# ISPConfig alternatives in 2026, and how to move your data off ISPConfig > Looking for an ISPConfig alternative? Compare HestiaCP, Virtualmin, DirectAdmin, cPanel and ZoPanel, then move sites, databases and mail off ISPConfig. Source: https://zopanel.net/blog/ispconfig-alternative Updated: 2026-10-21 ## Key takeaways - ISPConfig is free (BSD licence), runs on Debian, Ubuntu and the RHEL family, and its multi-server and mirrored-cluster support is still rare among free panels. - People usually leave for a more modern interface, built-in app deployment, or tighter per-account resource limits. - ISPConfig's own Migration Toolkit moves data into ISPConfig, not out, so leaving is a manual job. - Sites live under /var/www/clients/clientN/webN/web and mail under /var/vmail/domain/user, which makes the move predictable. The main ISPConfig alternatives in 2026 are HestiaCP and Virtualmin if you want to stay free, DirectAdmin and cPanel if you want a long-established commercial panel, and ZoPanel if you want per-account isolation, Git deploy and Docker apps with per-server pricing. None of them reads ISPConfig's data directly, so plan to move each site's files, databases and mailboxes yourself. That is straightforward because ISPConfig keeps data in fixed, well-known places. This article covers what ISPConfig does well, why people move, how the alternatives compare, and a step-by-step plan to get your data off an ISPConfig server. We make ZoPanel, so we have an interest; statements about other panels come from their own sites and from NVD, at the time of writing (October 2026). ## What ISPConfig does well [ISPConfig](https://www.ispconfig.org/) is an open-source hosting control panel, "released as Open Source software under the BSD license" according to its [download page](https://www.ispconfig.org/ispconfig/download/), where the latest stable version is 3.3.2p1 at the time of writing. Its strengths: - **Multi-server from one panel.** You can manage a single server, several servers with split roles (web, mail, DNS, database) or mirrored clusters from one interface. Few free panels do this. - **Mature mail stack.** Postfix for SMTP and Dovecot for IMAP/POP3, with spam filtering. - **DNS choice.** BIND or PowerDNS. - **Web server choice.** Apache or nginx. - **Four access levels.** Administrator, reseller, client and email login. - **Broad OS support.** The site lists Debian 11 to 13 and Ubuntu 22.04 to 26.04 as recommended, plus AlmaLinux and Rocky Linux 8 to 10. For a sysadmin who wants a free, multi-server hosting setup and does not mind a functional interface, ISPConfig is still a sensible choice. ## Why people look for an ISPConfig alternative ### The interface ISPConfig's interface is built around forms and tabs. It works, but agencies and hosting customers used to newer panels often find it dated, and it gives a customer few of the self-service tools (one-click apps, staging, app deployment) that newer panels show on the first screen. ### Apps beyond PHP ISPConfig is built for classic PHP hosting. Running Node.js, Python or Docker apps with health-checked releases and rollback is outside what the panel does for you; you set up the process and the proxy yourself. ### Resource limits per customer If you sell hosting, you want one customer's runaway script to stop at that customer's CPU and memory limit. Check whether your ISPConfig setup enforces that for PHP, cron and SSH processes together, or relies on PHP-FPM pool settings and quotas only. ### The security record ISPConfig has a long CVE history, as every panel does. Most entries need a logged-in user, and none is in CISA's Known Exploited Vulnerabilities catalog at the time of writing. Some examples from NVD: | CVE | Affected | What it allowed | | --- | --- | --- | | [CVE-2017-17384](https://nvd.nist.gov/vuln/detail/CVE-2017-17384) | 3.x before 3.1.9 | A logged-in user could get root through a crafted cron job | | [CVE-2021-3021](https://nvd.nist.gov/vuln/detail/CVE-2021-3021) | before 3.2.2 | SQL injection | | [CVE-2023-46818](https://nvd.nist.gov/vuln/detail/CVE-2023-46818) | before 3.2.11p1 | PHP code injection in the language editor by an admin, when that editor is enabled | | [CVE-2026-61518](https://nvd.nist.gov/vuln/detail/CVE-2026-61518) | per NVD record | Authenticated SQL injection in the Remote API | The lesson is the same for every panel: update quickly, restrict the panel port, and ask what a bug in the web layer can reach. Our [timeline of hosting panel security incidents](/blog/hosting-panel-security-incidents) puts these patterns side by side. ## How the alternatives compare | Panel | Licence and price (October 2026) | OS | Mail | Best for | | --- | --- | --- | --- | --- | | ISPConfig | Free (BSD) | Debian, Ubuntu, AlmaLinux, Rocky | Postfix, Dovecot | Free multi-server hosting | | HestiaCP | Free (GPLv3) | Debian 12/13, Ubuntu 22.04/24.04/26.04 | Exim, Dovecot | Simple single-server hosting | | Virtualmin | GPL free; Pro from $75/year | RHEL family, Debian, Ubuntu | Yes | Admins who want full control | | DirectAdmin | From $5/month; Standard $29/month | RHEL family, Debian, Ubuntu | Yes | Lean commercial hosting | | cPanel & WHM | Per account; Solo from $29.99/month | AlmaLinux, CloudLinux, Rocky, Ubuntu | Yes | Hosts wanting the biggest ecosystem | | ZoPanel | Free plan; Pro $49/year or $199 lifetime per server | Ubuntu 22.04/24.04/26.04, Debian 12/13 | Postfix, Dovecot, Rspamd | Hosting, agencies, app hosting | Sources: [HestiaCP docs](https://hestiacp.com/docs/introduction/getting-started), [Virtualmin shop](https://www.virtualmin.com/shop/), [DirectAdmin pricing](https://www.directadmin.com/pricing.php), [cPanel pricing](https://cpanel.net/pricing/) and [requirements](https://docs.cpanel.net/installation-guide/system-requirements/), [ZoPanel pricing](/pricing). For a broader list, see [the best VPS control panels in 2026](/blog/best-vps-control-panel-2026). **HestiaCP** is the simplest free swap for a single server. **Virtualmin** has more depth and more OS support, and a busier interface. **DirectAdmin** and **cPanel** are commercial and well known; cPanel's per-account pricing grows with every customer. **ZoPanel** runs its web interface as an unprivileged user and sends root actions through an agent that accepts only a fixed list of actions. Each hosting account is its own Linux user with its own PHP-FPM pool and a systemd slice that limits CPU, memory and processes for PHP, cron and apps together. It includes mail with DKIM, PowerDNS with DNSSEC, a WAF, malware scanning, Git deploy, a Docker App Store, resellers and billing modules. Several ZoPanel servers can be joined into a [fleet](/docs/fleet) managed from one panel, but each server runs its own services; there is no mirrored-cluster mode like ISPConfig's. Other limits: Ubuntu and Debian only, a fresh server required, and no ISPConfig importer. ## How to move data off ISPConfig ISPConfig's [Migration Toolkit](https://www.ispconfig.org/add-ons/ispconfig-migration-tool/) (€79) imports from Plesk, cPanel and older ISPConfig versions **into** ISPConfig 3, and its ISPCopy tool copies one ISPConfig server to another. Neither exports to a different panel. So you move each site by hand. The steps below use ZoPanel as the target, but the ISPConfig side is the same for any panel. ### Step 1: Inventory and lower TTL In ISPConfig, list for each client: websites and aliases, databases and their users, email domains, mailboxes, forwarders, cron jobs and DNS zones. Lower the TTL on A and MX records to 300 seconds at least 24 hours before the move. ### Step 2: Prepare the new server Install the new panel on a fresh VPS, never on the ISPConfig server. For ZoPanel: ```bash curl -fsSL https://get.zopanel.net | sudo bash ``` Then sign in at `https://SERVER-IP:8888`, turn on two-factor authentication, and install the mail and DNS components if you need them ([email docs](/docs/email)). ### Step 3: Copy website files ISPConfig stores each site in a folder such as `/var/www/clients/client1/web1/web`, with `/var/www/example.com` as a symlink to it ([HowtoForge forum](https://forum.howtoforge.com/posts/280226)). The exact path is shown in the website's settings. On the old server: ```bash cd /var/www/clients/client1/web1 tar -czf /root/example-web.tar.gz web ``` Create the website in ZoPanel (**Websites → New website**, same PHP version), then upload and extract the archive into `domains/example.com/public_html` with the File Manager, or copy it with rsync over SFTP for large sites. ### Step 4: Dump and import databases ISPConfig databases are ordinary MariaDB or MySQL databases, usually named with the client prefix (for example `c1shop`). Dump each one: ```bash mysqldump --single-transaction c1shop | gzip > /root/c1shop.sql.gz ``` Create the database in the new panel (ZoPanel names carry the account prefix, for example `alice_shop`), import the dump with **Import / restore**, and update the app's config file with the new name, user and password. ### Step 5: Move mail ISPConfig keeps mail in Maildir format under `/var/vmail//`. Rather than copying Maildir folders between different mail servers, recreate each mailbox on the new server and copy mail over IMAP with imapsync: ```bash imapsync --host1 old.example.com --user1 info@example.com --password1 'OLD' \ --host2 new.example.com --user2 info@example.com --password2 'NEW' ``` Recreate forwarders and autoresponders by hand. Then publish MX, SPF, DKIM and DMARC records from the new server. ### Step 6: Recreate DNS and cron If ISPConfig was your authoritative DNS, copy each zone's records into the new panel's DNS editor, or into your registrar's DNS. Recreate cron jobs and check that their paths now point to the new site folder. ### Step 7: Test, then switch Point the domain to the new IP in your computer's `hosts` file and test every site, login and contact form. Then change the A and MX records. A Let's Encrypt certificate is issued as soon as the domain resolves to the new server. Keep the ISPConfig server running for a few days to catch late mail, and run a final imapsync pass before you shut it down. For a whole server with many clients, see [how to move a whole hosting server](/blog/move-whole-hosting-server), and for the DNS cut-over, [how to migrate without downtime](/blog/migrate-website-without-downtime). ## When to stay on ISPConfig Stay if you depend on its multi-server or mirrored-cluster setup, need AlmaLinux or Rocky Linux, run only classic PHP sites, and your team is happy with the interface. Keep it on the latest 3.3 release, restrict port 8080 (the installer's default panel port, per [HowtoForge's install guide](https://www.howtoforge.com/perfect-server-ubuntu-11.10-with-nginx-ispconfig-3-p7/amp/)) to your own IPs, and keep backups off the server. ## Conclusion ISPConfig is still a capable free panel, especially for multi-server setups. The most common reasons to look for an ISPConfig alternative are the interface, app deployment beyond PHP and stricter per-customer resource limits. Choose HestiaCP or Virtualmin to stay free, DirectAdmin or cPanel for a classic commercial panel, or ZoPanel for privilege separation, account sandboxes and per-server pricing. Whichever you pick, move a few real sites first. [ZoPanel's Free plan](/pricing) gives you 3 hosting accounts, 10 websites and 10 databases with no time limit, enough to test the move from ISPConfig with real data. ## Frequently asked questions ### Is ISPConfig still maintained? Yes. The project lists 3.3.2p1 as the latest stable release at the time of writing and recommends recent Debian and Ubuntu releases, including Debian 13 and Ubuntu 26.04. Check the download page and changelog before you upgrade. ### Is ISPConfig free? Yes. ISPConfig is open source under the BSD licence. Paid add-ons exist, such as the Migration Toolkit (€79) and a billing module, and you can buy support. ### Can I migrate from ISPConfig to cPanel or ZoPanel automatically? Not with ISPConfig's own tools, which import into ISPConfig rather than export. ZoPanel imports cPanel and DirectAdmin backups, not ISPConfig. Move files, database dumps and mail over IMAP as described above. ### Where does ISPConfig store website files and email? Websites are under `/var/www/clients/clientN/webN/web`, with a symlink at `/var/www/`. Mail is in Maildir folders under `/var/vmail//`. The website's settings page shows its exact path. ### What is the best free alternative to ISPConfig? For a single server with web, mail and DNS, HestiaCP is the simplest free option. If you need broad OS support and a lot of control, Virtualmin GPL. ZoPanel's Free plan suits small setups of up to 10 websites.