Panel
The unofficial Panel response header identifies the hosting control panel managing the server.
Usage
The Panel header is set by hosting providers to expose which
control panel software administers the server configuration. The
dominant value is hpanel, referring to hPanel, Hostinger's
proprietary control panel interface. The header appears on over
660,000 surveyed websites, almost all of them Hostinger-hosted.
On Hostinger, Panel routinely appears alongside the
X-Powered-By header and other infrastructure
headers such as Platform,
x-hcdn-cache-status, and
x-hcdn-request-id. The combination reveals both the underlying
hosting platform and the control panel layer managing the server.
Other hosting providers use different identifiers. Values like
intecPanel, CP_TextraHost, and awp indicate alternative
panel systems used by smaller or regional providers.
Values
hpanel
The most common value. Identifies Hostinger's hPanel as the control panel managing the server. Present on the vast majority of sites sending the Panel header.
Other panel identifiers
Smaller hosting providers use provider-specific values. Observed
examples include intecPanel, CP_TextraHost, awp, iwp,
mwp, vwp, and TheHBK Premium Hosting Panel. These follow
no common naming convention.
Example
A response from a Hostinger-hosted site. The hpanel value
identifies Hostinger's control panel as the management layer.
Panel: hpanel
A response from a site managed through an alternative hosting control panel.
Panel: intecPanel
Observed in the wild
Crawl data across 314 hosts shows one value:
hpanel, the Hostinger control panel. The
alternative panel names above are reported values
from outside this crawl. The header is
a Hostinger deployment marker, arriving alongside
Platform with the value hostinger on
313 of those hosts, so the pair discloses provider
and control panel together.
Control panel disclosure carries a sharper edge than naming a host. A control panel is an attack surface with its own login and its own vulnerability history, and a response header naming the panel narrows an attacker's search before any probing starts. Removing such headers at the edge is routine hardening, and their continued presence across hundreds of hosts reflects a default nobody changed rather than a decision.