Research

Measurements, not adjectives.

Technical studies of server control panels and the stacks they manage, published with the method, the environment, the commands and the limitations, so that anyone can repeat them. Results are published whether or not they favour auraPanel.

  • 17 September 2026 · systemd cgroup accounting, ps, pidstat, du on one live host

    How much of the server does auraPanel itself use?

    On a production 2-vCPU ARM64 host running eight sites, the panel daemon holds about 38 MB resident and used 0.03% of one CPU core on average over nine days; its systemd cgroup, which also counts the backup and maintenance jobs it runs, averaged 0.4%. The data-plane engines it manages dwarf it. Single host, no competitor measured.

    Read the study →

  • 17 September 2026 · rendered configuration from a live host vs the competitor's public template repository

    What a control panel writes into nginx for WordPress: auraPanel and CloudPanel side by side

    Both panels ship a hardened WordPress server block with TLS 1.2+, HTTP/2, hidden version, blocked dotfiles and long-lived static caching. They differ on HTTP/3, PageSpeed and Varnish (CloudPanel), and on per-site logs, an ACME location, bot blocking, xmlrpc and uploads-PHP denial, a bad-bot map and an optional Cloudflare origin lock (auraPanel). Read from primary sources with dates.

    Read the study →

What every study here includes

Method

Exactly what was measured or read, with the commands or the source documents, so the number can be reproduced.

Environment

Hardware, operating system, software versions, and what else was running. A figure without its environment is not a result.

Date

When the measurement was taken or the source read. Software changes; a dated result stays honest.

Limitations

What the study does not show: sample size, single host, missing competitors, things not controlled for.

No tuning to win

Tests are not arranged so that auraPanel comes out ahead, and results are published when it does not.

Corrections

If you can show a measurement is wrong, tell us; the study is corrected with a note, not quietly replaced.

Try the live demo

A real auraPanel on a real server, shared with everyone. Sign in with the demo account and click around.

Email
demo@goaura.one
Password
demo1234
Open the demo panel ↗

Shared public demo, so please don’t put anything personal in it. More about the demo →

Talk to us

Tell us what you need and how to reach you. A person reads this, not a queue.

We use these details only to reply to you. Privacy

Recent updates

What shipped in the last releases. With automatic updates on, each lands on your server the moment it is published.

  1. v1.21.3
    Framework sites were undetectable, and a restore could silently point the copy at the original's live database.

    DetectApp looked for each application's signature relative to the docroot — but every PHP framework in the registry serves from a subdirectory (DocrootSub: public, webroot, web, pub, docroot) and keeps the file that identifies it one level *above* that. So the Laravel signature searched <project>/public/artisan,…

  2. v1.21.2
    Restarting nginx now blocks the panel and reconnects, instead of showing a notice.

    v1.21.1 stopped the false "HTTP 520" but only put up a toast — and a toast is the wrong affordance when the panel itself is about to go away: the page sat there looking broken while every request failed underneath it.

  3. v1.21.1
    Restarting nginx from Services no longer reports a false failure.

    It showed "Restart failed — HTTP 520". The panel is reverse-proxied *by* nginx, so the request deadlocked against itself: the handler blocked waiting for the restart to finish, while nginx's graceful stop waited for that very request to drain. Neither could proceed until nginx's stop-retry timeout force-killed it,…

  4. v1.21.0
    Per-site X-Frame-Options, fixing page builders that couldn't load their preview.

    Elementor's editor failed with *"Multiple 'X-Frame-Options' headers with conflicting values ('DENY, SAMEORIGIN')"*. The cause is that nginx's add_header appends rather than replaces: when the application also sets the header — a WordPress security plugin, or a CDN transform — the browser received two values,…

  5. v1.20.6
    The multi-database restore refusal now says what is in the backup and what still works.

    It read only "Restoring a multi-database site isn't supported yet", which is a dead end: it named neither the databases involved, nor why one of them is the limit, nor any route forward.

  6. v1.20.5
    Services: cards in a row now match heights.

    Like the settings grid before it, the Services grid pinned each card to its own content height, so a row often showed one card noticeably shorter than the card beside it. Each row now takes the taller card's height and both fill it, and it re-balances as content changes — a runtime installed, a longer service list.

  7. v1.20.4
    Settings: paired cards now match heights.

    Organisation / Panel Domain and auraPanel Updates / Session timeout each sat at their own content height, so a row showed one card visibly shorter than its neighbour. Each row now takes the taller card's height and both fill it — driven by content, not a fixed value, so it still adapts as a card grows (a validation…

  8. v1.20.3
    Settings: Organisation and Panel Domain now share a row too.

    They were full-width blocks stacked above the rest of the page; they now sit side by side in the same two-column grid as the Updates / Session timeout pair, so the top of Settings reads as two tidy rows instead of four stacked bands. Both cards shrink cleanly — the logo drop zone is a fixed 44×44 and the name field…

All releases on GitHub ↗