Setup guide / VPS

How to set up a VPS in 2026

A VPS is not production ready when it boots. It needs SSH keys, a non-root admin user, firewall rules, updates, a web stack, DNS, SSL, backups, monitoring, and a tested restore path.

By WebHostWatch editors Updated April 26, 2026

Use this guide when you control the server. If your host provides a managed shared or WordPress panel, use the web hosting setup guide instead.

Difficulty: Intermediate
Images: 17 local WebP sources
Time: 90 to 180 minutes

VPS setup map

The first hour decides whether the VPS becomes stable infrastructure or an unmanaged liability. Build the access, security, backup, and rollback path before publishing the site.

Size

Choose a plan with enough CPU, RAM, NVMe disk, bandwidth, and backup budget.

Create

Create the server with SSH keys, correct region, provider firewall, and backups selected.

Harden

Create a sudo user, patch packages, enable firewall rules, and protect SSH.

Stack

Pick managed panel, CloudPanel, HestiaCP, or manual Nginx based on your maintenance ability.

Publish

Point DNS, issue SSL, test HTTP and HTTPS, and verify redirects.

Operate

Add monitoring, off-server backups, restore testing, and update notes.

1. Create the server with production settings

Pick a size that leaves headroom

For a small WordPress or PHP site, 2 vCPU and 4 GB RAM is a safer starting point than the cheapest 1 GB instance. For WooCommerce, multiple active sites, or image-heavy publishing, budget more memory and disk before you migrate.

Kamatera VPS hosting page — Kamatera VPS hosting: Configurable VPS providers require buyers to document CPU, RAM, disk, location, backup, and support choices.

DigitalOcean production ready Droplet setup — DigitalOcean production Droplet setup: DigitalOcean frames the first VPS tasks around SSH keys, non-root access, firewalls, backups, and monitoring.

Create with SSH keys, not password-only login

Add an SSH public key during server creation. Password login is easier to brute-force and should not be the default path for a public server.

ssh-keygen -t ed25519 -C "[email protected]"
# Upload the .pub key to the VPS provider before creating the server.

DigitalOcean SSH key setup section — DigitalOcean production Droplet setup: SSH key access should be created before the server becomes production infrastructure.

Hetzner creating a server documentation — Hetzner create a server: The server creation screen is where image, location, resources, SSH key, and firewall choices start.

2. First login, sudo user, and package updates

Keep the original root session open until you verify a second SSH login works with the new sudo user.

ssh root@SERVER_IP
adduser deploy
usermod -aG sudo deploy
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy
ssh deploy@SERVER_IP

Warning

don't close the root terminal until `ssh deploy@SERVER_IP` works from a separate terminal. This avoids locking yourself out.

Hetzner connect to server documentation — Hetzner connect to server: Record the login method and initial IP address before changing firewall rules.

Hetzner SSH commands documentation — Hetzner connect to server: Keep SSH access tested from a second terminal before closing the first session.

3. Firewall, updates, and exposed ports

Use provider firewall and server firewall together

The provider firewall blocks traffic before the server. The server firewall protects the operating system if provider rules change later. Start with SSH, then add HTTP and HTTPS only when the web stack is ready.

sudo apt update && sudo apt -y upgrade
sudo apt -y install ufw unattended-upgrades
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

DigitalOcean cloud firewall quickstart: Cloud firewalls protect the server before traffic reaches the operating system.

DigitalOcean firewall rule section — DigitalOcean cloud firewall quickstart: Open SSH only to your IP when possible, then expose HTTP and HTTPS after the web stack is ready.

Hetzner Cloud firewalls documentation — Hetzner Cloud firewalls: A provider firewall gives a clean rollback path if the server firewall is misconfigured.

Patch before you install the app stack

Update the base image first, then install the control panel or web stack. If the VPS image is old, installing panel software before package updates can create dependency problems.

DigitalOcean firewall notes in production setup — DigitalOcean production Droplet setup: Provider firewall and server firewall should both be understood before exposing ports.

Hetzner server creation options — Hetzner create a server: Region, image, SSH key, and firewall are operational choices, not cosmetic settings.

4. Choose the web stack you can maintain

Managed VPS or SPanel

Best when you want VPS resources but don't want to own every OS, malware, and panel task yourself.

CloudPanel

Best for lean PHP, WordPress, and Nginx hosting when email and DNS live outside the server.

HestiaCP

Best for a free traditional panel with web, DNS, mail, and Apache compatibility in one stack.

Manual Nginx

Best for engineers with repeatable configuration, monitoring, backups, and incident response habits.

# Example manual stack starting point for Ubuntu
sudo apt -y install nginx mariadb-server php-fpm php-mysql certbot python3-certbot-nginx
sudo systemctl enable --now nginx mariadb

CloudPanel getting started documentation — CloudPanel getting started: CloudPanel is a VPS control panel path when you want PHP hosting without cPanel licensing.

CloudPanel WordPress documentation — CloudPanel WordPress docs: A control panel can create the site, but it doesn't remove the need for backups and DNS checks.

HestiaCP getting started documentation — HestiaCP getting started: HestiaCP is the traditional free panel route when email, DNS, Apache, and Nginx belong in one stack.

5. Point DNS, issue SSL, and test redirects

After the web stack responds on the server IP, point the domain. Use an A record for the root domain, a CNAME for www when appropriate, and then issue SSL after DNS resolves to the new server.

dig +short example.com
curl -I http://example.com
sudo certbot --nginx -d example.com -d www.example.com
curl -I https://example.com

DigitalOcean DNS quickstart: DNS is part of VPS setup even when the server itself is already running.

ScalaHosting SPanel getting started documentation — ScalaHosting SPanel getting started: Managed VPS plus a control panel is a middle path between shared hosting and raw Linux administration.

6. Backups, monitoring, restore test, and launch

The VPS is ready only after you can recover it. Store backups off-server, document restore steps, install monitoring, and set alerts for disk, memory, CPU, HTTP status, SSL expiry, and backup failure.