How to Create an SMM Panel Website: Script, Hosting and Setup

To create an SMM panel website you need four things: a domain, the panel software, at least one API provider to fulfil orders, and a way to take payments. You can rent the software as a child panel, use a hosted platform, or install your own PHP script on web hosting. Below we compare the three and walk through a self-hosted setup.

How an SMM panel works: you, your providers and your customers

An SMM (social media marketing) panel is a reseller storefront. Customers add funds to a balance on your website, pick a service, paste a link and place an order. Your panel passes the order to a provider through an API, the provider delivers it, and your panel checks back for the status.

• Providers are larger panels that sell wholesale through an API. You keep a prepaid balance with each.
• Your panel holds your services, prices, customer accounts and balances, and talks to providers on a schedule.
• Your customers order on your website. Some are resellers who order through your panel's own API.

Your business is the margin between what providers charge you and what you charge, plus quick support and refills when counts drop.

Three ways to start: a child panel, a hosted platform or your own script

Child panel

You rent a ready-made panel from an existing panel (the "parent"), point your domain where it tells you and pay its fee. Services come from the parent. There is almost no technical work, but if the parent raises prices, has delivery problems or closes, your panel suffers too.

Hosted platform

Platforms such as Perfect Panel run the software and servers for you on your own domain. As of October 2026 its website says hosting and SSL are included, you can connect your own provider APIs, and the monthly fee rises with the number of orders you process.

Your own script

You buy a script, install it on hosting under your domain and connect any providers you like. You own the code and data, but installation, updates and security are your job.

If you have never run a website, a child panel is the cheapest way to learn the business. Move to your own script once you have regular customers. HostEthical sells domains, hosting and VPS servers only, not panel scripts, provider accounts or payment gateways.

What a self-hosted panel needs: domain, PHP, MySQL, SSL and cron

• A domain. Short and easy to spell beats clever, and a .com suits an international customer base. See how to choose a domain name and how to buy one; free WHOIS privacy hides your personal details where the registry allows it.
• PHP and MySQL. Most panel scripts are PHP applications with a MySQL database. One widely sold script lists PHP 7.2 to 8.2, yet php.net shows security support for PHP 8.2 ending on 31 December 2026, so ask about PHP 8.3 or newer before you buy. Our hosting offers PHP 8.1 to 8.5 per website, with 8.3 as the default.
• A compatible web server. Many scripts list Apache and mod_rewrite because their URL rules live in an .htaccess file. HostEthical hosting runs nginx, which ignores .htaccess, so ask the seller whether the script runs on nginx.
• SSL. Logins and payment pages must be on HTTPS. A free Let's Encrypt certificate is issued automatically once your domain points at the server; see what an SSL certificate is.
• A way to send email for sign-ups and password resets. Our hosting servers block outgoing SMTP ports (25, 465, 587 and 2525), so the script must send through an email service's HTTPS API, not SMTP or PHP mail(); see why websites don't send email.
• Cron jobs to send orders and sync statuses, covered below.

Choosing a script safely, and why nulled scripts are a trap

Buy from the developer or a marketplace, and check the licence. On CodeCanyon, Envato's licence terms say an Extended licence is required if the end user must pay to use the end product. Envato's FAQ is less clear-cut when customers pay for a separate service, but one popular script's listing says you need the Extended licence if you charge users for access or services, so ask the seller in writing which one you need.

In October 2026 most SMM panel scripts there were listed at $19 to $49, but that script charged $29 for a Regular licence and $169 for an Extended one. Also check the last update date, PHP range, nginx support, email options and how long support lasts.

Encoded scripts. Some sellers encode their PHP with ionCube, which needs the ionCube Loader on the server. ionCube's release notes tie each loader to particular PHP and encoder versions, so an encoded script can lock you to an older PHP. On our shared hosting, check with support first; on a VPS you can install the loader yourself.

Nulled scripts. A "nulled" script is a paid script with its licence check removed, shared for free. Security firm Sucuri examined a nulled theme from a top search result and found a hidden webshell that could send the site's database credentials to a remote server. Your panel's database holds customer balances and the provider API keys that spend your money, and nulled code gets no updates. Never use one.

How to create an SMM panel step by step: upload, database, installer and admin login

Whether you searched "how to make an SMM panel website" or "SMM panel kaise banaye", the steps for a self-hosted panel are the same:

1. Add your domain to your hosting and point it at the server with an A record or our nameservers (see how to connect a domain to hosting). SSL follows once the domain resolves.
2. Set the site's PHP version to the newest one the script supports. If the installer asks, raise the memory limit, upload size or max execution time (up to 120 seconds) in the PHP settings.
3. Create a MySQL database and user in the hosting dashboard, and note the name, username and password.
4. Extract the script's zip on your computer, then upload the files into the site's folder with SFTP or the File Manager, including hidden files (names starting with a dot).
5. Run the installer by opening your domain in a browser. It usually asks for the database details, your purchase code and the first admin account.
6. Clean up and log in. Delete the install folder if the script says so, then set your panel's name, currency, time zone and terms.

If a requirements check fails, send the installer's message to our support.

Setting up cron jobs for order status sync and refills

Cron jobs send pending orders to providers, fetch status updates, release drip-feed runs, refresh the service list and check refills. One widely sold script's documentation lists six cron jobs in its main setup, plus extras for refills and crypto payments, and recommends running each every minute.

On HostEthical shared hosting you can add up to 20 cron jobs, each running at most every 5 minutes. There is no every-minute cron, so new orders reach your provider and statuses refresh within about five minutes. If customers expect orders to start instantly, or the script insists on every-minute sync, use a VPS, where you set the schedule.

Copy each command from your script's documentation and set the schedule to every 5 minutes. A URL-style job looks like this:

*/5 * * * *   curl -s "https://yourpanel.com/cron/order?key=YOUR_CRON_KEY" > /dev/null 2>&1

If the script offers command-line jobs, prefer them: a URL job is handled like a visitor's request, so a slow sync ties up one of your plan's PHP workers. Refresh the service list hourly, and keep the cron key secret.

Connecting API providers and setting your prices

Most panels use a similar API, often called API v2, with actions to list services, add an order, check its status, request a refill and check your balance. To connect a provider:

1. Open an account with the provider, add a small balance and copy its API URL and key.
2. Add the provider in your admin area and import the services you want to sell.
3. Set your price per 1,000. For example, if a provider charges you ₹40 per 1,000 and you sell at ₹60, your margin is ₹20 before payment fees, refunds and refills.
4. Place the smallest possible test order on every service before you list it.

Many providers bill in US dollars, so review your rupee prices when the exchange rate moves. Read each service's refill terms, keep a second provider for your best sellers, and treat API keys like passwords: a leaked key spends your balance. We don't recommend providers; judge them by track record, support and test orders.

Taking payments: what gateways allow and what they don't

Payment gateways review your website and business before activating your account, so read each one's prohibited list first:

• Stripe's list (updated 22 September 2026) puts "sales of online traffic or engagement" among the prohibited businesses it does not support.
• Razorpay's terms (as of October 2026) don't name SMM services, but its prohibited list includes broad catch-alls, such as any product or service that its partner bank or acquiring bank considers detrimental to the bank's image and interests, and Razorpay can update the list on instructions from its banks and other payment partners.

No gateway owes you an approval, and describing your business as something else to get one is how settlements get frozen and accounts closed. Some owners take UPI or bank transfers and credit balances by hand, or use crypto payment processors, which have their own terms. Because orders deliver instantly, stolen-card chargebacks are a real risk, so set sensible deposit limits. Ask a chartered accountant about tax and records, and see payment gateway website requirements.

Platform rules

YouTube's fake engagement policy says it doesn't allow "anything that artificially increases the number of views, likes, comments, or other metrics", and violations can lead to content removal, strikes and channel termination. Meta's spam policy, part of the Community Standards covering Facebook, Instagram, Messenger and Threads, prohibits selling, buying or exchanging engagement such as likes, shares, views and follows.

That is why counts drop and refills exist, and why your customers' accounts carry risk. Whether running a panel is lawful where you and your customers live is a question for a lawyer; this guide is not legal advice.

Keeping the panel safe: backups, malware scans and a protected admin area

Every customer balance and order lives in your database, so protect it:

• Backups. HostEthical hosting takes nightly backups and keeps the last 7, with one-click restore. Take your own before every script update, and keep a copy off the server.
• Malware scans and updates. Run the dashboard's malware scan. Try the seller's updates on a staging copy with its provider API keys removed, then update the live panel itself: publishing the staging database back would overwrite orders and balances placed since the copy was made.
• The admin area. Use a long, unique password and two-factor login if the script offers it. If the admin area sits in its own folder, password-protect it from the dashboard, and block IP addresses that hammer your login page.
• Secrets. If you edit the panel over SSH and Git, for example with an AI coding tool, keep provider and gateway keys out of your repository.

Real monthly costs, and when to move to a VPS

On shared hosting, Starter is enough for one new panel; Business adds a second PHP worker, which helps when cron jobs and customers are busy at once. Move to a VPS as the panel grows: when the script needs every-minute cron, when the resource graphs show you near your limits, when you need software you install yourself or SMTP email (on a VPS you control the firewall), or when you run several panels.

A HostEthical VPS gives you full root access and a dedicated IPv4 address. It is unmanaged, so read managed vs unmanaged VPS and our VPS setup guide first. Germany is included in the plan price; Mumbai adds a monthly location fee, worth considering if most customers are in India. Still deciding? Compare VPS vs shared hosting, or contact us.

Frequently asked questions

How much does it cost to start an SMM panel in India?

A child panel needs only a domain plus the parent panel's fee. A self-hosted panel needs a domain, a hosting plan, a one-time script licence and a prepaid balance with your providers. In October 2026 most SMM panel scripts on CodeCanyon were listed at $19 to $49, but a seller may require the more expensive Extended licence for a panel whose customers pay, so check the listing before you buy.

Can I run an SMM panel on shared hosting?

Yes, for a new panel with modest order volume, if the script supports a current PHP version and runs on nginx (check with our support first if it is encoded with ionCube). On HostEthical shared hosting, cron jobs run at most every 5 minutes and outgoing SMTP is blocked, so email must go through an email service's HTTPS API. Move to a VPS if the script needs every-minute cron or your volume grows.

What is the difference between a child panel and your own SMM panel?

A child panel is rented from a parent panel, which supplies the software and the services. You bring a domain and pay its fee. Your own panel runs a script you install on your own hosting, so you choose providers and control the code and data, but you handle setup, updates and security.

Is running an SMM panel allowed? What platform and payment-gateway rules apply?

YouTube's fake engagement policy and Meta's spam policy both prohibit artificially inflating, buying or selling engagement, and Stripe lists sales of online traffic or engagement as a prohibited business. Other gateways, such as Razorpay, don't name SMM services but keep broad catch-all clauses, so read their prohibited lists before you apply. Ask a lawyer about the law where you operate; this is not legal advice.