RunCloud alternative: WAF, OpenLiteSpeed and malware scanning in every plan
4 min read
Looking for a RunCloud alternative? Zefily includes the WAF, push-to-deploy, OpenLiteSpeed, the WordPress toolkit and malware scanning in every plan, with a free plan and signed jobs.
RunCloud is a hosted panel for PHP servers with nginx and OpenLiteSpeed stacks. If you are looking for an alternative, the usual reasons are price as you grow and features sitting in higher tiers. Zefily answers both: the core product is in every plan, Free included.
In short
- In Zefily the WAF, push-to-deploy, the WordPress toolkit, OpenLiteSpeed, Node.js, Python and containers are in every plan.
- Free plan for 1 server and 2 sites; paid plans from $8 a month for 3 servers.
- Security beyond the basics: signed jobs, malware scanning with quarantine, vulnerability notices and AI bot blocking.
- Our own nginx build (HTTP/3, Brotli) and PHP 7.3–8.5 even on Ubuntu 26.04.
At a glance
| RunCloud | Zefily | |
|---|---|---|
| Web server | nginx or OpenLiteSpeed | nginx (own build, HTTP/3, Brotli) or OpenLiteSpeed |
| Price | Paid plans; features differ by tier | Free for 1 server and 2 sites, no time limit; from $8/month for 3 servers |
Competitor details are taken from their own pages in October 2026 and may change. Zefily prices are in US dollars, excluding VAT.
What you get with Zefily
Malware scanning with quarantine
ClamAV scans every site's files on demand, daily or weekly, and can move what it finds to a root-only quarantine. Upload scanning checks every file the moment it is written (SFTP, deploys, plugin installs, upload forms) and quarantines infected files at once. Scans need a server with 2 GB of memory, upload scanning 4 GB. More on our security tools.
Vulnerability scans and notices
Installed packages are checked against the OSV database (Debian and Ubuntu advisories), WordPress core, plugins and themes against WPVulnerability, and you are told by email when security updates have been waiting for more than two days or an installed Node.js version has a security release.
Block AI crawlers and countries
One switch per site refuses GPTBot, ClaudeBot, CCBot, PerplexityBot, Bytespider and other AI crawlers while search engines keep indexing; you can also block or allow countries (nginx), block addresses, and turn on the web application firewall (ModSecurity with the OWASP Core Rule Set).
Signed jobs and passkey approvals
Every change to a server is signed by the panel and by a separate signing service on its own machine; risky actions (a root terminal, deleting a site or database, opening a database port) also need your passkey. A stolen session, or even a compromised panel, cannot quietly change your servers. How it works.
A web stack we build and patch
Zefily ships its own nginx build with HTTP/3 and Brotli, and its own signed PHP packages so PHP 7.3–8.5 run even on Ubuntu 26.04 (amd64 and arm64). Security fixes for PHP, nginx, OpenLiteSpeed and PostgreSQL install automatically, and you can switch a running server between nginx and OpenLiteSpeed in place.
More than PHP
WordPress, Laravel and PHP sites run next to Node.js and Python apps, Go, Java, .NET, Ruby, Bun and Deno, rootless containers and Compose files, each as its own Linux user. One-click apps such as Ghost, Nextcloud, Uptime Kuma and Supabase are upgraded one major version at a time, with a backup taken first.
Servers that look after themselves
Failed services (web server, PHP, databases, Valkey, CrowdSec, cron) are restarted automatically, a full disk is cleaned safely, planned maintenance windows silence alerts, and a weekly digest sums up what needs you.
Made for how you work
Free zefily.app addresses to test a site before DNS, an API and CLI, an MCP server so AI agents such as Claude, Cursor or VS Code can deploy and roll back with a token you control, and Feature requests in the panel, where every idea gets a status and an answer from us.
When RunCloud may still be the right fit
If your team already knows RunCloud well and every feature you use sits in your current plan, there may be no reason to move today.
Moving from RunCloud to Zefily
- Connect a server to Zefily: a fresh Ubuntu or Debian server at any provider works best, since Zefily does not take over software it did not install.
- Create the site with the PHP version (or runtime) it uses today.
- Copy the files over SFTP and import the database in the site's database section.
- Test on the site's free
zefily.appaddress before you touch DNS. - Switch DNS; the certificate is issued automatically.
Frequently asked questions
What is a good alternative to RunCloud?
Zefily: a hosted server management panel for PHP, WordPress and modern apps, with nginx or OpenLiteSpeed, a free plan for 1 server and paid plans from $8 a month.
Does Zefily support OpenLiteSpeed?
Yes, in every plan, and a running server can switch between nginx and OpenLiteSpeed in place, switching back by itself if a site stops answering.
Which features are in Zefily's free plan?
Backups, push-to-deploy, the WordPress toolkit, the web application firewall, OpenLiteSpeed, Node.js, Python and container apps, malware scanning, the terminal and file manager, for 1 server and 2 sites.
Can Zefily block AI crawlers?
Yes. One switch per site refuses GPTBot, ClaudeBot, CCBot, PerplexityBot, Bytespider and other AI crawlers while search engines keep indexing.
How do I move my sites from RunCloud to Zefily?
Connect a server to Zefily, create each site, copy files and the database, test on the free zefily.app address, then switch DNS.
Start free with one server: no time limit, and your first site can be live on a free zefily.app address in minutes.