How do you host a website or blog on your own VPS?

Static site, blog engine or WordPress: what changes on the server?

A static site is files that nginx serves; a dynamic one adds a runtime and a database to run, update and back up.

• Static (Hugo, Eleventy, Astro and similar): you build on your computer and copy the output. A few MB of RAM, nothing to patch beyond nginx and the system.
• WordPress: PHP and MariaDB or MySQL. WordPress asks for PHP 8.3 or newer, MariaDB 10.11 or newer or MySQL 8.0 or newer, and HTTPS. Debian 13 ships PHP 8.4 and MariaDB 11.8; Ubuntu 24.04 ships PHP 8.3. Debian 12 ships PHP 8.2, below that recommendation.
• A Node, Python or Go app: it listens on a local port and nginx forwards requests to it.

The steps below start with the static case, then add PHP and the reverse proxy.

Which DNS records do you need?

An A record for the IPv4 address and an AAAA record for the IPv6 address, for the bare domain and for www. Each VPS comes with a dedicated IPv4 address and a routed IPv6 /64. Every plan lists its outbound traffic per month in TB, and going over it never triggers an automatic charge. Both addresses are in your dashboard. Create the records at your DNS provider, then check them from your own computer before asking for a certificate: Let's Encrypt has to reach the server under that name.

dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com A

How do you set up nginx for one site?

One server block per site in /etc/nginx/sites-available/, a link in sites-enabled/, and nginx -t before every reload. Debian and Ubuntu package nginx this way. Remove the default site so a request for the bare IP address does not land on a placeholder page. Give your deploy user ownership of the document root, so publishing never needs root. Open ports 80 and 443 in the firewall; port 80 stays useful for the certificate checks and the redirect to HTTPS.

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

apt install nginx
mkdir -p /var/www/example.com && chown alice:alice /var/www/example.com

ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
rm /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx

ufw allow 80,443/tcp

How do you get HTTPS that renews itself?

Install certbot with its nginx plugin from the distribution, ask for one certificate covering both names, and check that renewal works. Certbot edits the server block to serve HTTPS and can add the redirect from HTTP, and Debian's and Ubuntu's packages install a systemd timer that renews certificates before they expire. certbot renew --dry-run proves the renewal path without touching the real certificate.

Caddy is the other common choice: it obtains and renews certificates on its own for every site name in its Caddyfile. Install it from Caddy's own apt repository, as its documentation shows.

apt install certbot python3-certbot-nginx
certbot --nginx -d example.com -d www.example.com
certbot renew --dry-run
systemctl list-timers | grep certbot

How do you publish updates?

Build on your computer and copy the output with rsync. --delete removes files you deleted locally; run it once with -n to see what it would do. For WordPress, nginx hands .php requests to PHP-FPM; for an app, it forwards requests to the app's local port and passes on the original host name and scheme. Keep the app bound to 127.0.0.1, so only nginx can reach it.

# from your computer
rsync -avz --delete -n public/ [email protected]:/var/www/example.com/
rsync -avz --delete public/ [email protected]:/var/www/example.com/

# WordPress (Debian 13: php8.4-fpm, Ubuntu 24.04: php8.3-fpm)
index index.php index.html;
location / {
    try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.4-fpm.sock;
}

# or an app listening on 127.0.0.1:3000
location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

How does a contact form send email?

Through a mail provider, never straight from the VPS. Outbound port 25 is closed on every VPS and is not opened on request; send mail through a mail provider on port 465 or 587. In WordPress, an SMTP plugin with your provider's host, port and credentials does it; most frameworks take the same three settings in their configuration. Add the SPF and DKIM records your provider gives you, or receiving servers will treat the messages as spam.

How do you back up the site?

Keep what you cannot rebuild somewhere else. No plan includes backups, so keep your own copy of anything that matters.

• Static site: the source in git on your computer, plus a remote, is already the backup. The server is rebuilt from it.
• WordPress: the database and wp-content, which holds uploads, themes and plugins. A nightly dump and copy to another machine, from cron, covers it. Test a restore before you need one.

Which plan fits a website?

Byte for static sites and small blogs, Kilo for WordPress, Mega for several dynamic sites on one server. Traffic rarely limits a small site: a 2 MB page viewed 100,000 times sends 200 GB. Plans connect through a 1 Gbit/s port that the VPS on the same host share.

• Byte (1 vCPU / 2 GB / 40 GB), 2 TB a month: $2.25 a month on a 12-month term, $3.21 month to month.
• Kilo (2 vCPU / 4 GB / 65 GB), 2 TB a month: $4.49 a month on a 12-month term, $6.42 month to month.
• Mega (2 vCPU / 6 GB / 120 GB), 6 TB a month: $6.75 a month on a 12-month term, $9.64 month to month.

Put the site close to its readers: a VPS in the USA or in Europe. Your VPS runs in a data centre in the city you pick, on IP addresses registered in that country (US, GB, NL or DE in the registry whois).