Install LiteSpeed Web Server With CyberPanel on VPS

CyberPanel is a fast way to run LiteSpeed with a usable control panel. The trade-off is trust. You’re installing an all-in-one stack (OpenLiteSpeed by default, with optional LiteSpeed Enterprise). That stack needs a clean install and basic hardening right away.

This guide shows how to install CyberPanel on a VPS, enable HTTPS, and publish your first site end-to-end. It also covers DNS, firewall rules, and where your files live on disk.

What you’ll build (and what you need)

A fresh VPS running CyberPanel + OpenLiteSpeed (OLS) + MariaDB
CyberPanel admin at https://SERVER_IP:8090
A first website served by LiteSpeed with a Let’s Encrypt certificate
Basic hardening: SSH, firewall ports, and panel protection

Recommended VPS size: 2 vCPU / 2–4 GB RAM for a small WordPress or PHP site. CyberPanel runs more services than a minimal Nginx + PHP-FPM setup. Avoid the smallest plans.

If you want consistent CPU and NVMe I/O for LiteSpeed caching and PHP workloads, start with a HostMyCode VPS.

If you don’t want to own updates, security baselines, and “why is the panel down?” incidents, managed VPS hosting is usually safer for production.

Prerequisites

A fresh server (no existing web stack). Don’t layer this onto a box that already has Apache installed.
Root SSH access (or a sudo user).
A domain name you control, with access to its DNS zone. If you need a domain, use HostMyCode Domains.

OS choices

CyberPanel supports several distributions. In 2026, these are the lowest-friction options:

Ubuntu Server 24.04 LTS (widely tested, broad package support)
AlmaLinux 9 / Rocky Linux 9 (stable RHEL-family base)

The steps below use Ubuntu 24.04 commands where they differ.

On AlmaLinux/Rocky, swap apt for dnf. Use firewalld instead of UFW.

Step 1: Prepare the VPS (hostname, updates, and time sync)

ssh root@YOUR_SERVER_IP

Set a hostname that matches your naming scheme. This step is optional, but it helps with logs, mail, and inventory later.

hostnamectl set-hostname panel1.example.com
hostnamectl

Update packages. Reboot if you pull in kernel updates:

apt update
apt -y full-upgrade
reboot

After reboot, reconnect. Then confirm time sync.

TLS and Let’s Encrypt can fail if the system clock drifts:

timedatectl status

If NTP isn’t active:

timedatectl set-ntp true
timedatectl status

Step 2: Open only the ports CyberPanel and your sites need

CyberPanel’s UI runs on 8090. LiteSpeed serves traffic on 80/443.

SSH is 22 unless you changed it.

Ubuntu (UFW)

apt -y install ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 8090/tcp
ufw enable
ufw status verbose

AlmaLinux/Rocky (firewalld)

dnf -y install firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=8090/tcp
firewall-cmd --reload
firewall-cmd --list-all

Common mistake: opening a large port range “temporarily.” CyberPanel can expose extra services (FTP, mail, DNS) after you enable them. Keep the firewall tight until you have a clear reason to open more.

Step 3: Install CyberPanel (OpenLiteSpeed mode)

CyberPanel’s installer pulls in OpenLiteSpeed, MariaDB, PHP versions, and the panel.

Run it on a clean machine. Let it own the stack.

Download and start the official installer:

cd /root
sh <(curl -s https://cyberpanel.net/install.sh)

You’ll see an interactive menu. These defaults work well for most setups:

Select 1) Install CyberPanel
Select OpenLiteSpeed unless you already have LiteSpeed Enterprise licensing
Set a strong admin password (store it in a password manager)
Leave PHP version defaults unless an app requires something specific

When it finishes, the installer prints login details. If you miss them, you can still log in with the credentials you set.

Verify the services are up

First, test locally on the VPS that the panel responds:

curl -I http://127.0.0.1:8090

You should get an HTTP response (often a redirect). Next, open this from your local browser:

https://YOUR_SERVER_IP:8090

The browser warning is expected because the certificate is self-signed. Continue, then log in as admin using the password you set.

Tip: If the UI won’t load, re-check the firewall rules.

Also confirm something is listening on 8090:

ss -lntp | grep 8090

Step 4: Lock down the panel before you host anything

Control panels attract attention. Do the basics now, while nothing critical runs on the box.

1) Create a non-root admin user for SSH

adduser ops
usermod -aG sudo ops
mkdir -p /home/ops/.ssh
chmod 700 /home/ops/.ssh

Add your SSH key:

nano /home/ops/.ssh/authorized_keys
chmod 600 /home/ops/.ssh/authorized_keys
chown -R ops:ops /home/ops/.ssh

Then harden SSH (optional, but strongly recommended):

nano /etc/ssh/sshd_config

Set (or ensure):

PasswordAuthentication no
PermitRootLogin no

Reload SSH:

systemctl reload ssh

Verify: Open a second terminal. Confirm you can SSH in as ops before you close your root session.

2) Add Fail2ban for SSH and basic web abuse

CyberPanel includes security features, but Fail2ban is a proven baseline against SSH brute force.

If you want a deeper Nginx-focused setup, see: Set Up Fail2ban for Nginx on Ubuntu VPS. The same jail concepts still apply even if LiteSpeed serves your sites.

apt -y install fail2ban
systemctl enable --now fail2ban
fail2ban-client status

Create a simple SSH jail:

nano /etc/fail2ban/jail.d/sshd.local

[sshd]
enabled = true
maxretry = 5
findtime = 10m
bantime = 1h

systemctl restart fail2ban
fail2ban-client status sshd

Step 5: Point your domain to the VPS (DNS) and confirm propagation

Pick a domain (example: example.com) and add these DNS records:

A record: example.com → YOUR_SERVER_IP
A record: www.example.com → YOUR_SERVER_IP

From the VPS, confirm DNS resolves to the correct IP:

apt -y install dnsutils
dig +short example.com
dig +short www.example.com

Both lookups should return your server IP. If they don’t, stop here.

Fix DNS before you try Let’s Encrypt.

If you’re changing DNS providers and want to avoid downtime (bad TTL timing, missing records, partial propagation), follow: Migrate a Domain to Cloudflare DNS Without Downtime.

Step 6: Create your first website in CyberPanel

In CyberPanel:

Go to Websites → Create Website
Select the package (the default is fine to start)
Owner: use admin or create a separate user if you prefer
Domain: example.com
Select a PHP version (stick to the default unless you have a reason to change)
Leave SSL for now (we’ll issue it after DNS is confirmed)

After creation, CyberPanel shows the site’s document root. It’s usually:

/home/example.com/public_html

Upload a quick test page (sanity check)

On the server, drop a tiny PHP file into the docroot:

sudo -u examplecom bash -lc 'echo "<?php echo \"LiteSpeed + CyberPanel OK\n\";" > /home/example.com/public_html/health.php'

If the user name differs, use CyberPanel’s file manager. You can also fix ownership afterward.

Now test over HTTP:

curl -i http://example.com/health.php

You should get 200 OK plus your message. If you see a 403, it’s usually permissions or the wrong docroot.

Step 7: Issue a Let’s Encrypt certificate and force HTTPS

CyberPanel can request Let’s Encrypt certificates from the UI.

Go to Websites → List Websites
Click Manage for example.com
Find Issue SSL (Let’s Encrypt)
Include both the root domain and www if you created both DNS records

Verify: After issuance, confirm the cert from your local machine:

curl -Iv https://example.com 2>&1 | grep -E 'issuer:|subject:|expire date:|SSL connection'

Force HTTPS

In CyberPanel, enable the toggle like Force HTTPS Redirect under the site’s management screen.

Then test:

curl -I http://example.com | head

You want a 301 or 308 redirect to https://.

Common mistakes that break issuance:

DNS A records still point to the old server
Port 80 blocked by the firewall or an upstream security group
Using a CDN proxy (orange cloud) before issuance; switch to DNS-only until the certificate is issued

Step 8: Install WordPress the clean way (optional, but most people will)

If you’re deploying WordPress, CyberPanel’s installer saves time.

Still watch two things: your PHP memory limit and where you store database credentials.

In CyberPanel go to Websites → List Websites → Manage
Use Install WordPress (or WordPress Manager if available)
Set an admin user/password and a real admin email address

Verify: Open https://example.com/wp-admin and confirm you can reach the dashboard.

For common ownership and permission issues after plugin installs or updates, keep this guide handy: WordPress File Permissions Fix on a VPS.

Step 9: Enable LiteSpeed Cache (and avoid the usual misconfig)

LiteSpeed pays off once you enable caching. On OpenLiteSpeed, that usually means the LiteSpeed Cache plugin in WordPress.

Install the LiteSpeed Cache plugin inside WordPress
Enable caching, then test as a logged-out visitor

Verify caching headers

Run this from your laptop (logged out):

curl -I https://example.com | grep -i -E 'x-litespeed-cache|cache-control|set-cookie'

You want LiteSpeed cache headers.

You also want to avoid a surprise Set-Cookie on public pages, since that commonly disables caching.

If you also need object caching (database query cache) for WooCommerce or heavier plugins, Redis is a good fit.

You can adapt the approach from our Redis guide even though it targets Nginx + PHP-FPM: Set Up Redis for WordPress With Nginx and PHP-FPM.

Step 10: Backups you can actually restore

CyberPanel includes backup tooling, but don’t stop at “backup succeeded.”

Do a restore test immediately. Restore into a second directory or a staging domain.

Quick manual backup (files + database)

For a WordPress site called example.com, a basic export looks like this.

1) Archive site files:

cd /home/example.com
tar -czf /root/example.com-files-$(date +%F).tar.gz public_html

2) Dump the database (DB name/user live in wp-config.php):

grep -E "DB_NAME|DB_USER|DB_PASSWORD" /home/example.com/public_html/wp-config.php

Then dump (replace values):

mysqldump -u DB_USER -p'DB_PASSWORD' DB_NAME > /root/example.com-db-$(date +%F).sql

Restore test (do it immediately)

Create a temporary folder and extract files:

mkdir -p /root/restore-test
tar -xzf /root/example.com-files-$(date +%F).tar.gz -C /root/restore-test

Import the DB into a new database instead of overwriting production.

If you want a more automated routine (including restore tests), use the workflow in: Set Up Automatic MySQL Backups With Tested Restores.

Common mistake: keeping backups only on the same VPS. If the disk fails or the server is compromised, the backups disappear too.

Keep an offsite copy (object storage, another VPS, or a backup provider).

Step 11: Basic monitoring and logs you should check weekly

CyberPanel hides a lot of plumbing, but you still need visibility.

Start with disk usage, memory pressure, and obvious service errors.

Quick health checks

df -h
free -h
uptime
journalctl -p warning -n 50 --no-pager

OpenLiteSpeed logs

Paths vary by build, but these are common:

/usr/local/lsws/logs/error.log
/usr/local/lsws/logs/access.log

Tail errors while you hit the site:

tail -f /usr/local/lsws/logs/error.log

If you want dashboards and alerting, Grafana is a practical next step.

This tutorial covers a typical VPS setup: Install Grafana on a VPS for Server Dashboards.

Step 12: Updates and safe operations (what to do, and what to avoid)

Panels often break during rushed updates. Treat changes like small deployments.

Plan them, back them up, and make them reversible.

Before updates: take a snapshot/backup and confirm you can restore files + DB.
Update OS packages: weekly for security fixes.
Update CyberPanel: monthly, or sooner if there’s a security advisory. Do it in a low-traffic window.

On Ubuntu, OS updates:

apt update
apt -y full-upgrade

Avoid: mixing control panels or installing extra web servers “just to try them.” CyberPanel expects to own ports 80/443 and the web stack.

Keep the machine single-purpose.

Summary: your LiteSpeed + CyberPanel VPS is live

You now have CyberPanel installed, OpenLiteSpeed serving your site, and HTTPS working end-to-end.

From here, focus on operations: tight ports, tested backups, and predictable updates.

If this is for a business site, run it on a VPS with consistent CPU and disk performance. A HostMyCode VPS is a solid match for CyberPanel + LiteSpeed.

If you don’t want to be the on-call sysadmin for panel patches and security maintenance, managed VPS hosting is worth budgeting for.

Want LiteSpeed performance without losing a weekend to DNS, SSL, and firewall cleanup? Run CyberPanel on a VPS sized for the job. Start with a HostMyCode VPS, or choose managed VPS hosting if you’d rather have a team handle upkeep and incident response.

FAQ: CyberPanel + LiteSpeed on a VPS

Should I choose OpenLiteSpeed or LiteSpeed Enterprise?

OpenLiteSpeed is free and fits most small to mid-sized sites. LiteSpeed Enterprise adds features and compatibility layers for certain workloads, but it requires a license.

Start with OLS unless you already know Enterprise solves a specific problem for you.

Why does Let’s Encrypt SSL fail in CyberPanel?

It’s usually DNS or port 80. Make sure your A records point to the correct server IP and that 80/tcp is reachable end-to-end.

Also disable CDN proxying until the certificate is issued.

What ports must be open for a minimal CyberPanel setup?

At minimum: 22 (SSH), 80/443 (web), and 8090 (CyberPanel UI). Only open mail, FTP, or DNS ports if you actually enable those services.

Where is my website’s document root?

Typically /home/yourdomain.com/public_html. CyberPanel shows the exact path in the site’s management screen.

If you’re seeing 403/404 errors, confirm you’re editing the right directory and that ownership/permissions are correct.

How do I confirm LiteSpeed cache is working?

Check response headers with curl -I and look for LiteSpeed cache headers. Also test from a logged-out browser session.

Confirm public pages aren’t setting cookies that bypass cache.