# CoreHttpd — the web server inside CorePanel > CoreHttpd is CorePanel's own web server: HTTP/1.1, HTTP/2 and HTTP/3, automatic HTTPS, a built-in WAF, Early Hints, WebP and full .htaccess support — and it never runs as root. Source: https://www.corepanel.net/corehttpd Documentation: https://www.corepanel.net/docs/web --- ## What CoreHttpd is CoreHttpd is CorePanel's origin web server: a single statically linked binary that serves HTTP/1.1, HTTP/2 and HTTP/3, terminates TLS with automatic Let's Encrypt certificates, reads .htaccess, runs the pxShield web application firewall in-process, converts images to WebP, emits Early Hints, and speaks FastCGI to a PHP-FPM pool per account. Its engine is the one behind pxShield, our commercial WAF, which has been in production in front of cPanel servers since 2020. CorePanel does not ship or wrap Apache, nginx or LiteSpeed. There is no second web server on the box, and no generated vhost configuration: the panel writes one JSON site record per site and the server reloads without dropping connections. ## At a glance | | | |---|---| | **Protocols** | HTTP/1.1, HTTP/2, HTTP/3 over QUIC — on by default, nothing to enable | | **TLS** | Automatic Let's Encrypt certificates, issued and renewed by the server, in every edition. Uploading a commercial certificate is Pro and above | | **Firewall** | pxShield WAF in-process — every rule family, every edition, blocking | | **.htaccess** | mod_rewrite, deny rules, password-protected directories, with a per-site report of what was not applied | | **PHP** | 7.4 – 8.4 over FastCGI, one FPM pool per account; never executed in the server process | | **Images** | WebP conversion on the fly — no plugin, no build step | | **Early Hints** | HTTP 103 learned from the page and replayed, with nothing to configure | | **Caching** | Dynamic page cache with declared invalidation, plus JS/CSS minification _(Pro+)_ | | **Routing** | Per-site serving modes, forced HTTPS, reverse proxy routes to local services | | **Logs** | One access log per domain, symlinked into the account's home, plus server-wide access and error logs | | **Privilege** | Runs as an unprivileged user with two capabilities, confined in its own SELinux domain | | **Packaging** | One statically linked binary; RHEL 8, 9 and 10, AlmaLinux and Rocky | | **Licence** | Included in every edition, Personal (free) included. Not sold separately | ## Why CorePanel ships its own web server - **The engine is not new.** CoreHttpd runs on the engine behind pxShield, our commercial WAF, which has been in front of Apache on cPanel servers since 2020 and has protected more than 800,000 domains. What changed in CorePanel is posture: it is the origin now, not a proxy in front of one. - **Sites do not have to change.** The `.htaccess` files a site already has are read — mod_rewrite, deny rules, password-protected directories — and each site gets a report naming every directive that was *not* applied, so nothing differs silently. - **It never runs as root.** Apache, nginx and LiteSpeed all start privileged and drop to a worker user. CoreHttpd runs unprivileged from the first instruction with two capabilities — bind ports 80 and 443, and read document roots — and is confined in its own SELinux domain, `corehttpd_t`. PHP runs in the account's own FPM pool, so a compromised web server cannot read a customer's `wp-config.php`. - **One request, one engine.** The cache and the WAF have to agree on order; WebP has to agree with the cache; Early Hints has to agree with the protocol and the upstream. In a stack of third-party modules, load order settles those questions instead of a product decision. ## Measured From documented runs on a 2-vCPU server, with the method published alongside them: | Measurement | Result | |---|---| | Cached WordPress home page, time to first byte | 1.6 ms, from 248 ms _(Pro+)_ | | WordPress under 400 concurrent visitors | 5,507 pages/s, against 12.1 uncached _(Pro+)_ | | Elementor site, 400 concurrent visitors | 78,946 pages in 20 s, against 251 uncached _(Pro+)_ | | A page of oversized PNGs converted to WebP | 14.3 MB to 75 KB, 4.9 s to 1.0 s | Method and full results: https://www.corepanel.net/blog/we-measured-the-page-cache and https://www.corepanel.net/blog/elementor-cache-webp-http3. ## Questions ### What web server does CorePanel use? CorePanel uses CoreHttpd, its own web server. It does not ship or wrap Apache, nginx or LiteSpeed — there is no second web server on the box. Every site the panel hosts is served by CoreHttpd, and it is included in every edition. ### What is CoreHttpd? CoreHttpd is CorePanel's origin web server: a single statically linked binary that serves HTTP/1.1, HTTP/2 and HTTP/3, terminates TLS with automatic Let's Encrypt certificates, reads .htaccess, runs the pxShield web application firewall in-process, converts images to WebP, emits Early Hints, and speaks FastCGI to a PHP-FPM pool per account. Its engine is the one behind pxShield, our commercial WAF, which has been in production in front of cPanel servers since 2020. ### Does CoreHttpd support .htaccess? Yes. CoreHttpd reads the .htaccess files a site already has: mod_rewrite rules (including WordPress permalinks), deny rules and password-protected directories. It also produces a per-site report naming every directive it did not apply, so there is no silent difference between what the file says and what the server does. ### Is CoreHttpd based on Apache or nginx? No. It shares no code with either. It is built on pxShield's engine, which spent six years in front of other people's Apache servers as a WAF before it became an origin server in its own right. ### Does CoreHttpd support HTTP/3? Yes. HTTP/3 over QUIC is on by default on UDP port 443 and advertised to browsers with an Alt-Svc header, alongside HTTP/2 and HTTP/1.1 on TCP. There is nothing to enable per site, and it is available in every edition, including the free one. ### Does CoreHttpd include a web application firewall? Yes. The pxShield WAF runs inside the web server rather than as a bolted-on module, so it sees the connection and not just a parsed request. Every rule family blocks in every edition, including Personal, which is free. There is no rule-set subscription. ### Does CoreHttpd run as root? No. It runs as the unprivileged corehttpd user with exactly two Linux capabilities: one to bind ports 80 and 443, and one to read document roots. The read capability cannot write anything, and the process is confined in its own SELinux domain, corehttpd_t. Apache, nginx and LiteSpeed all start as root; CoreHttpd never has privileges to drop. ### Does it work with WordPress? Yes, and WordPress is what most of it was tuned against. Permalinks work through .htaccess or the CMS serving mode, PHP runs in the account's own FPM pool, and the dynamic page cache (Pro and above) serves a cached WordPress page without touching PHP or the database — 1.6 ms instead of 248 ms in a documented run. ### How is CoreHttpd configured? From the panel. There are no vhost files to write: CorePanel writes one JSON site record per site and the server reloads without dropping connections. Server-wide settings live in /etc/corehttpd.ini, which most installations never need to touch. ### Can I install CoreHttpd on its own, without CorePanel? No. CoreHttpd is not sold or distributed separately — it is the web server CorePanel is built on, and it is installed with the panel. ### Which operating systems does it run on? RHEL 8, 9 and 10 and their rebuilds — AlmaLinux and Rocky Linux. It ships as a single statically linked binary with no shared-library dependencies to match. ### What does CoreHttpd cost? Nothing on its own. It ships with every CorePanel edition, including Personal, which is free: HTTP/3, automatic HTTPS, the full WAF, WebP conversion and Early Hints are all in the free edition. The Speed Optimizer — the dynamic page cache and JS/CSS minification — is part of the Pro line. ## More - The web server, documented: https://www.corepanel.net/docs/web - Why we stopped shipping Apache: https://www.corepanel.net/blog/we-had-to-build-our-own-web-server - Editions and pricing: https://www.corepanel.net/pricing