We tested six widely-used server management panels on identical hardware under identical conditions. No sponsored content, no vendor input — just clean numbers and what they mean for your infrastructure decisions.
The goal was simple: install each panel on a fresh Ubuntu 24.04 server, measure the same metrics across the board, and report what we found.
Test Environment
Every panel ran on the same dedicated hardware profile:
- CPU: 8 vCPU
- RAM: 12 GB
- Storage: 237 GB SSD
- OS: Ubuntu 24.04 LTS (fresh install, no modifications)
- Date: April 10, 2026
- Network: 1 Gbps uplink, same datacenter, same switch
Panels tested: Panelica, cPanel/WHM, Plesk, HestiaCP, CloudPanel, CyberPanel.
Each server was wiped between installations. Timing started when the install command was executed and stopped when the panel UI became accessible and responsive. RAM was measured 5 minutes after installation completed, with no additional configuration done. Disk was measured immediately after install settled.
Installation Time
How long does it take to go from a bare OS to a working panel? This matters for disaster recovery, autoscaling, and anyone standing up new servers regularly.
| Rank | Panel | Install Time |
|---|---|---|
| 1 | HestiaCP | 5m 22s |
| 2 | Panelica | 7m 47s |
| 3 | CloudPanel | 8m 22s |
| 4 | CyberPanel | 9m 11s |
| 5 | cPanel | 10m 15s |
| 6 | Plesk | 16m 01s |
HestiaCP wins on install time — it installs fewer services upfront. Panelica finishes in under 8 minutes despite setting up 20 services simultaneously (Nginx, Apache, MySQL, PostgreSQL, Redis, PHP 8.1–8.4, BIND, Postfix, Dovecot, ClamAV, Fail2ban, ModSecurity, and more). Plesk takes the longest due to its modular dependency chain and license verification overhead.
Memory Usage After Installation
Memory was measured 5 minutes post-install with no active websites, no users, no additional configuration. This is baseline idle consumption — the floor your server starts at before any workload.
| Rank | Panel | RAM Usage |
|---|---|---|
| 1 (lowest) | cPanel | 673 MB |
| 2 | CyberPanel | 837 MB |
| 3 | Plesk | 880 MB |
| 4 | CloudPanel | 1,431 MB |
| 5 | Panelica | 1,682 MB |
| 6 (highest) | HestiaCP | 1,979 MB |
What the Numbers Actually Mean
Raw RAM numbers without context are misleading. Here is what is actually consuming memory in each case:
Panelica (1,682 MB breakdown):
- PostgreSQL 17: ~520 MB (shared_buffers + work_mem, production-tuned)
- MySQL 8: ~465 MB (innodb_buffer_pool, enabled for WordPress hosting compatibility)
- Redis 7: ~45 MB
- Panel application (Go binary): ~195 MB
- PHP-FPM pools (8.1–8.4): ~96 MB
- Nginx, BIND, other services: remainder
Panelica ships with two full database engines running by default. The Go-based panel software itself uses ~195 MB. The databases account for the bulk of memory usage — and they are both available to hosted sites immediately without additional configuration.
HestiaCP (1,979 MB): ClamAV antivirus alone consumes ~965 MB at idle. Without ClamAV, HestiaCP would be the lowest-memory panel in this test at roughly 1,014 MB.
cPanel (673 MB): Low baseline, but note that cPanel does not run PostgreSQL, and many security features are disabled or sold as add-ons. The comparison is not apples-to-apples in terms of what is actually running.
If memory is your primary constraint and you are on a 1–2 GB VPS, HestiaCP (without ClamAV) or CyberPanel will be lighter. On anything with 4 GB or more, the differences are negligible relative to workload.
Disk Usage
Disk consumption after installation, measured with du -sh on the full filesystem delta from a clean OS baseline:
| Rank | Panel | Disk Used | Packages Installed |
|---|---|---|---|
| 1 (smallest) | HestiaCP | 6.3 GB | 677 |
| 2 | Plesk | 7.8 GB | 666 |
| 3 | CloudPanel | 8.6 GB | 712 |
| 4 | cPanel | 9.2 GB | — |
| 5 | CyberPanel | 10.4 GB | 745 |
| 6 (largest) | Panelica | 11.9 GB | 497 (fewest) |
Panelica uses more disk than the others but installs the fewest system packages (497 vs. 666–745 for others). The disk usage comes primarily from its bundled binaries — PostgreSQL, MySQL, PHP 8.1–8.4, Nginx, Redis, and all other components are shipped as isolated binaries under /opt/panelica/ rather than installed as system packages via apt. This architecture means Panelica does not touch /etc/nginx/, /etc/mysql/, or any system-level paths — everything is self-contained.
The tradeoff: more disk used upfront, but zero dependency conflicts, no system package pollution, and clean uninstall.
Out-of-the-Box Security
This category measured what security components are active by default after a standard installation, without any manual configuration. Four criteria were evaluated:
- Firewall: Is a network firewall configured and blocking by default?
- Brute-force protection: Is Fail2ban or equivalent blocking repeated authentication failures?
- Antivirus: Is ClamAV or equivalent scanning uploads/files?
- WAF: Is ModSecurity/OWASP Core Rule Set or equivalent blocking web attacks?
| Panel | Firewall | Fail2ban | ClamAV | WAF/ModSec | Score |
|---|---|---|---|---|---|
| Panelica | nftables | Yes | Yes | ModSecurity + OWASP CRS | 4/4 |
| HestiaCP | Yes | No | Yes | No | 2/4 |
| CloudPanel | Yes | Yes | No | No | 2/4 |
| cPanel | Yes | cPHulk (partial) | No | Partial | 2/4 |
| CyberPanel | No | No | No | No | 0/4 |
| Plesk | No | No | No | No | 0/4 |
A notable finding: CyberPanel serves its admin panel over HTTP (not HTTPS) by default, with no firewall and no brute-force protection. On a publicly accessible server, this means the admin interface is accessible unencrypted and subject to unrestricted login attempts.
Plesk scored 0/4 on default security — Fail2ban, WAF, and firewall are available as paid add-ons or require manual configuration post-install.
For cPanel, cPHulk provides brute-force protection for WHM/cPanel logins specifically, but does not extend to SSH or other services by default. WAF requires a separate CSF + ModSecurity setup.
Installation Errors
Each install was run three times on identical hardware. Errors reported here are installer-reported failures or service-start failures observed during any of the three runs:
| Panel | Errors (across 3 runs) |
|---|---|
| Panelica | 0 |
| Plesk | 0 |
| CyberPanel | 0 |
| HestiaCP | 1 (ClamAV database fetch warning on one run) |
| CloudPanel | 1 (Postfix config warning on one run) |
| cPanel | 2 (CPAN module build warnings on two runs) |
None of the errors were fatal — all panels completed installation and became usable. These are informational warnings that appeared in install logs. That said, any noise during installation suggests potential issues at scale or in edge-case environments.
Overall Rankings
Rankings were determined by weighting the five categories: security (35%), installation reliability (25%), memory efficiency (20%), install speed (10%), and disk footprint (10%). Security carries the heaviest weight because a panel that is fast to install but leaves your server exposed is not a production-ready solution.
| Rank | Panel | Security | Install Time | RAM | Disk | Errors |
|---|---|---|---|---|---|---|
| 1 | Panelica | 4/4 | 7m 47s | 1,682 MB | 11.9 GB | 0 |
| 2 | HestiaCP | 2/4 | 5m 22s | 1,979 MB | 6.3 GB | 1 |
| 3 | CloudPanel | 2/4 | 8m 22s | 1,431 MB | 8.6 GB | 1 |
| 4 | CyberPanel | 0/4 | 9m 11s | 837 MB | 10.4 GB | 0 |
| 5 | cPanel | 2/4 | 10m 15s | 673 MB | 9.2 GB | 2 |
| 6 | Plesk | 0/4 | 16m 01s | 880 MB | 7.8 GB | 0 |
Key Takeaways
On Memory Usage
Do not compare raw memory numbers without understanding what is running. A panel that uses 1,682 MB but includes two full database engines, antivirus, WAF, and brute-force protection is a fundamentally different product than one using 673 MB with none of those components active. Compare what you are actually getting per megabyte.
On Security Defaults
The gap between panels in security defaults is larger than most administrators realize. Two panels in this test — Plesk and CyberPanel — ship with zero out-of-the-box security layers active. For production use, every missing component needs to be manually configured, tested, and maintained. That is operational overhead that does not show up in install-time benchmarks but shows up in your incident response timeline.
On Disk Usage
Larger disk footprint is not inherently bad. Panelica's higher disk usage reflects a deliberate architectural choice: full isolation from the host OS, no system package dependencies, no apt conflicts. The tradeoff is intentional and has real operational benefits — particularly for servers running multiple panel versions or migrating between environments.
On Install Speed
Install time is rarely a deciding factor in panel selection, but it matters for automated deployments, disaster recovery runbooks, and cloud autoscaling. All panels in this test installed in under 17 minutes. The practical difference between 5m and 16m is less significant than it appears in table form.
What This Benchmark Does Not Cover
This test covered installation metrics only. It did not measure:
- Runtime performance under load (HTTP requests/second, PHP execution time, database query performance)
- UI responsiveness and workflow efficiency
- Feature depth (backup systems, DNS management, Docker support, migration tools)
- Reseller/multi-user isolation quality
- Licensing costs and total cost of ownership
- Long-term stability and update reliability
Those categories will be covered in separate benchmark reports. Installation metrics are one signal among many — use them as a starting point, not a final verdict.
Full Benchmark Report
The full benchmark report with raw data, test scripts, and methodology documentation is available at:
If you have run similar benchmarks on different hardware or found different results, we are interested in the data. Reproducibility matters.