BT Panel: Installation, Panel Security, and Hosting Your First Site

Stand up a website on your VPS through a GUI panel, then lock the panel down tight.

BT Panel (宝塔面板) is a server management panel that turns website setup, databases, SSL, and file management into point-and-click tasks. It saves you from hand-editing config files, but it also means that if the panel is breached, the whole server is exposed. Install it first, harden it, then put it into service.

Installing BT Panel

Prerequisites

Start from a clean OS: Ubuntu 20.04+/Debian 11+ or CentOS 7+/Rocky 8+, with at least 1 GB of RAM. Run the commands as root or an account with sudo, and make sure the box has internet access.

Install command

The official installer auto-detects your distro. The verification string at the end of the command is rotated periodically, so always copy the current command from the official install page. The examples below are illustrative:

# Ubuntu / Debian
wget -O install.sh https://download.bt.cn/install/install-ubuntu_6.0.sh && sudo bash install.sh ed8484bec

# CentOS / Rocky
yum install -y wget && wget -O install.sh https://download.bt.cn/install/install_6.0.sh && sh install.sh ed8484bec

When it finishes, the script prints your panel URL, username, and a random password — copy them down immediately. The default port is 8888, and the URL includes a random "security entry" path; the login page only opens when that path is present.

Logging in

Open the port in your VPS provider's security group/firewall, and on the host itself:

# Ubuntu/Debian (ufw)
sudo ufw allow 8888/tcp && sudo ufw allow 80,443/tcp

Browse to http://YOURSERVERIP:8888/security-entry and log in with the credentials above. On first login the panel offers to install a web stack — choose Nginx + MySQL + PHP (LNMP).

Hosting a site on your domain

  • In the left menu go to Website → Add site, enter your domain (e.g. www.example.com), and optionally create a database and pick a PHP version.
  • At your DNS provider, add an A record pointing the domain to the server's public IP, then wait for it to propagate.
  • Back in the site's Settings → SSL, request a free Let's Encrypt certificate and turn on Force HTTPS.
  • Upload your site's files to the site's root directory, and it's live.

Hardening the panel

The panel holds the highest privileges, so do all of the following:

  • Change the default port. Run bt in the terminal to open the menu and move it off 8888; open the new port in your firewall and close the old one.
  • Set strong credentials. Use the same bt menu to change the default username and random password — no weak passwords.
  • Keep the security entry. Don't disable the panel alias/security path; it deflects the vast majority of scanners.
  • Restrict access by IP. In panel settings, enable Authorized IP and allow only your static IP or office range.
  • Panel SSL + 2FA. Bind a domain to the panel, enable SSL, then turn on Google Authenticator two-step verification.
  • Expose only what you need. Beyond 80/443 and the panel port, keep everything else closed at the firewall.

Summary

BT Panel makes web hosting easy: one command to install, then a GUI to add sites, bind domains, and issue SSL certificates. The flip side of that convenience is concentrated risk, so the very first thing to do after installing is change the port, reset the credentials, keep the security entry, limit source IPs, and enable two-step verification. Lock the panel down first — then trust it with your sites.