ctapanel integrations
ctapanel connects to the hosting panels, DNS provider, storage services and server software already in your stack. Each connection uses the provider’s own interface: the panel API, OAuth or the ctapanel agent on the server. Credentials are stored encrypted and are not displayed again once saved.
Hosting panels and Linux servers.
cPanel/WHM, Plesk and DirectAdmin are managed through their own APIs, so every change also appears in the panel. Servers without a panel connect over SSH and run the ctapanel agent.
- API token
cPanel & WHM
Connected with a WHM API token that has every privilege enabled. Accounts, packages, resellers, DNS zones, mail, databases, PHP and EasyApache are managed through the WHM API, so each change is also visible in WHM.
ManagedDetails : cPanel & WHM - Admin key
Plesk
Connected with a Plesk admin key. Hosting accounts, DNS, mail, databases and PHP settings are handled through the Plesk API, and .NET and Node.js apps through Plesk’s own extensions.
ManagedDetails : Plesk - API token
DirectAdmin
Connected with a DirectAdmin API token. Users, DNS, mail, databases and services are managed through the DirectAdmin API, and backups are taken with admin-backup by the ctapanel agent.
ManagedDetails : DirectAdmin - SSH key
Linux without a panel
Connected with an SSH key, after which the ctapanel agent takes over. Services, metrics, files, terminal sessions, PHP-FPM pools and Node.js or Python apps are managed on the server itself.
ManagedDetails : Linux without a panel - Panel · FTP · SSH
Account migration
Accounts move between your own servers, or in from a remote cPanel, Plesk or DirectAdmin panel on its own port, over FTP or over SSH. Each transfer follows a step plan with live progress, a queue, cancel and requeue.
Managed- cPanel
- Plesk
- DirectAdmin
DNS zones, Cloudflare and certificates.
Server zones and Cloudflare records are edited with the same form and the same permissions. AutoSSL on cPanel servers is configured from the security screens.
- OAuth
Cloudflare
Connected over OAuth, with no API token to copy. A, AAAA, CNAME, MX, TXT, NS, SRV and CAA records are edited next to the server zone, with the proxy toggle per record. Domains can be moved to Cloudflare, and SSL mode and edge certificates are checked hourly.
ManagedDetails : Cloudflare - Panel API
Panel DNS zones
Zones on cPanel, Plesk and DirectAdmin are edited through each panel’s DNS API, with type-specific validation, SOA serial updates, protected system records and a one-step zone reset.
Managed- cPanel
- Plesk
- DirectAdmin
- Panel API
cPanel AutoSSL
The AutoSSL provider and options are set per server, a check can be started and its log read on screen. Turning AutoSSL off requires a one-time code.
Managed- cPanel
Backup destinations.
Backups of cPanel, Plesk and DirectAdmin accounts go to ctabox, any S3-compatible bucket, Google Drive, Dropbox or another server in your fleet. Every transfer is verified with SHA-256.
- Built in
ctabox
Built-in storage with space reserved for your organisation and a quota set by your plan. No bucket or keys to configure, and time-limited share links work with the backups stored here.
Managed- cPanel
- Plesk
- DirectAdmin
- Access keys
Amazon S3 and S3-compatible
Amazon S3, Wasabi, Backblaze B2, Cloudflare R2, DigitalOcean Spaces or MinIO, with custom endpoint, path-style addressing and prefix. The key is tested by writing and deleting a small file, then stored encrypted. Large packages use multipart upload.
Managed- cPanel
- Plesk
- DirectAdmin
- OAuth
Google Drive
Connected over OAuth with the drive.file scope: ctapanel sees only the files it creates. Uploads resume after a dropped connection, and retention removes older backups from Drive.
Managed- cPanel
- Plesk
- DirectAdmin
- OAuth
Dropbox
Connected over OAuth with app folder access: ctapanel sees only its own folder. Large packages use upload sessions, and retention removes older backups there as well.
Managed- cPanel
- Plesk
- DirectAdmin
- Agent
Your own server
Any other server in your fleet running the agent, panel-less machines included. Backups are written to /home/ctapanel-backups on the target, and a server cannot store its own backups.
Managed- cPanel
- Plesk
- DirectAdmin
Alerts and confirmation codes.
Alerts open in the panel’s alert list and, when enabled, are sent to WhatsApp. Sensitive actions such as restores and deletions are confirmed with a one-time code sent to the same number.
- Phone number
WhatsApp
Warning or critical alerts sent to the owner, or to the owner and sysadmins, capped at 20 messages an hour per organisation. The same number receives the one-time codes that confirm restores, deletions and other sensitive actions.
Managed - WHM Post URL
WHM notifications
With routing switched on, every notification WHM sends to the server administrator, such as disk quota, service failure or backup errors, also opens in the ctapanel alert list and can be forwarded to WhatsApp.
Managed- cPanel
Server security software.
ctapanel detects the firewall, login protection, WAF and malware scanner on each server from its service list and works with the engine it finds. Findings feed the security centre and the fleet score.
- Agent
CSF, firewalld, ufw and Plesk Firewall
The engine is taken from the server’s service list. Rules, allow and deny lists, counters and CSF country blocks are read by the agent and shown in the same table for every engine.
Read-only- cPanel
- Plesk
- DirectAdmin
- No panel
- Panel API
cPHulk, Fail2Ban and Brute Force Monitor
Failed logins and blocked addresses come from the panel’s own tool. On cPanel and Plesk an IP can be unblocked, allow-listed or blocked; DirectAdmin is shown read-only.
Managed- cPanel
- Plesk
- DirectAdmin
- Agent
Imunify360, ModSecurity and ClamAV
The WAF and malware scanner running on each server are reported, ImunifyAV and Maldet included. A stopped or missing engine becomes a finding in the security centre. Rule editing and manual scans are not available.
Read-onlyDetails : Imunify360, ModSecurity and ClamAV - Agent
CloudLinux
CloudLinux is detected per server. CageFS is switched per account through the agent, and turning it off requires a one-time code. Node.js on cPanel follows the CloudLinux selector.
Managed
Security advisory feeds.
Vendor advisories and vulnerability catalogues are read on a schedule and matched against the panel version and software inventory of each server.
- Public feed
cPanel, Plesk and DirectAdmin advisories
Security advisories from the cPanel and Plesk support centres and DirectAdmin release notes, matched against the panel version on each server. DirectAdmin versions are also checked against CVE records in the NIST NVD.
Data feed- cPanel
- Plesk
- DirectAdmin
- Public feed
CISA KEV and OS errata
Pending security updates on AlmaLinux and CloudLinux are read from dnf and checked against the CISA Known Exploited Vulnerabilities catalogue. A known exploited CVE raises a critical alert.
Data feed
Mail queue and webmail sign-in.
Queues, sending limits and mailbox quotas are read and changed through each panel. With the agent installed, mailboxes open in ctapanel Webmail without asking for their password.
- Panel API
Mail queue and sending limits
Queued messages are listed with their hold reason on cPanel, Plesk and DirectAdmin, then released, deleted or flushed. Hourly limits per domain and mailbox, spam hold and remote SMTP blocking are set per server.
Managed- cPanel
- Plesk
- DirectAdmin
- Agent
Dovecot webmail sign-in
The agent adds a Dovecot master user that accepts logins only from the ctapanel Webmail address. A mailbox then opens from the panel in one click, without its password; sending mail asks for it once.
Managed
PHP, Apache and application runtimes.
Each panel’s own version manager and build tool is used as it is: MultiPHP and EasyApache on cPanel, extensions on Plesk, systemd units on servers without a panel.
- Panel API
PHP and PHP-FPM
Server default and per-site PHP versions, php.ini directives, extensions and FPM pools, through MultiPHP on cPanel and each panel’s own handler elsewhere. Sites on end-of-life branches can be moved in bulk.
Managed- cPanel
- Plesk
- DirectAdmin
- No panel
- Panel API
EasyApache 4
Apache MPM and modules switched per cPanel server, with ready profiles, locked packages and the last build’s time and duration on screen.
Managed- cPanel
- Agent
Node.js and Python
Apps managed with Application Manager (Passenger) on cPanel, a dedicated extension on Plesk and systemd elsewhere, behind a reverse proxy, with port, memory and CPU per app.
Managed- cPanel
- Plesk
- DirectAdmin
- No panel
- Panel API
.NET on Plesk
.NET apps managed through the Plesk .NET Toolkit extension, with installed runtimes and apps listed. cPanel and DirectAdmin offer no .NET management, and the screen states the reason.
Managed- Plesk
- Panel API
MySQL
Databases listed with size, table count, reclaimable space, slow queries and last backup. New databases and users follow each panel’s naming rule, and wasted space is reclaimed from the list.
Managed- cPanel
- Plesk
- DirectAdmin
How connections work.
Each integration uses the narrowest access its task requires, and every change made through it is recorded with the user and the target.
- 01Panel credentials per type: a full-privilege API token for cPanel/WHM and DirectAdmin, an admin key for Plesk, an SSH key for servers without a panel. Each is tested before the server is saved.
- 02Encrypted storage: API tokens, access keys and OAuth grants are stored encrypted and never displayed again after saving.
- 03OAuth for Cloudflare, Google Drive and Dropbox: no password reaches ctapanel, tokens renew automatically, and disconnecting revokes the token at the provider.
- 04Narrow scopes: drive.file on Google Drive, the app folder on Dropbox, and read-only zone settings on Cloudflare, where only DNS records are writable.
- 05Agent on the server: backups, transfers, terminal sessions, file access, firewall readings and webmail sign-in run through the ctapanel agent. Accounts, DNS and mail settings go through the panel API.
- 06Permissions and codes: viewing, changing and connecting are separate rights, and sensitive actions such as restores or turning AutoSSL off require a one-time code.
Known limitations
The following are not available today. Requests for new integrations are welcome through the contact page.
- Alert channels other than WhatsApp and the in-panel alert list: no email, Slack, Microsoft Teams, Telegram or webhook delivery.
- No public API or outgoing webhooks for your own scripts.
- No DNS providers other than Cloudflare, such as Amazon Route 53.
- No Azure Blob Storage, FTP or SFTP backup destinations.
- No billing system integration, such as WHMCS or Blesta.
- Firewall rules and lists are read only, and Imunify360, ModSecurity and ClamAV rules cannot be edited or scans started from ctapanel.
Integration questions
Q.01Which permissions does the Cloudflare connection request?
Zone read, DNS read and write, account settings read, zone settings read and offline access for token renewal. Zone settings such as SSL mode, caching, page rules and WAF are read, never changed; they stay in the Cloudflare dashboard.
Q.02Can ctapanel see the rest of my Google Drive or Dropbox?
No. On Google Drive the drive.file scope limits access to the files ctapanel creates. On Dropbox access is limited to the ctapanel app folder. Removing the destination revokes the token at the provider.
Q.03Which S3-compatible services work?
Any service with an S3 API and Signature Version 4, including Amazon S3, Wasabi, Backblaze B2, Cloudflare R2, DigitalOcean Spaces and MinIO. Custom endpoints, path-style addressing and a key prefix are supported. The key needs only Put, Get, Delete and List.
Q.04Which integrations require the ctapanel agent?
Backups, account transfers, the terminal, file access, firewall readings, CageFS and webmail sign-in run through the agent. Accounts, DNS zones and mail settings on cPanel, Plesk and DirectAdmin go through the panel API. Servers without a panel rely on the agent for everything.
Q.05Can I request a new integration?
Yes. Send the service and the use case through the contact page. This page lists only integrations that work today.
Connect your first server today.
Free for 14 days, no card needed. Create your account, add your first server with an API token or an SSH key, and the panel starts filling in a few minutes later.
No setup fee · Cancel anytime · EU-hosted