How to Install aaPanel on Ubuntu and Configure It Securely

aaPanel provides browser-based management for websites, PHP, databases, SSL, cron, backups, and VPS resources. This guide installs aaPanel on a fresh Ubuntu Server and secures its administration interface before hosting a website.

aaPanel requires root privileges and changes many system components. Use a fresh VPS or a recoverable snapshot; do not install it directly over a manually configured production stack.

1. Requirements

• A public VPS with at least 1 vCPU and 1 GB RAM for testing; size production for the application and database.
• Ubuntu 22.04 or another currently supported release; official documentation presently recommends Ubuntu 22.04.
• Root or sudo access using an SSH key.
• A website domain and preferably a separate panel subdomain.
• Off-host storage for backups.

Avoid a host that already runs Nginx, Apache, MySQL, or another control panel unless you understand the conflicts. Create a provider snapshot first.

2. Connect and update Ubuntu

ssh -i ~/.ssh/server_key root@SERVER_IP

apt update
apt full-upgrade -y
apt install -y curl ca-certificates
reboot

Reconnect and inspect the system:

cat /etc/os-release
df -h
free -h

3. Configure the cloud firewall

Do not expose MySQL 3306, Redis 6379, FTP, or an unknown panel port. The installer prints the actual administration port; add a source-restricted rule afterward.

4. Download and inspect the installer

The official documentation serves the installer from aapanel.com. Download it with normal certificate verification instead of disabling TLS checks:

cd /root
curl --fail --location --proto '=https' --tlsv1.2 \
  --output install_panel_en.sh \
  https://www.aapanel.com/script/install_panel_en.sh

ls -lh install_panel_en.sh
less install_panel_en.sh

Review the source URL, packages, and paths. If TLS fails, fix system time or CA certificates; do not use -k to bypass verification on production.

The Quick Start page does not publish a fixed checksum beside this changing script, making the verified HTTPS source, manual review, and retaining the exact script in change records especially useful.

5. Run the installation

bash install_panel_en.sh forum

Confirm the installation directory when prompted. The installer reports the external and internal URLs, panel port, random security entrance, initial username, and password.

Store these in a password manager, not chat or email. Keep the SSH session open until panel access is confirmed.

6. Allow the panel port and sign in

Add the reported panel port to the cloud security group, restricted to the administrator IP or VPN. Visit the exact URL including HTTPS, port, and security entrance.

The initial panel may use a self-signed certificate. Verify that the IP and URL match the installation session before continuing, then replace it with a trusted certificate.

bt default   # show default access information
bt 5         # change the panel password
bt           # open the aaPanel management menu

7. Harden the panel immediately

1. Replace the panel username and password with unique values.
2. Enable Panel SSL with a trusted domain and certificate.
3. Enable Google Authenticator and store recovery information.
4. Add BasicAuth when appropriate.
5. Bind a panel domain to block direct IP access.
6. Use Authorized IP or a VPN.
7. Keep the random security entrance, but do not treat it as primary security.
8. Use a short session timeout and enable security alerts.
9. Review the host firewall and deny unnecessary inbound ports.

Changing the port mainly reduces automated noise. MFA, IP restriction, patching, and backups provide the meaningful protection.

8. Choose LEMP or LAMP

Install only the web server, PHP, database, and cache you need. Select application-supported versions. Do not preinstall mail, FTP, Docker, or several database engines merely because they are available.

9. Add the first website

1. Point the domain A/AAAA records to the server.
2. Open Website, select the project type, and add the domain.
3. Set the correct document root; Laravel commonly uses public.
4. Create a dedicated database and user with a generated password.
5. Upload or deploy through a controlled process.
6. Set rewrite rules, PHP version, and extensions required by the application.
7. Test over HTTP before issuing SSL.

Never use the database root account in the application. Keep secret-bearing configuration outside the public root or explicitly blocked by the web server.

10. Issue SSL and enforce HTTPS

Once DNS is correct and ports 80/443 are open, request a Let's Encrypt certificate in the site settings and enable HTTPS redirection. Verify all required names, mixed content, automatic renewal, and site availability after a web-server reload.

11. Configure off-host backups

Schedule separate site-file and database backups. Do not rely on /www/backup on the same VPS. Transfer copies to an independent account or provider, encrypt them, and define retention.

1. Create a manual backup.
2. Move or download it off-host.
3. Restore a test site and database from the copy.
4. Record the steps and actual recovery time.

Provider snapshots are useful but do not replace application-level backups because they can share the cloud account and failure domain.

12. Updates, monitoring, and operations

• Alert on CPU, memory, disk, services, SSL, and backup failure.
• Review aaPanel and plugin updates; test in staging when possible.
• Patch Ubuntu and schedule kernel reboots.
• Read web-server, PHP, and panel logs instead of merely restarting services.
• Check free space before backups and database upgrades.
• Document domains, ports, stack versions, backup locations, and ownership.

Common problems

Production checklist

• The panel is reachable only through HTTPS and authorized IPs or VPN.
• MFA works and recovery information is stored.
• SSH uses keys and password-based root login follows a restrictive policy.
• Only 22, 80, 443, and required ports are open.
• Databases and caches are not public.
• The site uses HTTPS and certificate renewal works.
• File and database backups exist off-host and have passed a restore test.
• Resource, certificate, and backup alerts have been tested.
• A snapshot or rollback plan exists before major upgrades.

Conclusion

Installing aaPanel takes only a few minutes, but a production-ready server requires more: restricted administration, MFA, a minimal stack, protected secrets, off-host backups, and tested recovery. If no one owns Linux patching and incident response, managed hosting remains a better choice than a self-managed VPS.

References

• aaPanel Documentation: Quick Start
• aaPanel Documentation: Settings
• aaPanel Documentation: Security
• aaPanel Documentation: Website Basics