Create or refresh a staging copy at staging.example.com and promote that copy to production. The copy is files only. Databases are not synced.
GitHub deploy
Connect a GitHub App, then pick the repository, branch and target (production or staging). An optional build command and output directory are supported. Pushes can deploy on their own. You can keep selected files and run a command after deploy. Builds run in a sandbox with no secrets.
Docker Compose per account
For plans that allow the account to edit its own stack.
Edit the account stack
On enterprise plans, clients can edit, validate, apply and roll back the account's Compose file.
Checks before apply
The panel blocks privileged containers, external volumes and secret interpolation.
Reseller and white-label
Packages, clients, and the reseller's own name and logo.
Reseller portal
Resellers work at /reseller inside an allowance. They have their own packages and clients, and they can create, suspend and terminate those clients.
White-label
A reseller's company name and logo replace the platform branding in the client portal. The host's own company name, legal name and logo are set in the admin console.
System email sender
Set a sender name and address for system email, per reseller or for the whole platform. The reseller sender is used first, then the platform sender.
Reseller API
A versioned HTTP API for the accounts a reseller manages.
Reseller API
HTTP API at /api/v1/reseller. Keys are bearer tokens with scopes. Endpoints cover clients (create, read, update, delete, suspend and provision), domains, packages and keys.
Limits and a record
Calls are rate limited and written to the audit log. Clients created through this API do not get a mail domain automatically.
Clusters
More than one server, with one list of clients.
Paired servers
Pair servers with signed calls and a heartbeat. See clients across nodes, keep one node as the DNS authority, and provision an account on another node.
Failover
Failover is manual, or automatic if you opt in. It works by changing DNS. There is no shared storage, no single database and no live migration. Mail does not fail over.
VPN
A personal VPN peer for accounts whose plan allows it.
Four ways to connect
WireGuard (split or full tunnel, as a QR code or a config file), OpenVPN, L2TP/IPsec and IKEv2.
Bandwidth caps
Plans can cap VPN users and monthly VPN bandwidth, with warnings at 80% and 95%.
Security
Separation, sign-in and the host firewall.
Two-factor authentication
Administrators must use two-factor authentication, and it cannot be turned off for them. Resellers must use it as well.
Account separation
Each hosting account runs in its own set of containers, on its own network. CPU and memory limits are set on each container.
Sign-in controls
Admin and reseller sign-in uses a one-time code, a CSRF token on forms, and a limit of 15 attempts in 15 minutes. You can also restrict the admin area to a list of IP addresses.
Firewall
Administrators manage host firewall rules, Fail2Ban jails and banned addresses. Clients can limit their SFTP port to an allow list of IPs.
Import scanning
A cPanel import can scan files with ClamAV, when it is installed, and with PHP webshell checks. You can quarantine the file or block the import.
PHP image checks
The admin console can scan account runtimes for outdated PHP and Adminer images and update them per account.
Guides
The knowledge base covers install, DNS, the client portal, mail, files, staging and cPanel migration. The architecture page shows how a request reaches a site.
Put it on a server
Requirements, DNS records, ports and the install commands are on the Get Started page.