Everything you need.
Nothing you don't.
Six systems, one binary. Here is what ships out of the box.
Hosting core
nginx with optional FrankenPHP per site, PHP 7.4 to 8.5 (5.6 to 7.3 available in opt-in legacy mode), MariaDB, PowerDNS with a MariaDB backend, and automatic Let's Encrypt SSL renewal. Every component you need to host a website, provisioned for you.
Per-account resource controls let you cap CPU, memory, and disk without CloudLinux. Switch a site between PHP versions without touching SSH. Add a domain alias or subdomain from the panel.
Mail stack
Postfix for delivery, Dovecot for IMAP and POP3, Rspamd for filtering, and SnappyMail as the webmail client. Guided DKIM key rotation walks you through publishing the new key before the old one is retired. A live deliverability dashboard shows SPF alignment, DMARC status, and Rspamd score trends.
Bounce tracking surfaces problem addresses before customers notice. Catch-all addresses, forwarding rules, and autoresponders are all managed from the same interface.
Security stack
Coraza WAF with OWASP Core Rule Set, CrowdSec for collaborative threat intelligence, ClamAV for malware scanning, Snuffleupagus for PHP hardening, and file integrity monitoring across every account. Included at every tier, free included. No Imunify license. No CloudLinux subscription.
The outbound connection monitor detects suspicious traffic before it damages your IP reputation. Security events surface in the admin dashboard with context, not just raw logs.
WP Toolkit
Available on paid tiers. One-click WordPress installation with smart defaults. Managed core and plugin updates with rollback snapshots so a bad update never breaks a live site. Hardening profiles apply recommended PHP and file system settings automatically.
A live vulnerability feed cross-references installed plugins and themes using your own Patchstack or WPScan API key. Affected installs surface in a single view so you can patch or quarantine before customers notice.
Backup and restore
Incremental, deduplicated backups (built on the open-source Restic engine) stored on S3, Backblaze B2, a local path, or a remote server over SSH and SFTP. Per-install backup schedules let you run WordPress sites hourly and static sites daily without wasting space.
Restoring is a single click: pick a snapshot, pick a destination, and HostCraft handles decompression, ownership correction, and database import. Full-account restores from cPanel-format backups are also supported for migrations.
Cluster mode
Link any number of servers under a single admin console. Each node runs as an agent, communicating over mTLS with a CA managed by the control node. Agent enrolment takes one command on the new server.
Cluster mode is a paid tier and the cluster panel needs PostgreSQL from the start. To decommission a node, move its accounts off first; HostCraft then drains the node, revokes its agent certificate, and publishes an updated CRL.
Bring your customers from cPanel
The cPanel cutover runbook walks you through migrating full accounts, transferring DNS zones, and validating mail before you flip the switch. Sites move one account at a time, so you choose when each cutover happens.
Ready to try it at launch?
HostCraft is launching soon. A free tier is planned: up to 3 accounts and 10 sites on one server.