Pick HestiaCP if you host for other people, and aaPanel if you host for yourself. Hestia is fully open source, European, built around multi-user hosting with mail included, and it discloses its security fixes publicly — its 1.9.7 and 1.9.8 releases in July 2026 patched a long list of advisories in the open. aaPanel is faster to get running, has a much larger one-click application catalogue, and stays free forever for core use, but its Pro tier is $198 a year, parts of it are closed source, and its Chinese origin is a procurement question that some hosts are not allowed to answer with a shrug.
What each one actually is
HestiaCP is a community-developed panel descended from VestaCP, rewritten and maintained openly on GitHub. Debian and Ubuntu only. The design assumption is multi-tenant hosting: users own domains, domains own mailboxes and databases, and everything is scriptable through a command-line interface that mirrors the web UI. Version 1.9.8 landed on 30 July 2026.
aaPanel is the international edition of BT Panel, a widely deployed Chinese control panel. It runs on both Debian-family and RHEL-family systems, installs in a couple of minutes, and leads with a software store — one-click LAMP, LEMP, Docker, WordPress, and well over a hundred extensions. The free edition is genuinely capable rather than a crippled demo.
The philosophical difference shows up immediately in the interface. Hestia asks you which user you are working on. aaPanel asks you which website. That single distinction predicts most of what follows.
Cost
| HestiaCP | aaPanel | |
|---|---|---|
| Base licence | Free, open source | Free forever |
| Paid tier | None | Pro: $28.80/mo, $198/yr, or $699 lifetime |
| What the paid tier adds | — | Website protection, analytics, anti-tampering, advanced WordPress tools, unlimited team members, priority support, 20+ Pro extensions |
| Account or domain limits | None | None on the free edition |
Read that table carefully before concluding aaPanel is the cheaper option. It is cheaper at zero and more expensive at scale: $198 a year is real money for a single server, and several of the Pro features — a WAF, tamper protection, team accounts — are things a hosting business will end up wanting. Hestia has no Pro tier because the equivalents are either included or assembled from the underlying stack yourself.
Security: what each one's record actually shows
This is where the comparison gets uncomfortable, and where most articles hand out reassurance instead of information.
HestiaCP had a bad July 2026 and handled it well. Version 1.9.7 addressed eight security advisories, including an unauthenticated remote code execution through session deserialization in the web terminal, SQL injection in database operations, IP address spoofing via header handling, several command injection and privilege escalation issues, and a path to authenticated admin account takeover. Two weeks later, 1.9.8 added four more fixes: restricting ROOT_USER modifications to a ROOT_USER session, XSS in notifications, injection in backup queue operations, and hardening around the debug panel and SSH key deletion.
That list looks alarming and it is worth reading it the right way. Every one of those has a public advisory identifier, a patch and a changelog entry. The vulnerabilities existed; the disclosure is exactly what you want from a panel you run as root. The actionable conclusion is narrower and more urgent than "Hestia is insecure": if you are running anything below 1.9.8, update today, because an unauthenticated RCE in the web terminal is not a theoretical risk once it is public.
aaPanel's situation is harder to assess, which is itself the finding. The core is open, but the Pro extensions are not, and the panel's lineage runs back to BT Panel in mainland China. Community reports over the years have raised concerns about telemetry and outbound connections to Chinese infrastructure. We have not independently verified those claims and we are not repeating them as fact — but for a European or UK hosting business the relevant question is not whether the claims are true. It is whether you can demonstrate to a customer, an auditor or a regulator that they are false. Under GDPR and NIS2 the burden of that answer is on you, and "a forum thread said it was fine" is not an answer.
If you are hosting your own projects, this consideration may be worth nothing to you. If you are hosting other people's personal data, it may be the whole decision.
Feature by feature
| Area | HestiaCP | aaPanel |
|---|---|---|
| Operating systems | Debian, Ubuntu | Debian, Ubuntu, and RHEL-family |
| Web stack | Nginx, Apache, or Nginx as a proxy to Apache | Nginx, Apache, OpenLiteSpeed |
| Mail server | Included — Exim, Dovecot, webmail, DKIM | Available as an extension, less integrated |
| Multi-user hosting | Core concept, per-user packages | Possible, but the model is site-centric |
| One-click applications | Modest | Extensive — the main attraction |
| Docker management | Not a first-class feature | Built in |
| CLI | Comprehensive, mirrors the UI | Present but secondary |
| Licence | Open source throughout | Open core, closed Pro extensions |
| Governance | Public GitHub, public advisories | Vendor-led |
The mail row deserves more weight than it gets in most comparisons. Running a mail server that reliably reaches inboxes is one of the hardest things on this list — DKIM, SPF, DMARC, reverse DNS, reputation, blacklist recovery — and a panel that ships it integrated is doing significant work for you. If your customers expect [email protected] to work, that row alone can decide the comparison.
Where each one hurts
HestiaCP's weak points: no RHEL-family support at all, which rules it out if you standardise on AlmaLinux or Rocky; a modest application catalogue that assumes you are comfortable installing things yourself; and a user isolation model that is conventional Unix permissions rather than anything stronger, so one compromised site's PHP process is closer to its neighbours than many operators realise.
aaPanel's weak points: documentation and forum answers that are frequently machine-translated and occasionally wrong in ways that matter; the site-centric model that makes true per-customer separation awkward; and the Pro paywall sitting in front of exactly the security features a production host wants. The origin question is on this list too, whatever you personally conclude about it.
Choosing
Take HestiaCP if you host domains for other people, need working mail without assembling it, run Debian or Ubuntu, and want everything you depend on to be inspectable. Take aaPanel if the server is yours, you value a large application catalogue and built-in Docker over multi-tenant structure, and no compliance conversation is going to happen about where your management software comes from.
And if you are in the position that fits neither — hosting other people's sites on RHEL-family systems, needing mail, and wanting isolation stronger than Unix permissions — that combination is exactly the gap commercial panels aim at, ours included: Panelica runs on both distribution families, includes the mail stack, and layers cgroup v2 limits and namespace isolation under each account rather than relying on file permissions alone. That is a paid product and this article is not the place to sell it; the honest summary is that if the free options above cover your case, they are good software and you should use them.
Frequently asked questions
Is aaPanel or HestiaCP better?
For multi-user hosting with email, HestiaCP — it is built around user accounts, includes a full mail stack, and is open source throughout. For a personal server where you want a large one-click application catalogue and built-in Docker management, aaPanel. The decision follows from whether you host for others or for yourself.
Is aaPanel free?
The free edition is free permanently and has no stated limits on websites or databases. The Pro edition costs $28.80 per month, $198 per year, or $699 as a one-time lifetime licence, and adds website protection, analytics, anti-tampering, advanced WordPress features, unlimited team members and priority support.
Is HestiaCP safe to use after the 2026 CVEs?
Yes, on 1.9.8 or later. Versions 1.9.7 and 1.9.8, released in July 2026, patched a series of disclosed vulnerabilities including an unauthenticated remote code execution in the web terminal. Installations below 1.9.8 should be updated immediately, since the advisories are public.
Does HestiaCP work on AlmaLinux or Rocky Linux?
No. HestiaCP supports Debian and Ubuntu only. aaPanel supports both Debian-family and RHEL-family distributions.
Can HestiaCP and aaPanel run on the same server?
No. Both take ownership of the web server, PHP and firewall configuration, and installing one over the other produces a system where neither is fully in control. Migrate by exporting sites and databases and rebuilding on a clean machine.