capability index
Everything the panel
actually does.
No feature grid of vague promises. Every capability below maps to a real component in the stack — with the technical detail a sysadmin evaluates on.
performance
Blazing-fast by default
HTTP/3, real Early Hints, and intelligent caching deliver lightning-fast loads — the difference between a visitor staying and leaving.
- HTTP/3 + QUIC transport
- Real Early Hints (HTTP 103) preload
- Dynamic cache with smart invalidation
- WebP conversion on-the-fly
security
Isolation that actually isolates
Security in every layer. True user isolation and dedicated PHP-FPM pools mean one compromised site never touches its neighbors.
- 0700 directories / 0600 files, no shared access
- SELinux enforcing — mandatory-access-control confinement
- Dedicated PHP-FPM pool per system user
- Native integrated Web Application Firewall (pxShield)
| alice | php-fpm:alice | 0700 | 🔒 |
| bravo | php-fpm:bravo | 0700 | 🔒 |
| carol | php-fpm:carol | 0700 | 🔒 |
wordpress
Tuned for WordPress, out of the box
Dynamic caching, automatic purge on content changes, and Opcache preloading — the technical details handled so you can focus on content.
- Dynamic cache with smart invalidation
- Page cache with auto-purge on update
- WP-CLI integration & automation
- Opcache preloading for peak PHP
protection
Multi-layered active defense
Beyond the basics: behavioral DDoS mitigation, brute-force blocking, injection filtering, and bot detection — kept current automatically.
- pxShield DDoS (behavioral analysis)
- Fail2ban with WordPress rules
- SQLi / XSS filtering via native pxShield WAF
- Bot detection with challenge pages
modern stack
Modern components, no legacy baggage
Carefully chosen, actively maintained software — the opposite of a crusty Apache/cPanel box. Faster, leaner, production-tested.
- CoreHttpd — auto HTTPS, HTTP/3; on-the-fly WebP + Early Hints (free); JS/CSS minify (Pro)
- PHP 7.4 – 8.4, concurrent FPM pools
- MariaDB 10.11 LTS (unified)
- PowerDNS — GeoDNS, DNSSEC, API
backups
Backups that leave the server
Scheduled locally on every edition, copied off-box to storage you already own on Pro and Business — because a backup on the same disk is not a backup.
- S3-compatible and SFTP destinations
- Local scheduled backups on every edition
- Restore stays free even if a licence lapses
- Per-account: files, databases and mail
ai agents
Ask the server, in the assistant you already use
The panel speaks MCP at /mcp. Point Claude — or any MCP
client — at it and ask why a site is slow or what the firewall blocked last night. It
answers from the box itself, with a credential that only reads until you widen it.
- Eighteen read tools, hand-written — no sidecar, on every edition
- Its own credential class: read-only and expiring by default
- The three tools that change anything answer with a plan first
- Pin a token to the addresses it may be used from
shop.example.com went slow after 18:00 — what happened?
The FPM pool hit max_children at 18:12 — p95 went 210 ms → 3.4 s. Requests queued, nothing crashed.
purge its cache while I raise the limit
Nothing changed. A write answers with a plan; the change needs a second call carrying that confirmation, valid 60 s and once.
why it works that way
Every capability above
is ours to change.
The list is only possible because the stack underneath is not borrowed. A panel that wraps Apache and ModSecurity ships what those projects ship, when they ship it.
| Capability | Classic control panels | CorePanel |
|---|---|---|
| Web server | Apache or nginx, wrapped in generated config | CoreHttpd — written for this panel |
| Web application firewall | ModSecurity bolted on, rule sets sold separately | pxShield, native — every rule family, every edition |
| Early Hints (HTTP 103) | Not available | Native, on by default |
| WebP conversion | A plugin per site | On-the-fly in the web server |
| Account isolation | Shared group, permissive defaults | 0700 / 0600, PHP-FPM pool per user, SELinux enforcing |
| Applications beyond PHP | SSH and a systemd unit you write yourself | Deploy, env, logs and health from the panel |
| Dynamic page cache | Varnish in front, or a caching plugin | In the web server, with smart invalidation Pro+ |
| Host firewall | A shell script over iptables | Managed in the panel, with automatic blocking Pro+ |
Rows marked Pro+ ship in the paid editions. Everything else is in Personal, free. Compare editions →
See what's included in each edition
Personal ships the full core stack, free. Pro and Business add the premium layers.