Everything you'll need on your server, in one panel.
Every module below is part of SanalCP, and none of them is a paid add-on — including in the Beta release.
01 Web Server & PHP
Automatic vhost creation
An nginx configuration is generated and safely reloaded automatically whenever a domain is added.
Per-domain PHP version
Multiple PHP-FPM pools on the same server; each domain uses its own version and settings.
One-click application installs
WordPress, Joomla, Drupal, PrestaShop, OpenCart, Grav, Matomo, MediaWiki, Nextcloud and phpBB are installed, updated and removed from a single screen. Plugin/theme management and maintenance-mode control for WordPress are in the panel too.
Page and object caching
FastCGI cache zones and Redis object caching. Ready-made cache profiles for plain PHP, WordPress and PrestaShop, bypass rules that keep session, cart and checkout requests out of the cache, and TTFB / HIT-MISS measurement from the panel.
Let's Encrypt automation
Free SSL certificates are issued automatically and renewed before they expire.
Modern protocol support
HTTP/2 and gzip compression are enabled by default; HTTP/3 (QUIC) can be turned on safely through nginx capability detection.
02 Vhost & Deploy
Write the raw nginx config yourself
For custom routing scenarios the built-in template can't cover (e.g. running more than one app under the same domain), edit the entire vhost file from within the panel. It's validated with nginx -t before saving; if it fails, the change is rolled back automatically and the live configuration stays intact.
Deploy from Git
Connect a repository and run automatic or manually triggered deploy hooks after each push.
Scheduled tasks
Add, edit and monitor the run logs of cron jobs from the panel interface.
Isolated shell access
Every account runs in its own sandboxed shell and can't see other accounts' files.
Publish Node.js and Next.js apps
Bind an app running on 127.0.0.1 to a domain; WebSocket upgrades, the real client IP and X-Forwarded-* headers work out of the box. The target is restricted to loopback against SSRF.
Laravel deploys and Artisan
The panel discovers a Laravel install, shows .env with values masked and runs allowlisted Artisan commands. A release that fails the deploy health gate is rolled back automatically.
An isolated test site, pushed live in one click
Each staging site gets its own Linux user, PHP-FPM pool and database; WordPress, Laravel and PrestaShop connection settings are rewritten automatically and search engines are blocked with X-Robots-Tag. Files and database can be pushed to live separately — a successful full backup of the live site is required first.
03 Domains & DNS
Built-in DNS management
Edit all the basic record types — A, AAAA, CNAME, MX, TXT — right from the panel.
Unlimited subdomains
Add as many subdomains as you like under your main domain, each with its own vhost.
301/302 redirects
Define domain- or path-based redirect rules from the interface.
Addon and parked domains
Attach extra domains to your account; point a domain straight at another site with a whole-domain redirect (parked domain) instead of serving separate content.
Cloudflare DNS and cache
Connect your API token once, then manage the domain's zone records from the panel, toggle orange-cloud proxying and purge the zone cache in one click. The token is stored AES-256-GCM encrypted and never sent back to the browser.
04 Email
Postfix + Dovecot + OpenDKIM
Send and receive email from your own domain without depending on a third-party mail provider. SPF/DKIM signing is configured automatically, and the DNS records needed for deliverability are shown right in the panel.
Mailbox from your browser
Reach your inbox from anywhere with the web-based mail client.
Per-mailbox storage quota
Every mailbox automatically gets a disk quota based on its hosting plan.
Unlimited email aliases
Create aliases that forward incoming mail to different mailboxes.
Mail forwarding and catch-all
Forward mail sent to one address to another; define a catch-all rule that collects mail sent to any undefined address on the domain into a single mailbox.
05 Database
Database and user management
Create a database and set user privileges in one click.
Single sign-on access
Jump into phpMyAdmin straight from your panel session, no separate login required.
Key-value caching
Redis support for application-level caching and session storage.
A management page per database
See size and character set, rename it, attach several users to the same database; take a gzip backup in one click, restore from a .sql/.sql.gz file, optimise and repair.
06 Security
nftables-based rules
Manage port- and IP-based access rules from the panel.
Web application firewall
Application-level filtering against common attack patterns, toggled per domain.
Hotlink protection and IP filtering
Stop other sites from hotlinking your images; control who can reach a domain with IP-based allow/deny lists.
Two-factor authentication
A TOTP-based second factor for panel logins.
Failed-login lockout
Repeated failed login attempts are temporarily locked out per IP, and every attempt is written to the audit log.
Directory-level access protection
Protect specific directories with a username/password (htpasswd).
Automatic IP banning
Authentication failures from SSH, mail and FTP are watched; an IP that crosses the threshold within the configured window is banned in nftables for a period. No separate service (fail2ban) is installed — the watcher lives inside the panel itself.
ClamAV file scanning
Scan account directories from the panel and quarantine suspicious files; virus signatures update automatically.
Account suspension
Take an account offline and show a maintenance page without deleting its live content.
Webshell scanning and WordPress integrity
PHP webshell content signals and writable-location heuristics combine into an explainable 0–100 risk score; WordPress core files are verified against official checksums. Quarantine never follows symlinks and can be undone.
A center that correlates events
Login attempts, WAF blocks, malware findings and failed deploys/migrations are correlated over time windows; repeats are merged, a severity is assigned, and open/resolved state is managed from the panel.
CIDR allowlist and rate limiting
Restrict the panel API to an IPv4/IPv6 CIDR allowlist and grant temporary access; if you lock yourself out, a root recovery command opens it again. Bot and rate-limit profiles can be applied to panel and domain traffic.
The panel has its own admin account
Panel login does not depend on the server's root password; installation generates its own admin account. Disabling root login drops live sessions and revokes API tokens, and two lockout guards stop you from deleting the last administrator.
07 Resource Management
CloudLinux-like resource limiting
Every account runs fully isolated from every other — CPU/RAM limits via systemd cgroup v2 slices, disk limits via user quotas (XFS and ext4), and sandboxed shell access — all through standard Linux/systemd mechanisms, with no extra license cost.
Hosting plans
Define disk, mailbox and resource limits per plan, then assign them to accounts.
Live resource usage
Track CPU, RAM and disk usage per account from the panel.
08 Files & Backups
In-browser file management
Upload, edit and archive files without needing an FTP client.
FTP/SFTP accounts
Create separate FTP users per domain and restrict their permissions.
Scheduled backups
Take automatic file and database backups, restore them in one click. Ship backups off the server: FTP, SFTP and S3-compatible object storage (including Backblaze B2) destinations are configured per domain.
Backups are proven to restore
Backups are checked for manifest match and SHA-256 integrity, and the SQL dump is actually restored into a temporary schema with a single-use MariaDB account. The newest backups are re-tested periodically, and restoring from an unverified backup is blocked.
Move in from cPanel, Plesk and DirectAdmin
Bring existing sites over from an archive or straight from the old panel over SSH. The job runs in the background with percentage, step and errors visible in the panel; on a partial failure the affected part is restored automatically and an HTTP health check runs afterwards.
09 Reseller & Customer Management
Admin, reseller and customer in one panel
Use the server on your own, or give a reseller their own space to manage their customers. The reseller creates and manages their own accounts; the customer only ever sees their own services. Every tier's permissions are resolved from the ownership chain at request time rather than baked into the session — when an account changes hands, the old session loses access immediately.
Per-reseller limits
Set a limit on customer count, domain count, disk and traffic for each reseller. Once a limit is reached, the panel blocks further sign-ups.
Resellers cannot see each other
Lists are narrowed to the reseller's own scope inside the query, so one reseller can neither view nor modify another reseller's customers, domains or DNS records.
A panel account of their own
Every customer signs in with their own username and password and gets a simplified panel containing only their own services.
Cascading suspension
Suspending a reseller also suspends the customer accounts and domains beneath them; lifting the suspension restores them together.
Read-only server visibility for resellers
A reseller can see service status, server load and version information so they can support their customers. Restarting services, firewall rules and package installation stay with the administrator.
10 Panel Management
Log into the panel with your own domain, no port needed
By default the panel is reached at the server's IP address on port 8443. Enter your own domain (e.g. panel.yourdomain.com) and save it — the panel verifies the A record points to this server and automatically issues a real Let's Encrypt certificate. From then on you reach the panel with no port and no browser warning. Access via the server IP and port 8443 always keeps working as a fallback.
Security log
Logins and critical actions are written to the audit log, and you can review them in the panel filtered by user, action and date.
Menu that adapts to your role
The sidebar is built from the permissions of the role signing in. Step into a domain and it turns into that domain's toolset; the selector at the top moves you between domains without losing the page you are on.
Server-wide lists
See the DNS records, SSL certificates, mailboxes and databases of every domain in a single list — no need to walk domain by domain.
Multilingual interface
The panel interface and docs are available in both Turkish and English.
Management API and tokens
Everything the panel does is also available over an HTTP API. Time-limited, scope-aware API tokens are generated from the panel for automation and your own integrations.
AlmaLinux, Debian and Ubuntu
A single installer covers both distribution families: AlmaLinux 10 / 9.4+ (RHEL, Rocky), Debian 13 / 12 and Ubuntu 26.04 / 24.04 LTS.
Restart or shut the server down from the panel
Restart the server safely from the panel with a confirmation step, no SSH required; a shutdown, which does not come back on its own, asks you to type KAPAT to confirm.
Central operations and notifications
Imports, account migrations, Laravel deploys and malware scans are tracked from one view in the top bar; running jobs refresh on their own and every row links to its detail screen.
Server maintenance cards
Automatic security updates, timezone and NTP, hostname/PTR checks, disk and inode warning thresholds, kernel and reboot state, journald cleanup, DNS resolver settings and swap management, all in one section.
Panel updates with pre-flight checks, backups and rollback
sanalcp-update verifies the database, free disk space, the backup tool and the nginx configuration before it starts; if a blocking check fails, the update never begins. A release that fails its health check is rolled back together with the binary, frontend, migration directory and database. A monthly recovery drill proves the panel backup actually restores.
Couldn't find what you're looking for?
SanalCP is under active development. Suggest a missing feature on GitHub.