1.6ms
Pro+Time to first byte on a cached WordPress home page, down from 248 ms. The request never reaches PHP.
the engine
CoreHttpd, the web server
inside CorePanel.
CoreHttpd is CorePanel's own web server. The panel does not ship or
wrap Apache, nginx or LiteSpeed — there is no second web server on the box. CoreHttpd serves
HTTP/1.1, HTTP/2 and HTTP/3, issues its own Let's Encrypt certificates, reads the
.htaccess your sites already have, runs a web application firewall in-process,
converts images to WebP, emits Early Hints — and never runs as root.
That is also the largest difference between CorePanel and a classic control panel, and the first thing a careful administrator should push back on. The rest of this page is that pushback, answered in the order it gets asked.
This page is served by CoreHttpd.
curl -I https://www.corepanel.net CoreHttpd at a glance
| Protocols | HTTP/1.1, HTTP/2, HTTP/3 over QUIC — on by default, nothing to enable |
|---|---|
| TLS | Automatic Let's Encrypt certificates, issued and renewed by the server, in every edition. Uploading a commercial certificate is Pro and above |
| Firewall | pxShield WAF in-process — every rule family, every edition, blocking |
| .htaccess | mod_rewrite, deny rules, password-protected directories, with a per-site report of what was not applied |
| PHP | 7.4 – 8.4 over FastCGI, one FPM pool per account; never executed in the server process |
| Images | WebP conversion on the fly — no plugin, no build step |
| Early Hints | HTTP 103 learned from the page and replayed, with nothing to configure |
| Caching | Dynamic page cache with declared invalidation, plus JS/CSS minificationPro+ |
| Routing | Per-site serving modes, forced HTTPS, reverse proxy routes to local services |
| Logs | One access log per domain, symlinked into the account's home, plus server-wide access and error logs |
| Privilege | Runs as an unprivileged user with two capabilities, confined in its own SELinux domain |
| Packaging | One statically linked binary; RHEL 8, 9 and 10, AlmaLinux and Rocky |
| Licence | Included in every edition, Personal (free) included. Not sold separately |
Rows marked Pro+ ship in the paid editions; everything else is in Personal, free. Full documentation →
01
maturity
The engine is six years old. Only its posture is new.
CoreHttpd is not a web server we started writing when we started writing a panel. It runs on the engine behind pxShield, our commercial WAF, which has sat in front of Apache on cPanel servers since 2020.
- More than 800,000 domains protected in those six years
- HTTP parsing, TLS termination and connection handling hardened by hostile traffic
- On servers we did not own, in environments we did not control
- What changed in CorePanel: it is the origin now, not a proxy in front of one
A WAF's entire job is to be attacked. The parts of a web server that are genuinely dangerous to write yourself are exactly the parts that spent six years being attacked on purpose.
engine lineagesame code path
2020pxShieldWAF in front of Apache · cPanel servers
2020–26800,000+domains behind it
2026CoreHttpdsame engine, now the origin
6yearsof production traffic before it served a single CorePanel site
02
compatibility
Your sites do not have to change
This is the question behind the question. A new web server is only interesting if the sites you already run keep working on it — including the rules they brought with them from Apache.
.htaccessis read: deny rules, password-protected directories, mod_rewrite- WordPress permalinks, Laravel, Drupal and Symfony front controllers
- PHP 7.4 through 8.4, one FPM pool per account
- A per-site report naming every directive that was not applied
That last line is the one that matters. Servers that claim
.htaccess compatibility usually mean "most of it, silently". CorePanel tells
you, file by file, what it did not apply — so there is no difference you find out about
from a customer. How .htaccess support works →
.htaccess · northgate-books.comapplied
✓RewriteEngine On
✓RewriteRule . /index.php [L]
✓AuthType Basic
✓Require valid-user
—Header set X-Frame-Options
report · 4 of 5 directives applied · 1 listed as not applied
03
privilege
It never runs as root
Apache runs as root. So do nginx and LiteSpeed: they start privileged, bind the low ports and drop to a worker user. CoreHttpd has no privileges to drop — it runs unprivileged from the first instruction, with exactly two capabilities.
CAP_NET_BIND_SERVICE— bind ports 80 and 443CAP_DAC_READ_SEARCH— read document roots, never write them- Confined in its own SELinux domain,
corehttpd_t— nothttpd_t - Homes stay
0700and files0600, with no ACLs to keep reapplying
And it never executes PHP in its own process: PHP runs in the account's
own pool. The consequence is worth stating plainly, because a panel built on a root web
server cannot state it — a compromised CoreHttpd cannot read your customers'
wp-config.php. The privilege model →
processenforcing
$ ps -eZ | grep corehttpd
system_u:system_r:corehttpd_t:s0 corehttpd
| runs as | corehttpd |
| can write user files | never |
| executes PHP in-process | never |
| capabilities held | 2 |
The industry's standard troubleshooting advice is "disable SELinux". CorePanel ships a policy module instead.
04
integration
One request, one engine
This is the argument for building the server rather than assembling one. These features are not independent, and when they live in separate third-party modules they break at the seams — where load order, not a product decision, settles the conflict.
- The cache and the WAF must agree on order, or you serve uninspected content
- WebP must agree with the cache, or a browser is handed an image it cannot read
- Early Hints must agree with the protocol and the upstream to be worth emitting
- The WAF must see the connection, not just a parsed request
It is also why the page cache is safe to leave on: it never guesses what is cacheable. Our WordPress companion declares in the response what may be stored, and the engine stores only that. What each optimization does →
one requestsingle process
1TLS · HTTP/1.1 · HTTP/2 · HTTP/3
2WAF — sees the connection, not just the headers
3Page cache — serves the stored page, or moves on
4WebP · minify · Early Hints
5PHP-FPM pool of the account, over a socket
Five stages, one program, one decision at each seam. A stack of modules has the same five stages and no one in charge of the order.
05
measured, not claimed
What it buys, with the method attached
Numbers from documented runs on a 2-vCPU server, published with how they were taken — including the corrections we had to make to our own first results, and the cases where the cache does nothing at all.
5,507pages/s
Pro+400 concurrent visitors on a WordPress site with 400 posts. The same server without the cache does 12.1.
78,946pages / 20 s
Pro+An Elementor site under 400 simultaneous visitors, against 251 uncached — and the box finished 9% idle.
14.3MB → 75 KB
A page of oversized PNGs converted to WebP on the fly, 4.9 s to 1.0 s. No plugin, no build step — and free in every edition.
How we measured the page cache, and where it fails → The same test on an Elementor site →
06
what it costs
There is nothing here to license
CoreHttpd is not a product you buy, and not one you can install on its own. It is the web server the panel is built on, and it ships with every edition — including Personal, which is free.
- No web-server licence, no per-worker tier, no kernel module to rent
- No rule-set subscription — the full WAF is in every edition, blocking
- HTTP/3, automatic HTTPS, WebP and Early Hints: free edition included
- The Speed Optimizer — page cache and minification — is the Pro line
And nothing about it locks a site in: sites are ordinary files and an ordinary MariaDB, and a CorePanel backup restores on any server.
licences requirednone
Web serverCoreHttpd · included
WAF rule setspxShield · every family, every edition
HTTP/3 · WebP · Early Hintsincluded, free edition
Speed Optimizerpage cache + minify · Pro
questions we get asked
CoreHttpd, answered plainly
What web server does CorePanel use?
CorePanel uses CoreHttpd, its own web server. It does not ship or wrap Apache, nginx or LiteSpeed — there is no second web server on the box. Every site the panel hosts is served by CoreHttpd, and it is included in every edition.
What is CoreHttpd?
CoreHttpd is CorePanel's origin web server: a single statically linked binary that serves HTTP/1.1, HTTP/2 and HTTP/3, terminates TLS with automatic Let's Encrypt certificates, reads .htaccess, runs the pxShield web application firewall in-process, converts images to WebP, emits Early Hints, and speaks FastCGI to a PHP-FPM pool per account. Its engine is the one behind pxShield, our commercial WAF, which has been in production in front of cPanel servers since 2020.
Does CoreHttpd support .htaccess?
Yes. CoreHttpd reads the .htaccess files a site already has: mod_rewrite rules (including WordPress permalinks), deny rules and password-protected directories. It also produces a per-site report naming every directive it did not apply, so there is no silent difference between what the file says and what the server does.
Is CoreHttpd based on Apache or nginx?
No. It shares no code with either. It is built on pxShield's engine, which spent six years in front of other people's Apache servers as a WAF before it became an origin server in its own right.
Does CoreHttpd support HTTP/3?
Yes. HTTP/3 over QUIC is on by default on UDP port 443 and advertised to browsers with an Alt-Svc header, alongside HTTP/2 and HTTP/1.1 on TCP. There is nothing to enable per site, and it is available in every edition, including the free one.
Does CoreHttpd include a web application firewall?
Yes. The pxShield WAF runs inside the web server rather than as a bolted-on module, so it sees the connection and not just a parsed request. Every rule family blocks in every edition, including Personal, which is free. There is no rule-set subscription.
Does CoreHttpd run as root?
No. It runs as the unprivileged corehttpd user with exactly two Linux capabilities: one to bind ports 80 and 443, and one to read document roots. The read capability cannot write anything, and the process is confined in its own SELinux domain, corehttpd_t. Apache, nginx and LiteSpeed all start as root; CoreHttpd never has privileges to drop.
Does it work with WordPress?
Yes, and WordPress is what most of it was tuned against. Permalinks work through .htaccess or the CMS serving mode, PHP runs in the account's own FPM pool, and the dynamic page cache (Pro and above) serves a cached WordPress page without touching PHP or the database — 1.6 ms instead of 248 ms in a documented run.
How is CoreHttpd configured?
From the panel. There are no vhost files to write: CorePanel writes one JSON site record per site and the server reloads without dropping connections. Server-wide settings live in /etc/corehttpd.ini, which most installations never need to touch.
Can I install CoreHttpd on its own, without CorePanel?
No. CoreHttpd is not sold or distributed separately — it is the web server CorePanel is built on, and it is installed with the panel.
Which operating systems does it run on?
RHEL 8, 9 and 10 and their rebuilds — AlmaLinux and Rocky Linux. It ships as a single statically linked binary with no shared-library dependencies to match.
What does CoreHttpd cost?
Nothing on its own. It ships with every CorePanel edition, including Personal, which is free: HTTP/3, automatic HTTPS, the full WAF, WebP conversion and Early Hints are all in the free edition. The Speed Optimizer — the dynamic page cache and JS/CSS minification — is part of the Pro line.
Read the part we wrote for administrators
The documentation says where every file and log lives, what the server can and cannot read, and what to do when a site misbehaves.