You bought a VPS and see a black screen with a blinking cursor. To set up a website, database, and SSL through the terminal, you need dozens of commands in the right order. Make one mistake in a config line and your site is down while you dig through logs for the cause.

aaPanel removes this barrier: the Linux server control panel installs with a single command and replaces the terminal with a browser interface. Sites, databases, multiple PHP versions, Docker, firewall, SSL certificates can all be configured with your mouse.

Below is the installation process from SSH to your first site, current as of mid-2026. We will also cover what most guides stay silent about: the panel port has not been 8888 for a long time, CentOS 7 cannot be installed, and "free and open" is a marketing simplification. We start with this because half the guides in search results still repeat information from 2021.

💡 Quick overview:

• Connect to your server via SSH as root and run a single universal command
• In a couple of minutes you get an HTTPS panel address with a random port, username, and password
• On first login you choose your environment: LNMP (Nginx) or LAMP (Apache)
• Immediately change the password, enable 2FA, and close unnecessary ports
• From the panel you manage sites, databases, Docker, firewall, and certificates

What is outdated in old guides

Before copying commands from guides that are three years old, check against this list. Mistakes here are costly.

Especially about the port: even fresh English tutorials from 2025-2026 continue to write "8888". This is a direct error and you simply will not reach the panel.

What aaPanel is and who it suits

aaPanel is a web-based Linux server management panel from a Chinese team (the international version of Chinese BT Panel). It runs on top of the OS and replaces the command line with a browser interface: sites, FTP, databases, multiple PHP versions, firewall, Docker, task scheduler.

The free version covers all basic tasks. The paid Pro adds multi-user accounts and billing integration, which is relevant for hosting providers.

Here is what the complete installation cycle looks like on a real VPS.

Honest take on the license

aaPanel is called "free and open," but this is a simplification. The panel is distributed under its own license (AAPANEL Open Source License Agreement), not MIT, GPL, or Apache. Key terms: source code for paid plugins is closed, you can modify the code for personal use, but publishing forks is prohibited.

The accurate description: not open source in the classic sense, but source-available with restrictions. Use it for free, yes. Fork it and release your own version, no.

The installer also sends installation counts to the developers, and in case of failure, the last lines of the installation log. Technically this is crash reporting, not a backdoor, but you should know about it.

Honest take on security

During 2025-2026, several critical vulnerabilities were closed in aaPanel, including CVE-2026-29859, an arbitrary file upload with code execution rated 9.8 out of 10 without authorization. There was also an RCE through the archiver (CVE-2025-48702), which the developer closed within two days.

The conclusion is not "don't install," but "update promptly and don't expose the panel to the internet as is." A server control panel is an entry point with root privileges. The sections below about changing the port, 2FA, and firewall are not optional.

Supported operating systems

Current list (from documentation and installer code):

Not supported: CentOS 6, openSUSE, 32-bit systems, and non-LTS Ubuntu versions (the installer rejects them).

Requirements: 1 core, 512 MB RAM, 1 GB disk. Realistically, at least 1 GB RAM. If swap is missing, the installer will create a 1 GB swap file automatically.

⚠️ Clean system only. If Apache, Nginx, PHP, or MySQL are already running on the server, the installer will overwrite their configurations and break working sites. Migration is done via a new VPS: backup, clean installation, import.

Step 1: Prepare the server

Connect via SSH as a user with root privileges (installation is only possible as root):

1
ssh root@your_server_ip

Update packages. For Ubuntu and Debian:

1
apt update && apt upgrade -y

For AlmaLinux and Rocky Linux:

1
dnf update -y

Make sure no web environment exists:

1
which nginx; which apache2; which mysqld

On a clean server all three commands will produce empty output. If you find a file path, remove the package before running the installer.

Step 2: Run the installation script

The current command from the official download page is universal for all distributions:

1
URL=https://www.aapanel.com/script/install_panel_en.sh && if [ -f /usr/bin/curl ];then curl -ksSO $URL ;else wget --no-check-certificate -O install_panel_en.sh $URL;fi;bash install_panel_en.sh

The script will detect the OS and pull dependencies automatically. Do not use old addresses like install_6.0_en.sh or install-ubuntu_7.0_en.sh from outdated instructions.

Confirm installation to the /www directory by entering Y. No further intervention is needed: the script will deploy the web server, database, PHP, and the panel interface itself. This takes a couple of minutes.

Step 3: Save the credentials

After completion, the terminal will display three things:

• Panel address in the format https://IP:PORT/random_path
• Username
• Password

Note two details that were not present in older versions. First, https**, not **http: the certificate is self-signed, so the browser will show a warning. This is normal; click "Advanced → Proceed." Second, the port is random, and the address includes a random path (security entrance). Without the full address you will get a 404, which is intentional.

Open the provided address in your browser and you will see the panel login form.

Copy everything to a password manager before you close the terminal. If you lose it, no problem: the command bt 14 in SSH will show the login data again.

Do not forget to open the assigned port at your hosting provider. Cloud providers (Oracle Cloud, AWS, Google Cloud) have their own firewall in the dashboard, and it blocks everything except port 22 by default.

Step 4: Choose the web environment

On first login the panel will offer a stack:

• LNMP (Nginx + MySQL + PHP), suitable for most sites
• LAMP (Apache + MySQL + PHP), if you need .htaccess

Installation will start in the background. If you skipped this step, the same components can be installed later through App Store in the left menu.

Step 5: Initial security settings

Do this immediately, before you deploy your first site. A control panel is root access, and scanners will eventually find its address.

Change the login and password. In the Settings section. Generated values are good, but users often simplify them "to remember." Don't.

Enable two-factor authentication. Go to Settings → Two-Step Verification, link an authenticator app, and save the backup codes. Without a second factor, a leaked password means full access to the server.

Restrict access by IP. If you work from a single address, allow panel login only from it. This is stronger than any password.

Close unnecessary ports. In the Security section leave open only what is needed: 80 and 443 for sites, 22 for SSH, the panel port. Everything else should be closed.

Set up proper SSL for the panel. In settings, bind a domain and obtain a Let's Encrypt certificate to get rid of the browser warning and avoid sending passwords over a self-signed connection.

Keep updated. Given the history of RCE vulnerabilities, keep the panel on the current version. Updates are in Settings → Version, but take a VPS snapshot with your provider first: sometimes an update changes PHP or Nginx configuration.

Step 6: What is inside

The screenshots below show key sections of the panel. The design changes between versions, but the content and logic of sections remain the same.

Dashboard. CPU load, memory, disk, network traffic in real time.

Security. Firewall section: open ports and rules. Keep open only what is necessary.

Settings. Changing login and password, panel port, two-factor authentication, SSL, API access.

App Store. One click to install a mail server, Node.js, Redis, MongoDB, WordPress Toolkit, and dozens of other components. No terminal needed.

Docker. The panel installs Docker and provides a graphical interface for images and containers, including Compose.

Backup. There are no automatic backups out of the box; the schedule is configured manually. Specify external storage: a local copy will die along with the disk.

aaTerm. Built-in browser terminal: a console without a separate SSH client when you need to quickly fix something from someone else's computer.

Branch 8.0.x also added an AI module with server diagnostics and WordPress migration from other panels.

Service management and removal

The panel is managed with the bt utility. Restarting affects only the interface: sites and databases continue to run.

1
bt stop      # stop the panel
2
bt start     # start
3
bt restart   # restart
4
bt 14        # show login data
5
bt 5         # change password
6
bt 8         # change panel port

Complete removal of the panel (sites, databases, and configs in /www/server/ and /www/wwwroot/ remain):

1
sudo bt stop && sudo rm -f /etc/init.d/bt && sudo rm -rf /www/server/panel

Alternatives if aaPanel did not work out

If the Chinese origin and telemetry concern you, look at HestiaCP: same niche, GPL, no "phoning home." If your server is for containers rather than classic hosting, consider Coolify.

⁉️🤔 Frequently asked questions

After installation the browser won't open the panel. What's wrong?

Three causes by frequency. First: you are trying port 8888 from an old guide, which no longer exists. Check the port in the installer output or run bt 14. Second: the port is closed in your cloud provider's firewall (not in ufw, but in the Oracle/AWS/Google panel). Open it there. Third: you forgot the random path at the end of the address. Without it the panel intentionally returns 404.

Is aaPanel really free?

The basic version, yes, with no license keys and no limits on the number of sites. But "free" does not equal "open source": the license is proprietary, publishing forks is prohibited, source code for paid plugins is closed, and the installer sends statistics to the developers. For a personal VPS this is usually not a problem. Just know what you are signing up for.

Can I install aaPanel on a server where sites are already running?

No. The installer will overwrite Nginx, Apache, and PHP configurations and break what is already working. The correct path: backup files and databases, get a clean VPS, install aaPanel, import sites through the interface. "Live" migration is not possible.

How secure is this, given the vulnerabilities?

A panel with root privileges is always a risk, and critical RCE vulnerabilities in aaPanel were found in 2025 and 2026. The developer patches quickly, but the conclusions are simple: update promptly, enable 2FA, restrict login by IP, and do not leave the panel open to the entire internet. For a server with sensitive data, consider a panel with an open license and auditable code.

Is there a Russian language interface?

Yes, the language can be switched in settings. After installation the interface may open in English or Chinese. Switch it immediately while button locations are still unfamiliar.

How is aaPanel better than cPanel?

Price and entry barrier: cPanel costs from $18 per month and is designed for hosting providers with hundreds of accounts. aaPanel is free, lighter on resources, and simpler for one or two servers. But cPanel is a mature ecosystem with support and a predictable security cycle. For a personal VPS, aaPanel works well; for commercial shared hosting, cPanel.

The bottom line

For those starting with a VPS who do not want to spend evenings on configs, aaPanel is an excellent start: free, installs in a couple of minutes, covers sites, databases, SSL, firewall, and backups.

But you should approach it with open eyes. This is not a GPL project, the installer communicates with the developer's servers, and the panel has had critical remote code execution vulnerabilities closed over the past two years. None of this makes aaPanel unsuitable. It simply requires discipline: updates, 2FA, restricting access by IP.

And the main takeaway from this article: the port is no longer 8888, access is via HTTPS, and CentOS 7 is not installed in 2026. Half the guides in search results do not know this yet.

Install aaPanel on a test VPS and spend a couple of evenings with it. The risk is half an hour of your time, and the experience will stay with you. What panel do you use and why? Write in the comments.