CyberPanel on DigitalOcean: Install, Secure and Run a Hosting Panel

CyberPanel on DigitalOcean means installing the free CyberPanel control panel, built on OpenLiteSpeed, onto a droplet so you can create sites, databases and email from a web interface, and it works well as long as you accept that you are now the sysadmin of that server.

A panel takes the typing out of server setup. It does not take the responsibility out.

What you are actually setting up
Prepare the droplet
Install CyberPanel
Lock it down before you add sites
Create your first site and keep it healthy
Panel on a VPS versus managed WordPress
Backups and recovery you should rehearse
How this fits the rest of the stack
FAQ

What you are actually setting up

CyberPanel is a web hosting control panel. Instead of editing web server configuration files and creating databases by hand, you use a browser interface to add a website, issue a certificate, create a database and manage backups. It is built around OpenLiteSpeed, a web server known for speed and for compatibility with common PHP applications, especially WordPress.

DigitalOcean offers it two ways: as a one-click image in its marketplace, and as something you install yourself on a fresh Ubuntu droplet. Either way, the end result is a virtual server with the panel, the web server, a database engine, PHP and optional mail components installed together.

It is worth being clear about the arrangement. A droplet is a virtual server you rent, and the panel is software you run on it. You are not buying managed hosting. The provider keeps the physical host running. Everything from the operating system upward is yours: updates, firewall, backups, security, performance and recovery when something breaks.

For people who run several client sites and want a panel without paying a per-server licence, this is a reasonable and popular setup. For someone who wants one WordPress site to simply work, it is more server than the job needs. The post on cPanel on a VPS discusses a similar trade for a different panel.

Prepare the droplet

Pick a supported operating system. The panel’s installer targets specific Ubuntu long-term releases, so use the version its documentation lists rather than the newest one. Check that before you create the droplet, because a mismatch fails partway through the install.

Size it realistically. A panel with the web server, a database and a few sites idles at a noticeable amount of memory before any site traffic. A very small droplet will struggle, so start with a plan that gives you comfortable memory and add swap as a safety net. Monitor and resize if it is tight.

Then do the standard first steps:

adduser deploy
usermod -aG sudo deploy
apt update && apt upgrade -y
ufw allow OpenSSH

Set a hostname that resolves to the droplet’s address with a DNS record, because the panel and its certificates work better with a real hostname than a bare IP. Enable backups or snapshots at the provider before you install anything, so you can roll back a failed install in minutes rather than rebuilding.

Log in with SSH keys, and disable password authentication for SSH once you have confirmed that the key works. The existing post on adding a domain to a droplet covers the DNS steps.

Install CyberPanel

The installer is a script you run as root on the droplet. Always read installation instructions from the project’s own documentation, because the command and options change between versions. The shape of it is:

sudo su -
sh <(curl https://cyberpanel.net/install.sh || wget -O - https://cyberpanel.net/install.sh)

The script asks a series of questions: which edition to install, whether to add components such as a full mail stack and a DNS server, which database setup to use, and which admin password to set. If you do not need mail or DNS from the panel, leave them out. Fewer services mean a smaller attack surface and less memory use.

The install takes several minutes. When it finishes it prints the address of the admin panel, which listens on port 8090, along with the admin credentials. Save the credentials in a password manager immediately. The first sign-in uses HTTPS with a self-signed certificate, so your browser will warn you. Proceed once, then replace it with a proper certificate for the panel hostname inside the panel.

If you used the marketplace image instead, the software is already installed and the first login details are in the droplet’s message of the day when you connect over SSH.

Lock it down before you add sites

Control panels are targets because one login controls many sites. Spend ten minutes on security now.

Change the admin password to a long random one and enable two-factor authentication if the panel version supports it.
Restrict port 8090. Allow it only from your own IP address, or reach it through an SSH tunnel, rather than leaving the admin interface open to the internet.
Use a cloud firewall. Allow 22, 80 and 443 publicly, restrict everything else.
Keep SSH key-only. Disable root login over SSH and turn on a brute-force protector such as fail2ban.
Enable automatic security updates for the operating system.
Schedule backups inside the panel to remote storage, and test a restore.

ufw allow 22,80,443/tcp
ufw allow from YOUR.IP.ADDRESS to any port 8090 proto tcp
ufw enable

The weak spot of panels is the panel software itself. A vulnerability in the admin interface can expose every site on the server, so updating the panel promptly matters more than almost anything else. Subscribe to the project’s announcements.

Create your first site and keep it healthy

In the panel, add a website by choosing a package, entering the domain, and creating it. Point the domain’s DNS A record at the droplet’s IP address, then issue a free certificate from inside the panel once DNS has propagated. Most panels renew certificates automatically, but check the renewal job rather than trusting it.

For WordPress, the panel offers an installer that creates the database and user for you. Afterwards, the usual WordPress hygiene applies: keep core, themes and plugins updated, remove what you do not use, and set up caching. OpenLiteSpeed has its own cache plugin that works with its server, which is one of the reasons people choose this stack.

Plan the ongoing chores, because they are the real cost:

Operating system and panel updates, monthly at least.
Backup monitoring and periodic restore tests.
Disk space checks, since logs and backups fill disks quietly.
Resource monitoring for memory and CPU.
Certificate and domain renewals.

None of this is difficult. It is just constant, and a server that nobody updates becomes a liability within a year.

Panel on a VPS versus managed WordPress

The honest comparison is about time. Running a panel on a droplet is excellent when you manage many sites, need unusual software, or enjoy the control. It is a poor use of attention when what you actually want is a WordPress site that stays up.

RunxBuild offers managed WordPress on its own plan ladder, from a free plan and a $3 Starter plan up. It includes a file manager and a database browser in the dashboard, so you can browse, edit, upload and unzip files and work with tables, rows and SQL without SFTP or phpMyAdmin, and autoscaling is available. You do not patch an operating system or run a panel. It does not give you root access or arbitrary server software, which is the trade.

Choose the panel if you need that freedom, and choose managed WordPress if you do not. The docs on managed WordPress describe what is included.

Backups and recovery you should rehearse

Panels make backups easy to schedule and easy to forget to test. Decide what you are protecting against. A snapshot of the whole droplet protects against a failed upgrade or a deleted server. A site-level backup of files and database protects against a hacked or broken site. A copy stored off the server protects against the provider or the account itself failing. You want at least two of the three.

Configure the panel to send backups to remote object storage on a schedule, and keep several generations, since the bad change you want to undo may be a week old. Then actually restore one into a spare site or a second droplet. A backup you have never restored is a hope, not a backup.

Write down the recovery steps while you are calm: how to rebuild the droplet, install the panel, restore each site and repoint DNS. If that document takes more than a page, the setup is more complex than your needs, and that is useful information too.

How this fits the rest of the stack

A droplet plus a panel is cheap in dollars and expensive in hours, so count both. See what a managed WordPress plan costs next to your server estimate in the RunxBuild hosting calculator. When you would rather not patch a server, the RunxBuild dashboard is where a managed WordPress site is created.

Useful related references:

FAQ

Can I install CyberPanel on a DigitalOcean droplet?

Yes. Use a supported Ubuntu release, run the project’s installer as root or deploy the marketplace image, then log in to the admin panel on port 8090 and secure it.

How much memory does CyberPanel need?

The panel, OpenLiteSpeed and a database use a noticeable amount of memory before any site traffic, so avoid the smallest droplet sizes. Start with comfortable memory and add swap as a safety net.

Is CyberPanel secure by default?

Not by itself. Change the admin password, restrict port 8090 to your IP, enable a firewall, keep SSH key-only and update the panel promptly. The panel is a high-value target.

Do I need a control panel to host WordPress?

No. You can run WordPress directly on a server or use managed WordPress, which removes server administration. A panel helps mainly when you manage several sites on one machine.

What are the ongoing tasks after setup?

Regular system and panel updates, tested backups, disk and resource monitoring, and certificate renewal checks. Without them the server gradually becomes a risk.