Features
Everything you need to host websites, in one panel.
Every feature is included in every plan, the free one too.
WordPress
Everything a fast, secure WordPress site needs, ready out of the box.
Learn more In the manual- One-click installDedicated database, fresh keys, permalinks, WP-Cron on system cron, final check.
- nginx page cacheSafe exclusions for WooCommerce (cart, checkout, account), logged-in users, admin, REST API.
- Private Redis per siteLocal socket, no network port, capped memory, Object Cache plugin installed.
- OPcacheHit rate and memory read directly from PHP-FPM.
- Speed measurementHome page response time with and without cache, with history.
- Safe updatesBackup, update, official checksums, home page check and automatic rollback if something goes wrong.
- Nightly automatic updatesOff, security and minor only, or everything: always with the same safe procedure.
- Staging copyPassword-protected, not indexed, publishable to production (files, database or both).
- Known vulnerabilitiesEvery night WordPress, plugins and themes compared with the Wordfence Intelligence list: email and, if you like, an automatic fix with the safe update.
- HardeningLogin rate limit, fail2ban, XML-RPC closed, PHP blocked in uploads, file editor off, sensitive files hidden, nightly integrity check.
- ToolsPassword-less wp-admin (single-use link), safe search & replace, WP-CLI in the browser, debug and maintenance mode.
- ImportBring a WordPress from any host with just its address and wp-admin password, or by uploading the files archive and database dump.
- Backup and restoreLocal copies on request and one-click restore, with a safety copy taken before restoring.
Apps, languages and databases
Not just WordPress: over 40 applications in one click, Node.js, Python and .NET with Git deploy, PostgreSQL, remote MySQL and .htaccess rules when you need them.
In the manual- App installerOver 40 applications: WordPress, WooCommerce, PrestaShop, Joomla, Drupal, Nextcloud, Matomo, Laravel, Moodle, Mautic, forums, wikis, CRMs and more, with a dedicated database, nginx rules, cron and the admin password shown only once.
- Verified packagesOfficial downloads checked against the SHA-256 of a signed catalogue, refreshed without updating the panel; updates with a copy of files and database and automatic rollback.
- Node.js and PythonA site can be a Node.js (20, 22, 24) or Python (3.11–3.13) application: it runs as a service with the site's user, memory and CPU limits, nginx in front with HTTPS, HTTP/2 and WebSocket.
- .NET applicationsASP.NET Core 8 and 10 sites, with the runtime installed by the panel and the application as a service behind nginx.
- Site builder with AIBlock pages turned into a fast static site; the AI assistant writes the draft and edits it in chat, step by step.
- Git deployA deploy key per site: pulls the branch, installs dependencies (npm, uv), runs the build, restarts and checks the application answers. Logs, restart and health check from the API too.
- PostgreSQLInstalled only when needed, next to MariaDB: databases per site with their own user, password-less Adminer, .sql and pg_dump import, backups and migration from cPanel.
- Apache/.htaccess compatibilityFor sites with their own .htaccess rules: nginx stays in front (certificate, static files, cache) and Apache runs PHP with the site's own pool, same limits. Migrations from cPanel and Plesk turn it on when needed.
Sites and PHP
Every site isolated in its own Linux user, with the PHP version you prefer.
In the manual- Per-site isolationLinux user, PHP-FPM pool,
open_basedir, private tmp and sessions for every site. - PHP 7.4 to 8.5Several versions on one server, installed from the panel; each site picks its own and tunes memory, limits and further directives from a safe list; extensions install one by one; Git deploy with webhook.
- Per-site PHP settingsMemory, uploads, max execution time, input vars, errors and PHP processes (how many and in which mode), verified with automatic rollback. The panel warns when a site runs out of processes.
- Verified configurationEvery change goes through
nginx -tandphp-fpm -t: if it fails, the previous config comes back. - Domains and aliasesSite aliases, Let's Encrypt HTTPS with DNS precheck, automatic renewal and "Renew now". For a certificate bought elsewhere (OV, EV) you paste it and the panel checks it.
- Wildcard certificates and dedicated IPA *.domain certificate with DNS validation (on-server DNS, Cloudflare or 1PrimeCDN) and an IP address all for the site.
- Site rulesRedirects, password-protected folders, IP blocking with notes, hotlink protection, error pages and MIME types, without touching the configuration.
- Request limit and CDNA limit of pages a minute per address stops the scripts downloading the whole site, even when they change address; signed-in users, Google and Bing get through. Behind 1PrimeCDN, Cloudflare or another CDN the panel sees the visitors' real address.
- Statistics and logsVisits, pages, referrers and errors for every site, with access and error logs readable from the panel and the most active addresses of the moment, to block in one click.
- Background jobsCertificates, backups, installs: visible progress, keep working meanwhile.
Accounts, resellers and white label
Three levels like WHM and cPanel: administrator, reseller, user. In one interface.
In the manual- Resellers with quotasMax accounts, assignable space and max sites for each reseller, and custom permissions: what they can do, like WHM's reseller privileges.
- PackagesLimits for sites, space, databases and allowed PHP versions, global or per reseller, number of files and monthly traffic with alerts, and the functions included (like cPanel's Feature Manager): for example a package without mail or without WordPress.
- Reseller brandingName, logo and support contacts seen by their customers, emails included.
- Notices and templateAn email to every account with the reseller's branding, and the files new sites start with instead of the welcome page.
- Upgrade linkResellers set their shop link: customers never see KoaPanel's plans.
- Log in asHelp a customer by entering their panel, with a log of who did it.
- TeamEvery account can give access to collaborators and agencies, up to 20, each with their own sign-in and only in the chosen sections, without sharing the password.
- SuspensionSuspend and reactivate an account without deleting anything.
Security
Antimalware, application firewall, network firewall and signed updates, with email and chat alerts.
In the manual- Built-in antimalwareWeb shells, obfuscated code, PHP in images and uploads, SEO spam redirects, suspicious cron and injections in the WordPress database. Files identical to the originals of wordpress.org are not flagged, and "Put the original back" puts the official file in place of the infected one.
- ClamAVDaemon, on demand or off depending on server RAM, falling back to clamscan.
- Scan historyEvery scan of every site up to 60 days back: files checked, ClamAV, new findings, result, with a filter for the ones with problems.
- WordPress integrityCore and plugins compared with official files; repair WordPress without touching
wp-content. - Real-time protectionEvery PHP, JavaScript, HTML or .htaccess file written to a site is checked seconds later; only certain detections are quarantined at once, the rest is emailed to you.
- Reversible quarantineNothing is deleted automatically: quarantine, restore, false positive.
- Application firewall (WAF)ModSecurity with the OWASP Core Rule Set stops SQL injection, XSS, file inclusion and scanners before they reach the site; detect-only or block, per server and per site, with "Exclude this rule" for false positives.
- Complete firewall, like WHMPorts by service, Allow / Block / Ignore lists with expiry, search an IP and "Unblock everywhere", register of the blocks, block by country, connection limits, flood and scans, Spamhaus and DShield lists, outgoing mail from the mail server only, email alerts and a security score. Test mode puts everything back if a change locks you out.
- fail2ban for every serviceSSH, the panel, FTP, mail and WordPress sign-in, each with its own thresholds, and a permanent block for whoever comes back; on ufw (Ubuntu) or firewalld (AlmaLinux and Rocky), with anti-lockout protection for SSH access.
- Valid certificate for the panelLet's Encrypt for the server's IP address too, renewed automatically: panel, phpMyAdmin and webmail without "Not secure". Or a name of yours, like panel.mydomain.com.
- Passkeys and two-step sign-inSign in with Face ID, Touch ID, Windows Hello or a security key, without a password; or protect sign-in with an authenticator app and 10 recovery codes. Administrators can make two-step sign-in mandatory per role.
- Encrypted credentialsS3 keys, DNS tokens and relay passwords encrypted on the server (AES-256-GCM).
Isolation & limits
Like CloudLinux, but included: every account has its own limits and its own isolated PHP. A site that overdoes it slows down only itself.
In the manual- Limits per accountCPU, memory, processes, concurrent PHP requests (entry processes), disk speed and operations (IOPS), number of files and database connections: in the package, on the single account (also from WHMCS options) or server defaults.
- Symbolic links protectionLike SecureLinks: a site cannot publish another site's files through a link. The SFTP of each site stays within its account's limits too.
- X-Ray for slow sitesOptional: for every PHP page that is too slow it shows the culprit plugin, theme or file and the slowest functions.
- Mail limitOptional: over the emails per hour of its limit an account cannot send any more, so a hacked site does not get the server blocklisted.
- Limits per resellerAn overall cap for all the customers of a reseller, on top of the limits of each account.
- Database limiterOptional, like MySQL Governor: longest query time and database CPU per account; whoever overdoes it gets fewer connections for a few minutes.
- PHP on demandOptional: the PHP of an account starts at the first visit and stops when not needed. Made for servers with hundreds of accounts.
- Isolated PHP, like CageFSThe PHP and cron jobs of each account see only their own sites, the system read-only and a private /tmp.
- Limits & usage24-hour and 30-day graphs per account, the database too, the times it hit its limits, an email to the administrator, the reseller and the customer, a ranking and a report every Monday.
- Live usage and site errorsLike lvetop: CPU, memory, processes, PHP requests and disk of every account over the last seconds, its processes, and the site errors from the logs (5xx pages, PHP busy, out of memory).
- Optional and reversibleInstall it with one click when you need it, with the sites online; uninstalled, the server goes back as it was. It has its own version (now 1.3.0), shown on its page. Migrating from cPanel on CloudLinux, the limits of the accounts are imported. No licences: CloudLinux costs $18 a month per server.
- What it doesn't doNo modified kernel and no Ruby: it covers PHP and WordPress, i.e. almost all shared hosting; the sites' Node.js and Python applications have their own memory and CPU limits.
Backups
Encrypted copies of files, databases, mail and site settings, wherever you want.
In the manual- restic to S3, SFTP, FTP, Google Drive or diskAWS, Wasabi, Backblaze B2, MinIO or any S3-compatible storage, a storage box over SFTP, an FTP/FTPS server or a Google Drive folder.
- Scheduled with retentionDaily backup at the time you choose, with daily, weekly and monthly retention.
- Selective restoreFiles, databases, mail and settings, together or separately, from any snapshot.
- Site settingsPHP, aliases, site rules, SFTP access, cron jobs, DNS records and the SSL certificate come back with the site.
- Downloadable archiveEvery backup downloads as a .tar.gz with files, databases, mail and settings, by the customer too.
- Mail includedThe site's mailboxes with messages, passwords and forwarders. Restore all the mail or a single mailbox, without losing or duplicating the messages received since.
- AlertsEmail to admins if a backup fails.
Optional mail service: Postfix, Dovecot, Rspamd and the SnappyMail and Roundcube webmails.
In the manual- Mailboxes, aliases and forwardersWith per-mailbox quota and autoresponder.
- Antispam and DKIMRspamd with 2048-bit DKIM signing per domain; each domain chooses strictness, spam folder and senders always accepted or refused.
- One-click webmailOpens from the panel already signed in, with the panel's branding.
- Pre-flight checksPort 25, reverse DNS, hostname, blocklists and memory, explained plainly.
- Outgoing IP per domainEach domain can send from its own server IP address, to keep reputations apart.
- Queue and delivery logThe queue is managed message by message (retry, hold, delete) and whoever has a domain sees whether its emails were delivered, bounced or refused.
- SMTP relayFor providers that block port 25 (Brevo, Mailgun, Amazon SES…).
- Mailbox migrationFrom cPanel with messages and original passwords.
DNS, HTTPS e CDN
Your domains' DNS on the server itself, like cPanel, or on Cloudflare and 1PrimeCDN, right from the panel.
In the manual- DNS on the serverAuthoritative PowerDNS, with site and mail zones created and updated by themselves.
- DNSSEC and your own nameserversns1/ns2 on your domain (per reseller too), per-zone DNSSEC and a second KoaPanel server as secondary.
- DNS recordsA, AAAA, CNAME, MX, TXT, CAA… with import and export.
- Point to serverShows what changes before applying: never automatic.
- Least-privilege tokensCloudflare token verified and stored encrypted.
- File managerUpload, download, create, rename and delete, confined to the site folder.
- Code editorHighlighting, syntax checks and a warning if the file changed meanwhile.
- Chrooted SFTPPassword or SSH keys, locked in the site folder, no shell.
- FTP e FTPSFTP accounts per site when you need them (for tools that don't speak SFTP), with the option to accept encrypted FTPS only.
- MariaDB + phpMyAdminDatabases and users per site, phpMyAdmin with single sign-on; PostgreSQL with Adminer when needed; remote MySQL access only from the IP addresses you allow.
- CronSchedule builder, next run, result and output of the last one.
- Signed and verifiedDigital signature and checksum verified before installing.
- Automatic rollbackIf the new version doesn't respond within a minute, the previous one comes back.
- Automatic, notify or manualWith a time window of your choice.
- System updatesUbuntu (apt) or AlmaLinux and Rocky (dnf): pending packages, security, reboot required; automatic security updates on by default.
AI assistant
A diagnosis of your sites by Anthropic's Claude, with safe fixes that you apply.
- Reads what mattersPHP and Nginx logs, configuration and site responses; passwords and personal data are removed before sending.
- Fixes with a previewEvery proposal shows the current and the new value; apply it in one click and undo it the same way.
- Safe actions onlyThe model can only propose changes from an allow-list: no arbitrary commands on the server.
- KoaPanel AI, no key neededEvery licence, free ones too, includes 100 Haiku and 5 Sonnet calls a month. KoaPanel AI PRO: €29 a month for 3,000 Haiku calls and Sonnet up to €10 a month. Or use your own Anthropic key.
- Deep analysisHaiku makes the diagnosis; when it does not find the cause, Sonnet looks again. A deep analysis with Sonnet is also one click away, and the debug chat follows the problem step by step.
- Nightly check and customersEvery night the AI looks only at the sites showing problems. If you want, resellers and users use it on their own sites with the server's credits.
RAM and disk savings
Server › Savings measures where the memory really goes and frees RAM and disk without touching the sites. Every item turns on and off with one click.
In the manual- Real RAM, site by siteRAM split between sites, PHP, databases, mail, web, DNS, panel, system and kernel, with shared memory counted once.
- Compressed RAM and swapzswap with zstd and, if there is none, a swap file: when RAM runs out the database is not killed.
- Idle PHP and servicesPHP versions no site uses stop and start again by themselves when needed; system services a web server doesn't need are blocked.
- Compressed mailNew and existing messages compressed, with no difference for mail users: −41% on our test server.
- Identical files sharedOn XFS and Btrfs identical site files share disk blocks, every week: 10 WordPress sites from 1.1 GB to 458 MB. On ext4 the panel measures the possible saving.
- Guided cleanupPackage cache, journal, leftovers of deleted sites and WordPress updates, temporary files and debug logs. Never sites, mail or databases.
Resources and disks
When the server gets tight, grow it from the panel.
- Bigger planOn Vultr and Hetzner Cloud: CPU, memory and disk of the next plan, with the new cost to confirm and the file system grown at the restart.
- ProcessesThe programs running, the busiest first, stopped one by one: the whole server for administrators, their own sites for resellers and accounts.
- Disks for your sitesCreate a volume at the provider or prepare a new disk; the system disk is never touched.
- Real disk quotasThe package's space and files as a limit of the disk, shared by all the sites of an account: on XFS (AlmaLinux, Rocky) and on the disks for the sites prepared by the panel.
- Space always visiblePartitions, used space and SMART status, disk by disk.
More servers and integrations
One view of every server, a terminal in the browser and open doors to your own systems.
In the manual- Load barAt the top of every page, like in WHM: server load, CPU, memory and disk, and the alerts that need a look, linked to the right page.
- All serversOne page with your linked servers: status, load, space, sites and alerts at a glance.
- Function searchLike in WHM: type what you look for in the menu, cPanel and Plesk names too (“zone editor”, “softaculous”), and get to the right page or section; it finds sites and accounts too. Ctrl+K (Cmd+K on Mac) or / from any page.
- Web terminalThe server's root shell, the site user's shell and, when the administrator turns it on, a shell for the accounts closed in their site, with the password asked every time, idle timeout and activity log.
- REST API and webhooksDocumented as OpenAPI 3.1, personal keys for user accounts too (read-only available), HMAC-signed webhooks: see Developer API.
- WHMCS, Blesta and FOSSBillingCreation, suspension, upgrades and one-click login from your billing system, with free official modules: Integrations.
- Alerts on Slack, Discord and TelegramStopped services, failed backups, suspicious files, expiring certificates and new versions reach your chat, with the server's name. Each administrator picks their own destinations.
- Prometheus monitoringServer, site, certificate and backup metrics for Prometheus and Grafana (also Zabbix, Netdata, Uptime Kuma) with an API key.
- Customer areaLicences, invoices and support with Prime Software ID; connect a panel to your account with a code.
- Automatic error reportsWhen something breaks the panel tells us, with technical data only, and shows whether the problem is known or fixed; turn it off in Privacy.
- Linked serversSwitch servers already signed in with a single-use ticket.
- Move an accountSites, MariaDB and PostgreSQL databases, mailboxes with their messages, cron, certificates and DNS move to a linked server with the same passwords; a final copy of the changes only and one-click undo.
- Remote mail serverAn account's mail can live on another linked server: the DNS publishes its records and the customer goes in from the Mail page, with no other password.
- MigrationFrom cPanel, Plesk, CWP, DirectAdmin or Linux: backup file or SSH. A WordPress site from any host with its address and password. It resumes from where it stopped, gives every imported site a traffic light and completes the cutover (sync, DNS, SSL, cron) in one click, at a chosen time too.
- Italian, English and FrenchLanguage per user: interface, emails, error messages and manual.
- Built-in supportSupport requests right from the panel.
- System emailsAlerts on certificates, backups, disk, passwords and new versions.
Your next server deserves a better panel.
Free up to 3 websites for personal use. When you grow, pick the right plan: every feature is included in every plan.