Features
Every tool in the user panel and the admin panel. Each row shows which install method the tool works on: your own server, Docker or Railway.
Files and access
Account owners manage their files in the browser, over FTP or with an SSH key.
File manager
Code editor, drag-and-drop uploads, zip/tar, permissions. Hardened against symlink attacks.
Web terminal
An in-browser terminal that runs as the account user (when the package allows it).
FTP accounts
Pure-FTPd virtual users locked to a directory.
SSH access
Per-account SSH key management.
Directory privacy
Password-protect folders with HTTP Basic Auth (bcrypt).
Disk usage
See which folders take up space.
Git version control
Clone repositories, run a deploy script, and deploy automatically on push via GitHub/GitLab webhooks.
Databases
MySQL and MariaDB with a familiar wizard flow; phpMyAdmin opens in one click.
MySQL / MariaDB databases
Account-prefixed names, users, privilege selection, a database wizard and connection snippets.
One-click phpMyAdmin
No stored passwords: a single-use sign-in valid for 60 seconds that only shows the account's own databases.
Remote MySQL
Allow database access from specific IP addresses.
Domains and web
Apache 2.4 (mpm_event) with a separate PHP-FPM pool per account. Your .htaccess files keep working.
Domains
Addon domains, subdomains and aliases. Internationalized (IDN) domains are converted to punycode automatically.
PHP version per domain
PHP 8.2, 8.3 and 8.4. Each account's pool runs as its own user, locked with open_basedir.
PHP INI editor
memory_limit, upload_max_filesize, max_execution_time and more.
Redirects
301/302, exact match or prefix redirects.
IP blocker and hotlink protection
Block IPs or CIDR ranges and stop other sites from embedding your images.
SSL/TLS
Automatic Let's Encrypt certificates and renewals, plus custom certificate upload. Caddy handles TLS in Docker, Railway at its edge.
Visitors, errors, bandwidth
Apache access and error logs, PHP errors and a monthly traffic chart.
Apps: Node.js, Next.js, Python
What traditional panels treat as an add-on is first-class in bipanel: framework detection, builds and live logs.
Node.js and Next.js apps
Build and start commands, environment variables, internal port assignment, an Apache reverse proxy with WebSocket support, and restarts.
Python apps
Flask, Django and FastAPI with venv and gunicorn.
App installer
One-click WordPress, Laravel, Next.js, Express, Flask and a blank PHP template.
Deploy on git push
On a signed webhook: pull, build, restart. The same flow for PHP and Node projects.
Cron jobs
The user's crontab on a server; the panel's own scheduler in Docker and on Railway.
Email and DNS
Full email and authoritative DNS on a server install; Cloudflare DNS sync in containers.
Email accounts
Postfix + Dovecot, quotas, suspension and Roundcube webmail.
Forwarders and autoresponders
Address forwarding, date-ranged autoresponders (Sieve) and a default address.
Deliverability
SPF, DKIM and DMARC suggestions; DKIM signing on server installs.
DNS zone editor
Authoritative DNS with BIND; record suggestions and Cloudflare sync in Docker and on Railway.
Backups
Full, files-only or database backups per account, with scheduled copies to remote storage.
Account backups
Full, files-only or database-only backups with download and restore.
Remote destinations
S3, Backblaze B2, Google Drive and SFTP via rclone, with schedules and retention.
Migrate from other panels
Import full account backups (cpmove format): files, databases and domains.
Admin panel
A separate panel for admins and resellers (server management). Create and package accounts, and open any customer's panel in one click.
Accounts
Create, suspend, change package, reset password, delete, and log in as the customer.
Packages and feature lists
Disk, bandwidth, domain, database, email, app and memory/CPU limits plus the enabled tools, on one screen.
Resellers
Per-reseller account, disk and bandwidth limits, overselling and ACLs.
Branding
A white-label panel with your own name, logo and accent color.
Server status and services
CPU, memory, disk and a 24-hour chart; start, stop and restart services.
PHP, Apache and MySQL settings
Default PHP version and extensions, Apache modules and config test, MySQL process list.
Updates
Signed releases; one-click or automatic updates on server installs, with rollback if something breaks.
Audit log and API
Who did what, when and from which IP. API tokens for automation.
Security
Protections that are on by default, with no extra licenses.
DDoS protection
Per-IP request limits with automatic bans, nftables connection limits, a one-click "under attack" mode and Cloudflare control.
Brute-force protection
IP bans based on failed logins, with an allow list.
Two-factor authentication
TOTP, which you can require for admins and resellers.
Firewall
UFW and Fail2Ban management.
Account isolation
Each account runs as its own system user; its PHP-FPM pool is locked to the home directory with open_basedir, and commands run without a shell.
Missing a tool you need?
Our roadmap is ordered by what customers ask for. Incremental backups, Rspamd spam filtering and multi-server clusters are coming next.