Running a hosting server doesn't have to mean pricey add-ons, per-account bills and manual updates. We built bipanel to fix that.
With per-account pricing, your bill grows with your customer list. bipanel is licensed per server: every account up to your plan's limit costs nothing extra, and you don't need a license at all for up to 3 accounts.
Each account runs as its own system user with its own PHP-FPM pool, locked to its home directory with open_basedir. File operations are hardened against symlink attacks, and commands run without a shell.
Apps need no add-ons: frameworks are detected, and build and start commands, environment variables, live logs and git-push deploys live on one screen. PHP sites and modern apps sit side by side on the same server.
The same code runs as full shared hosting on your own server, with Docker on any VPS, or as a single service on Railway. Your license works on all of them, so you can move when your needs change.
Every release is signed with Ed25519, and bipanel won't install anything it can't verify. The panel database is backed up before each update, and if the new version fails its health check, bipanel rolls back by itself. You choose the maintenance window.
DDoS protection, brute-force blocking, two-factor authentication, a firewall and an audit log come in the box, with no extra security product to buy.
Packages and quotas, resellers (account and resource limits, permission lists), white label, one-click login as a customer, and password-free single sign-on to phpMyAdmin come as standard.
The user and admin panels are in English and Turkish, and each user picks their own language. Purchasing, invoices, the customer portal and emails are bilingual too, with one currency: US dollars.
Sites, databases and email never leave your server. Even if a license expires, your sites keep running; only creating new accounts stops.
| bipanel | Traditional panels | |
|---|---|---|
| Pricing | ✓ Per server, flat up to the plan's account limit | Often per account; grows as you add accounts |
| Node.js, Next.js, Python | ✓ Built in | Often an add-on or extra license |
| Account isolation | ✓ Own user and PHP-FPM pool per account | Often needs an extra product |
| Where it runs | ✓ Server, Docker or Railway | Usually a server only |
| Updates | ✓ Signed, automatic, reversible | Varies |
| DDoS and brute-force protection | ✓ Built in | Often an extra product |
A general summary; individual products vary.
We don't hide what we haven't built yet. These are on our roadmap, ordered by what customers need.
Rspamd and ClamAV integration is coming in the next releases. SPF, DKIM and DMARC are available today.
Today you get full, files-only or database backups; incremental backups with restic are planned.
Node.js apps already have memory and CPU limits; account-wide limits including PHP-FPM are planned.
Wildcard certificates via DNS-01 validation are on the roadmap.
Splitting web, database, mail and DNS roles across servers comes in a later release.
Install on a clean Ubuntu or Debian server with one command; no license needed for up to 3 accounts.
curl -fsSL https://bipanel.io/install.sh | sudo bash -s -- --hostname server.example.com --email [email protected]