A free hosting panel with protection built in
Run static, PHP and Node.js sites on your own Ubuntu server. Certificates, Cloudflare setup and protection from bots, scanners and floods are built into the web server itself.
Ubuntu 24.04 LTS. A VPS with 1 GB of RAM is enough for a dozen small sites.
Made for the first server and for the hundredth
Someone renting a first VPS and an admin with forty servers use the same panel. The defaults work without tuning, and every option stays one tab away.
You have never set up a server
The panel starts with safe values and explains its settings in plain words, so you do not need to read a manual first.
- One command to installPaste it into the server console. The installer checks the system and asks before it changes anything.
- A certificate that issues itselfPoint the domain at the server and HTTPS appears. Renewals happen on their own.
- Safe defaultsEvery PHP and Node.js site runs as its own Linux user in a sandbox, and the panel itself runs without root.
- A clear interface with hintsA table of sites, one page per site with tabs, short hints next to the settings, English and Russian, and a phone layout.
- Problems in plain wordsThe dashboard and each site show what needs attention and why, for example DNS that does not point to the server yet.
A setup wizard, Simple and Expert modes, protection presets and health checks with Fix buttons. See the roadmap
You have run servers for years
Every setting is in the panel, and the docs list its default and the files it touches.
- handlers
- static, PHP or Node.js per site, switch any time
- shell
- a terminal in the browser
- node
- one PM2 daemon per owner, pm2 works from the shell
- php
- .htaccess with mod_rewrite, per-site php-fpm pools
- rules
- per-site checks in a fixed, documented order
- cloudflare
- zone fixes through the Cloudflare API
- migrate
- export and import of every site as JSON
- releases
- sha256 published and checked by the installer
- source
- AGPL-3.0, the source code in every release archive
Checks run before your code does
WardPane itself answers on ports 80 and 443, so a request reaches your site only after the checks you turned on, in this order.
Blocklist
Addresses and networks you banned for every site.
Rate limit
Floods from a few addresses get a 404 and a ban.
Bot Fight
AI crawlers, scanners, fake Googlebots by IP.
Geo
Countries, groups like EU or CIS, hosting networks.
Link only
Open the site only to people from your ad link.
Password
A login prompt for drafts and test copies of a site.
Your site
Files, PHP or your Node.js app.
Pick what runs each site
Switch at any time. The settings of the other handlers are kept, so switching back takes one click.
| No handlerstatic hosting | PHPthe versions installed on the server | Node.js22 · 24 · 26, and 20 (end of life) | |
|---|---|---|---|
| Serves | Files from the site folder as they are | .php files, other files as static | Your app; files in public/ directly if you want |
| Good for | Landing pages, docs, built SPAs | WordPress, Laravel, older sites with .htaccess | Express, Next.js, Nuxt, bots with webhooks |
| Runs as | Nothing runs | php-fpm under its own Linux user, sandboxed | PM2 under the site owner, sandboxed, on a port from 10000 |
| Limits | Not needed | Memory, CPU, workers, upload size | Memory, CPU, outgoing connections |
No handlerstatic hosting
- Serves
- Files from the site folder as they are
- Good for
- Landing pages, docs, built SPAs
- Runs as
- Nothing runs
- Limits
- Not needed
PHPthe versions installed on the server
- Serves
- .php files, other files as static
- Good for
- WordPress, Laravel, older sites with .htaccess
- Runs as
- php-fpm under its own Linux user, sandboxed
- Limits
- Memory, CPU, workers, upload size
Node.js22 · 24 · 26, and 20 (end of life)
- Serves
- Your app; files in public/ directly if you want
- Good for
- Express, Next.js, Nuxt, bots with webhooks
- Runs as
- PM2 under the site owner, sandboxed, on a port from 10000
- Limits
- Memory, CPU, outgoing connections
Behind Cloudflare or not, it sees the real visitor
Behind a CDN, a filter that looks at the connection address sees only Cloudflare servers. WardPane keeps the list of Cloudflare networks (refreshed daily) and applies its rules to the visitor address behind them.
- Real IP, only from Cloudflare
- CF-Connecting-IP is trusted only when the connection comes from a Cloudflare address. The list of networks is refreshed daily.
- Only through Cloudflare
- With this switch on, direct requests to the server IP get a 404 and cannot go around the CDN.
- No accidental lockouts
- If a site behind Cloudflare is not marked as such, Cloudflare addresses are never banned and get a ten times higher limit. The log says which switch to turn on.
- Workers counted apart
- Anyone can deploy a Cloudflare Worker. Requests from Workers of other zones are counted and banned by that zone and do not share limits with your visitors.
Hosting
Sites and aliases
Up to 99 aliases per site, each can point to its own folder. Files go up over SFTP or through the terminal in the panel.
Let's Encrypt without manual steps
One certificate per site, renewed when a third of its term is left. Names with wrong DNS are skipped and added once DNS is fixed. The server IP gets a certificate too.
Cloudflare zone check
The panel reads the zone, shows wrong DNS records and SSL mode, fixes them on request and keeps certificates issuing behind the orange cloud.
Export and import
All sites with their settings go into one JSON file, which you import on the new server.
Protection
Bans only for clear attacks
A request for /.env or a URL with <script> bans the address. A reader with a broken image or a search for "select from" is not banned.
Fake crawlers banned
Google, Bing, OpenAI and five other operators publish their IP ranges. A "Googlebot" from an address outside them is banned.
Geo with groups
Pick countries one by one or 27 groups such as EU, Schengen, CIS, NATO or BRICS, with exceptions.
Panel sign-in
Five failed attempts block an address for 15 minutes. Root sign-in is optional, and the panel can answer only the IP addresses you list.
One command on a clean Ubuntu server
$ curl -fsSL https://wardpane.com/install | sudo bash
Available after the release.
You can also get the archive by email and read the code before you install.
Email me the archive- Your emailThe script asks for it and sends a six-digit code.
- Two confirmationsTerms and privacy policy, then consent to process personal data. The newsletter question defaults to No.
- A checked downloadThe installer checks the archive's SHA-256 before anything runs.
- The panel addressAt the end you get https://your-ip:1500 and the sign-in details.
Before you install
Is it really free?
Yes. WardPane is free software under AGPL-3.0, and every release archive contains the full source code. Use it on any number of servers, change it and share it. If you run a changed version as a service for others, publish your changes.
I am not a server admin. Can I manage?
Yes. One command installs it, certificates issue themselves, sites run in sandboxes by default, and the panel explains its settings with short hints. A setup wizard and a Simple mode are planned for 2.3.
Do I need Cloudflare?
No. WardPane issues certificates and filters traffic on its own. If a site needs Cloudflare, turn on Behind Cloudflare and the panel takes the visitor IP from it.
Can it live next to another panel?
It needs ports 80 and 443 for itself, so use a clean server. To move a site, copy its folder and create the site in WardPane.
Does it protect against DDoS?
It stops floods from a small number of addresses, scanners and abusive bots. A volumetric attack that fills the network link can only be stopped by your provider or a CDN.
Why do you ask for my email?
To send the download link and tell you about security fixes. Release news comes only if you opted in when you downloaded, and every email has an unsubscribe link.