netcup Server Control Panel (SCP): what every tab does and what to avoid

2026-10-20 #netcup#vps#server-control-panel

The netcup Server Control Panel (SCP) is where you start, reinstall, snapshot and rescue a netcup VPS or root server. This guide goes through it in the order you will need it: first login, what each tab does, and the few settings that can leave a server unable to boot. It follows netcup's own documentation as of October 2026. Menu names can change, so check netcup's help center if something looks different.

Not a customer yet? The current netcup VPS voucher codes are on the voucher page, and how to redeem a voucher explains the order step.

SCP and CCP are two different panels

netcup has a Customer Control Panel (CCP) for your account, contracts and invoices, and the SCP for the server itself. Everything below happens in the SCP, except booking extra snapshot exports, which netcup's docs place in the CCP.

First login

After the order you receive several emails. According to netcup, the one titled Zugangsdaten SCP has your SCP login. A second one, Ihr vServer bei netcup ist bereit gestellt, has the root password of the server.

Log in to the SCP and change the SCP password first: Account, then Settings, then Account Data, then Change Password. netcup recommends a long, unique passphrase used only for the SCP.
Pick your server from the list on the home page.
Open Screen (lower right bar). That's the VNC console. Log in as root with the password from the email. Don't worry that the password field shows nothing while you type.
Run passwd to set your own root password.

netcup's first-use page says a new server comes with a preinstalled Debian minimal image, a small partition (the rest of the disk you must partition yourself), no LVM, timezone Europe/Berlin and the en-US keyboard layout. If that isn't what you want, reinstall from Media, Images (below) instead of fixing it by hand.

From there, continue with the first 15 minutes checklist: update, add a normal user, SSH keys, firewall.

What each tab does

General

Read-only overview: server name, hostname, nickname, state, uptime, traffic this month, memory, CPUs, boot device, IP networks. netcup asks you to quote the Name or Hostname in support requests. The nickname is only for you. It also shows how many snapshot exports you still have.

Control

Power actions, in order of how gentle they are:

ACPI Shutdown: the recommended way to shut down.
Powercycle: a normal reboot via ACPI.
Reset: a forced restart. netcup warns that data loss may occur; use it only when Powercycle didn't work.
Power Off: a hard shutdown, same warning; use it only when ACPI Shutdown didn't work.
Suspend and Resume: pause and continue the server. netcup says this is no replacement for storing your files properly.

Media

The tab you will use most for risky operations. It has five parts: Disks, Images, Snapshots, DVD Drive and Rescue System.

Images reinstall the operating system. Installing wipes the server's disk. You pick an official image, choose the partition layout, and can import SSH keys stored with netcup, plus timezone and language. netcup recommends the large partition with the OS as root, which gives the system the whole disk. The small-partition layout is for people who want to partition the rest themselves. Afterwards the SCP shows the new root password, and it can email you when the install is done. Custom images (.qcow, .qcow2, .raw) can be uploaded. netcup also says new official images will be UEFI-only. A manual install on BIOS means switching off UEFI Boot in the server settings.

DVD Drive is the other way to install: attach an official or custom ISO, switch on Boot from CD-ROM, then power the server off and on under Control. netcup notes this is more work than using an image.

Disks shows the reserved space and lets you format the main disk (irreversible, and it needs the server stopped). It also has a storage driver setting. netcup warns that changing it is not trivial and in the worst case the server won't boot, so leave it alone unless you know why.

Snapshots

Two types, and the difference matters:

Offline snapshots (netcup's recommendation) are taken with the server off. They can be exported and imported into another netcup server later. The disk of the new server must be at least as large as the partition of the backed-up server.
Online snapshots are taken while the server runs and also save its running state. They can't be exported, can make the server unresponsive for a few minutes, and netcup warns that file changes during the snapshot can cause irreparable data loss.

You can't create a snapshot while an ISO is attached as DVD. Every server includes one free export; more are booked in the CCP. Exports are compressed with zstd. To use one again, decompress it first:

zstd -d snapshot.raw.zst -o snapshot.raw

A snapshot is a quick safety net before a risky change, not a backup strategy. Your data still needs real backups with restic stored somewhere else.

Rescue System

A minimal Linux (netcup uses Grml) that boots independently of your installed system. Use it when the server won't boot or SSH is broken. In short: ACPI Shutdown under Control, then Media, Rescue System, Activate, note the password, and connect over the SCP screen or SSH as root. When it is active the netcup firewall is disabled, and you must deactivate the rescue system manually afterwards, then start the server yourself. Full steps are in netcup's rescue system guide.

Network

Shows the MAC address, the network driver (netcup's recommended default is virtio), and your IPv4 and IPv6 addresses with their gateways. Reverse DNS for each IP is set here: type the hostname next to the IP and click Save. Changing the driver needs a restart.

Settings

netcup's own warning at the top: incorrect settings here can leave the server unable to boot. You can change the boot order (for the rescue system, Network has to come first), CPU topology (only if a licence needs it), the keyboard layout of the VNC console (not of the server), OS optimization, Autostart (starts your server again if netcup restarts its host, for example for maintenance) and UEFI Boot.

Firewall

netcup's free firewall filters incoming and outgoing traffic with policies you assign to a server. According to their docs:

New servers start with all traffic allowed, except sending email. You then create policies and assign them.
It is stateful for TCP only. For UDP you need an ingress and an egress rule, for example for DNS.
It offers basic protection; for advanced features you need your own firewall.
It is available for all server products starting from Generation 9, and older generations are being equipped gradually.

Treat it as an extra layer, not a replacement for the firewall on the server. Remember that Docker publishes ports around ufw, so read Docker ignores ufw. The firewall generator builds the on-server rules.

Log, Statistics, API

Log records significant changes: power actions, boot order changes, snapshots, root password changes, image installs, ISO inserts, rescue system on and off, firewall changes. Useful when a server rebooted and you don't know why.
Statistics graphs CPU, disk IOPS and network packets and traffic for up to 31 days, and exports them as PNG.
API opens the REST API. You can restrict it to IP addresses or CIDR ranges in the REST API security settings; empty means all IPs are allowed.

Locked out of your own server?

Two SCP features help. The Screen console works even when SSH doesn't, so you can fix a bad firewall or sshd change from there; see the SSH hardening post for the usual cases. If the system itself won't boot, use the Rescue System. For a forgotten root password, the SCP has an Access page: with the server powered off, Set Root Password. netcup says that only works on Linux servers with an unencrypted disk.

Next step

Now that you know where things are, secure the server, then put Docker and Caddy on it. Unsure whether a VPS or a root server fits you? See root server vs VPS.