# Limits and boundaries

> What a client panel customer can never reach, what stays with the operator inside the sections they can use, and the hard per-account ceilings under your package limits.

Source: https://www.corepanel.net/docs/client-panel/limits/
Last updated: 2026-10-12
Part of the CorePanel documentation — https://www.corepanel.net/docs

---

This is the question every hosting provider asks first: what can a customer reach, and
what can they never touch? The short answer is their own account, and nothing else. The
boundary is enforced by the server, not by hiding buttons.

## What a customer can never reach

- **Another account's anything.** Every request is pinned to the customer's own account.
  Asking for someone else's resource returns the same error as one that does not exist, so
  the panel cannot be used to discover what else is on the server.
- **Server-wide settings.** Firewall, WAF rules, licence, telemetry, packages, imports, the
  accounts list, services and the server's notification settings.
- **Their own limits.** Disk quota, allowances and application count are yours to set.

## What stays with you inside their sections

Some tools are absent from the client panel even where the customer manages the thing they
belong to, because they affect more than one account:

| Section | What stays with you |
|---|---|
| Websites | [Reverse proxy routes](https://www.corepanel.net/docs/reverse-proxy) |
| DNS | Nameservers, the server's DKIM key, ACME challenges, the server's own names |
| Email | [Anti-spam](https://www.corepanel.net/docs/email/antispam) thresholds and email authentication |
| Databases | The MySQL activity list, and remote access for MySQL users |
| SSH & SFTP | The access level and password login |
| Backups | Recreating deleted accounts, outside archives, remote destinations |
| Applications | Creating, changing and deleting them |
| WAF | Every rule, exception and trusted IP |
| Optimizations | Server defaults, the cache evaluation report and manual purge |

## Ceilings under your package limits

Each account also has hard ceilings on how many domains, subdomains, mail aliases, MySQL
users and mailbox filter rules it may hold. They sit **under** your
[hosting package](https://www.corepanel.net/docs/accounts/hosting-packages) allowances and apply even when a limit is
`0` ([unlimited](https://www.corepanel.net/docs/accounts/editing#a-limit-of-0-means-unlimited)).

They exist to stop a runaway script, not a real customer, and are set high enough that a
normal account never meets them. If one does, the error names the ceiling — treat it as a
signal to look at that account.