Skip to content
Pre-release. HostCraft is in testing and not yet for sale. These docs describe the current build and may change. Join the waitlist to hear when it launches.
HostCraft mark

HostCraft documentation

Hosting. Simplified. Built better.

HostCraft is one program that runs the control panel and everything it manages: websites and PHP, databases, DNS, email with spam filtering, a web application firewall, malware scanning and free SSL certificates, all set up by a single install command. Under the hood: nginx, PHP-FPM, MariaDB, PowerDNS, Postfix, Dovecot, Rspamd, Coraza, CrowdSec, ClamAV, Snuffleupagus and acme.sh.

curl -fsSL https://hostcraft.io/install.sh | sudo bash -s -- [email protected]
  • Trust
  • Performance
  • Simplicity
  • Control
The HostCraft server admin Overview showing license usage, account, domain and mail queue counters, disk, CPU and memory, and a health monitor
The server admin Overview: license, accounts, mail queue and live resource usage in one view.
The customer dashboard with site, database and mailbox counts, plan limits and quick actions
Customer dashboard
The cPanel migration review step with plan, reseller and include options
cPanel migration review
The Security page with component health and recent firewall events
Security and firewall events

HostCraft v1 is the production-ready cPanel/WHM replacement. Everything listed below ships in v1 and is tested against real-world hosting workloads.

Layer Choice
Daemon Go 1.27, single static binary, systemd unit
Frontend React 19 + TypeScript 6 + Vite 8 + Tailwind 4.3 + React Router 8, embedded via go:embed
Panel database SQLite (solo), PostgreSQL (cluster)
Web server nginx + PHP-FPM, FrankenPHP optional per site
PHP versions 7.0 to 8.4 from Sury or Remi, plus 5.6 in legacy mode
Database MariaDB default, MySQL alternative
DNS PowerDNS with MariaDB backend
Mail Postfix + Dovecot + Rspamd + SnappyMail webmail
Security Coraza + CrowdSec + ClamAV + Snuffleupagus + FIM + outbound monitor
SSL Let's Encrypt and ZeroSSL via acme.sh
Backups restic to S3, B2, or local
Updates Cosign-signed binaries, atomic swap, auto-rollback