[Golden]

Definitely good advice @Golden, but control panels are very convenient and there's always room for those.  I think one can minimize the potential of security flaws in free panels by making sure one's panel is on automatic updates, and by omitting FTP and e-mail systems from the security panel. I use SFTP and external e-mail hosts instead.  I don't use bind and I don't use FTP with my free control panels as over the years I've learned with cPanel that those are the two systems hackers target the most.  I know one is still vulnerable, but if one does away with those two it is already much safer.

VestaCP got hacked because of the developer's fault. It is opensource and hackers can easily look into the code to find flaws.