[deanhills]

 But sticking with only terminal via ssh and uploading and downloading files via sftp would be the most secured way to manage a web server if you can protect your ssh server properly so bruteforce hackers won't get into your server.

I use only the bare minimum applications through VestaCP, for example I don't have FTP or e-mail included.  I find that in most cases those are seriously vulnerable features in any panel, not only VestaCP.  That's the beauty of the VestaCP installation script.  VestaCP gives you a template where you can tick what you want and discard what you don't want.