VPS Tutorials
Install CloudPanel on a VPS (2026): Ubuntu Site Panel, WordPress, SSL, Backups and Security Hardening
Install the CloudPanel site panel on a VPS from scratch, covering the official Ubuntu 24.04 installation, secure access on 8443, WordPress site building, domains and SSL, site users, remote backups, updates and common troubleshooting.
CloudPanel is a free VPS site panel for PHP, WordPress, Node.js and static websites. It suits individual site owners and small teams who do not want to maintain Nginx, PHP-FPM, databases, site users and SSL configuration by hand, yet still want to keep control of the server.
This article uses a brand-new Ubuntu 24.04 LTS VPS as an example, deploys CloudPanel v2 with the official CloudPanel installer, and completes secure panel access, WordPress site building, domain resolution, Let's Encrypt HTTPS, site users, remote backups, updates and common troubleshooting.
CloudPanel installs and manages Nginx, PHP, databases and other services directly on the host machine; it is not a Docker container panel. Do not install it on a production server that already runs BT Panel, 1Panel, aaPanel, Apache, MySQL or a large number of Docker ports.
CloudPanel's core advantages are a clean interface, relatively restrained resource usage, and ready-made workflows for PHP and WordPress site building.
| Requirement | Is CloudPanel suitable | Notes |
|---|---|---|
| Quickly build WordPress, WooCommerce or PHP websites | Suitable | Can directly create sites, databases, SSL and site users |
| Manage multiple independent websites on the same machine | Suitable | Each site uses an independent system user and directory |
| Mainly manage Docker Compose applications | Not a priority | 1Panel, Portainer or plain Compose are more direct |
| Need email mailbox hosting | Should not rely on the panel alone | For site email, use an independent SMTP; plan mailbox services separately |
| Already have a complex Nginx/MySQL production environment | Not recommended to install directly | The installer may change existing services and configurations |
If you are still choosing between BT Panel, aaPanel, 1Panel, CyberPanel and HestiaCP, you can first read How to choose a VPS control panel. CloudPanel leans toward a lightweight site-building environment, not a general-purpose server operations platform.
CloudPanel officially currently supports x86 and ARM64, with systems including Ubuntu 22.04/24.04/26.04 and Debian 11/12/13. The official minimum requirement is 1 CPU core, 2GB memory and 10GB disk, but this configuration only means it can be installed, not that it is suitable for a production website.
| Scenario | Recommended configuration | Notes |
|---|---|---|
| A single lightweight WordPress | 2 cores, 4GB, 50GB NVMe | Suitable for corporate showcase sites and personal blogs |
| 2-5 small and medium websites | 4 cores, 8GB, 100GB NVMe | Leave room for PHP-FPM, databases and backups |
| WooCommerce or high-traffic websites | 4-8 cores, 8-16GB and up | Requires caching, monitoring and independent load testing |
A brand-new Ubuntu 24.04 LTS is recommended. Before buying a VPS, confirm it has a public IPv4, console or VNC, snapshot capability, and that ports 80, 443 and 8443 are not blocked by the provider.
First update the system and confirm the version, architecture and port usage:
sudo apt update
sudo apt upgrade -y
cat /etc/os-release
uname -m
sudo ss -lntp
df -h
free -h
Ports 80, 443, 3306 and 8443 should not be occupied by existing services. Then confirm the hostname and time synchronization are normal:
hostnamectl
timedatectl status
If the server already holds data, create a provider snapshot and an off-site backup first. CloudPanel officially also requires an empty server; do not treat the installer as a tool to "add an interface" to an existing LNMP environment.
Installation and site building require the following ports:
| Port | Purpose | Public policy |
|---|---|---|
| 22/TCP | SSH | Allowing only management IPs is safer |
| 80/TCP | HTTP and certificate validation | Allow public access |
| 443/TCP | HTTPS websites | Allow public access |
| 8443/TCP | CloudPanel admin backend | Strongly recommended to allow only management IPs |
Prefer restricting 8443 in the VPS provider's cloud firewall or security group. First obtain your current public IP, then set it so that only that IP can access 8443/TCP. Do not expose database port 3306 directly to the public internet.
If your management IP changes frequently, access the panel via WireGuard, Tailscale, an SSH tunnel or temporary firewall rules; do not permanently open the admin backend to the whole internet for convenience.
Switch to a root shell:
sudo -i
The official CloudPanel installation command first downloads the script, then verifies the SHA-256. The checksum below comes from the official documentation dated August 28, 2026; the hash may change after the installer is updated, so check the latest command on the official CloudPanel installation page before running it.
This article chooses the officially supported MySQL 8.4:
curl -sS https://installer.cloudpanel.io/ce/v2/install.sh -o install.sh
echo "8146dbe0a488e7088b04071b0c34d59aa0ab1fe9dcec382d395fd155c9e6c476 install.sh" | sha256sum -c
sudo DB_ENGINE=MYSQL_8.4 bash install.sh
Only continue running if the output is install.sh: OK. Do not skip the verification, and do not download modified installation scripts from blog mirrors or cloud drives.
The installation process deploys CloudPanel, Nginx, PHP, MySQL and related system services. After completion, check:
systemctl --failed
sudo ss -lntp | grep -E ':(80|443|8443)'
curl -kI https://127.0.0.1:8443
If the installation is interrupted, first save the complete error output and the relevant logs in /var/log; do not repeatedly run the installation script. Confirm that disk, memory, DNS and software sources are normal before proceeding.
Open in a browser:
https://你的VPS公网IP:8443
The first visit uses a self-signed certificate, and the browser will show a certificate warning. Confirm that the address is indeed your own VPS IP, then continue and create the CloudPanel administrator account.
Administrator settings should meet the following:
- Use an independent username, not
admin,rootor a common nickname; - Use a long random password generated by a password manager;
- Use a dedicated admin email address that can properly receive security notifications;
- After creation, log out and log in again once;
- Confirm that 8443 only allows access from your own IP or VPN subnet.
Do not give the CloudPanel administrator account to site editors. Daily uploads and deployments should use site users; the panel administrator is only for server-level management.
First add records at your DNS provider:
A example.com 你的VPS公网IPv4
A www.example.com 你的VPS公网IPv4
If IPv6 is not configured, do not add incorrect AAAA records. Check resolution:
dig +short example.com A
dig +short www.example.com A
Log in to CloudPanel, select + Add Site, then select Create a WordPress Site. Fill in:
- Domain Name:
example.com; - Site Title: the website name;
- Admin User Name: do not use
admin; - Admin Password: an independent strong password;
- Admin E-Mail: a usable site administrator email;
- PHP Version: choose a stable version explicitly supported by your theme and plugins.
CloudPanel creates the site user, Nginx vhost, database and WordPress files. After creation, visit respectively:
http://example.com
http://example.com/wp-admin/
If you would rather isolate WordPress and the database with Docker, you can refer to VPS WordPress Docker tutorial. The CloudPanel approach is better suited to centrally managing multiple traditional PHP websites.
On the site page, go to SSL/TLS, select Actions → New Let's Encrypt Certificate, add example.com and www.example.com, then create and install the certificate.
Before issuance, you must confirm:
- Both domains already resolve to the current VPS;
- 80 and 443 allow public access;
- No old AAAA records point to another server;
- DNS changes have propagated;
- The Cloudflare proxy is not forwarding requests to the wrong origin.
Test after issuance:
curl -I https://example.com
curl -I https://www.example.com
If you use Cloudflare, you can use a Cloudflare origin certificate and set the SSL/TLS mode to Full; it is even better to further restrict the origin to accept only Cloudflare IPs. Do not use Flexible mode, which easily causes redirect loops and keeps plaintext HTTP between Cloudflare and the origin.
CloudPanel creates an independent Linux user for each site; site directories are usually located at:
/home/站点用户/htdocs/域名/
Add an SSH Key on the site's SSH/FTP page and prefer key-based login:
ssh-keygen -t ed25519 -a 100
When deploying code, running Composer or WP-CLI, use the site user; do not modify site files as root for long periods. Files written by root may cause permission errors in PHP-FPM, uploads and automatic updates.
Check directory ownership:
sudo find /home/站点用户/htdocs/域名 -maxdepth 2 -printf '%u:%g %p\n' | head
Do not run chmod -R 777 whenever you hit a permission problem. First confirm the specific directory, site user, PHP-FPM user and the paths that need write access, then fix ownership or apply least privilege.
After logging in to /wp-admin/, complete immediately:
- Set permalinks to an SEO-friendly structure;
- Delete default posts, pages, unused themes and plugins;
- Enable two-factor authentication for the administrator;
- Configure an independent SMTP and test password resets and form emails;
- Prohibit installing cracked themes and plugins of unknown origin;
- Set the site time zone, language, privacy policy and backup window;
- Test media uploads, post publishing, pretty permalinks and HTTPS redirects.
CloudPanel manages the web and database environment, but it will not audit every WordPress plugin for you. Plugin vulnerabilities remain a common entry point for website compromise.
CloudPanel lets you choose the PHP version for a site, adjust PHP settings, and supports caching capabilities such as Varnish. Measure before optimizing; do not turn on all caches at once from the start.
First observe resources and slow requests:
top
free -h
df -h
sudo journalctl --since "30 minutes ago" -p warning
WordPress performance problems usually come from plugins, themes, PHP-FPM, slow database queries, external APIs and images, not just panel settings. If you need systematic troubleshooting, continue reading What to do when WordPress is slow on a VPS.
Before enabling Varnish or page caching, first exclude the admin login, shopping cart, checkout, member center and other personalized pages. WooCommerce sites must not cache all responses indiscriminately.
CloudPanel supports backing up sites to Amazon S3, Wasabi, DigitalOcean Spaces, Dropbox, Google Drive, SFTP, Hetzner Storage Box or other compatible storage via Rclone.
Configure the storage provider in Backups in the Admin Area. When using S3-compatible storage:
- Create a dedicated Bucket or prefix;
- Use an Access Key with minimal permissions;
- Do not use the cloud account's global administrator key;
- Set reasonable backup times, retention periods and lifecycle rules;
- After creating the first backup, you must confirm on the remote end that the files actually exist.
By default, CloudPanel backs up the site vhost and the site user's Home directory, but excludes .ssh, logs and tmp. Databases, site files, panel configuration and VPS snapshots should each be confirmed according to the recovery goal; do not assume the whole machine is recoverable just because you see "task succeeded".
Do a recovery drill at least once a quarter. For the complete process, refer to VPS backup and recovery drill tutorial.
CloudPanel is distributed as Debian packages; the official update command is:
sudo -i
clp-update
Before updating, you must create a VPS snapshot and verify site and database backups. Then record the current state:
df -h
free -h
systemctl --failed
sudo ss -lntp | grep -E ':(80|443|8443)'
After updating, check:
- The CloudPanel 8443 backend can be logged in to;
- HTTP/HTTPS for all websites works normally;
- The WordPress backend, media uploads and scheduled tasks work normally;
- MySQL, Nginx and PHP-FPM have no persistent errors;
- Remote backups can still connect and create new backups.
Do not automatically run major panel version updates unattended. First check the CloudPanel Changelog, then schedule a maintenance window and rollback plan.
- Allow 8443 only from fixed management IPs, VPN or SSH tunnels;
- Use keys for SSH and disable unnecessary root password login;
- Use different passwords for the CloudPanel administrator and the WordPress administrator;
- Use independent site users for site deployment, not root for daily operations;
- Do not expose the database to the public internet; manage it remotely via SSH tunnel;
- Regularly update the system, CloudPanel, PHP, WordPress, themes and plugins;
- Configure off-site backups, provider snapshots and actual recovery drills;
- Monitor disk, inodes, memory, certificates, website availability and backup results;
- Regularly check CloudPanel Events, Nginx logs and abnormal logins.
The panel reduces configuration work, but it also adds a high-privilege web management entry point. Restricting 8443 is more important than simply changing the port.
sudo ss -lntp | grep ':8443'
curl -kI https://127.0.0.1:8443
systemctl --failed
If it is accessible locally but the browser times out, it is usually because the cloud firewall, security group or local firewall has not allowed the management IP. Do not permanently open it to 0.0.0.0/0 just for testing.
dig +short example.com A
dig +short example.com AAAA
curl -I http://example.com
sudo ss -lntp | grep -E ':(80|443)'
Focus on checking for incorrect IPv6, DNS not yet propagated, port 80 blocked, the domain resolving to an old server, and CDN proxy configuration. Before certificate issuance, you can temporarily switch the Cloudflare record to DNS Only, then enable the proxy after completion.
First confirm that Nginx and the corresponding PHP-FPM version are normal:
systemctl --failed
sudo journalctl -u nginx --no-pager -n 100
sudo tail -n 100 /var/log/nginx/error.log
free -h
df -h
Common causes include PHP-FPM stopped, socket mismatch after a PHP version switch, insufficient memory, full disk and incorrect vhost configuration.
Confirm that the origin's 80/443 are listening normally, that Cloudflare DNS points to the correct IP, and check whether the firewall mistakenly blocks Cloudflare nodes. For the complete troubleshooting steps, see Cloudflare 521 / 522 troubleshooting.
Check the site directory owner, disk space, PHP upload limits and temporary directory. Do not directly run a site-wide 777:
df -h
df -i
sudo find /home/站点用户/htdocs/域名 -maxdepth 2 -printf '%u:%g %m %p\n' | head -n 30
If files were created by root or another user, restore them to the correct site user and verify the user identity used by PHP-FPM.
- Installed on a brand-new Ubuntu/Debian system that is officially supported
- The official installation script's SHA-256 verification passed
- 8443 allows only management IP or VPN access
- The WordPress domain, HTTPS, backend and pretty permalinks work normally
- Administrator, site user and database accounts are independent of each other
- SMTP, password reset and form emails have been tested
- Remote backups have been created, and the files are confirmed to exist on the storage end
- A site file and database recovery drill has been completed once
- There is a snapshot before updating, and sites, PHP, database and backups are checked after updating
Only after completing these steps is CloudPanel more than just a control panel you can log in to; it becomes a VPS site-building environment with a domain, HTTPS, independent site users, remote backups and a controllable update process.