How to host a website on a VPS, step by step

Is a VPS the right place for your site

A static site (plain HTML, CSS and JavaScript, or the output of a generator such as Astro, Hugo or Eleventy) can be hosted almost anywhere, including free static hosts. A VPS makes sense when you want one server for several sites, need to run your own backend or database next to the site, want full control of headers and redirects, or simply want to learn how hosting works.

If you only need one simple page and never want to touch a terminal, a static host or shared hosting is the easier choice. Do not rent a VPS just because it sounds more serious.

Step 1: pick the plan and the operating system

For a static site the smallest plan is enough, so compare providers on location, reliability and renewal price rather than on raw specs. Choose a data center near most of your visitors.

For the OS, take a current long-term-support release of Ubuntu or Debian. Both have the most tutorials and receive security updates for years. When the provider asks, choose a plain OS image, not a prebuilt app image, unless you want that exact app.

Step 2: secure the server before anything else

A new public server starts receiving login attempts within minutes, so do these steps first.

• Create a normal user with sudo rights and stop working as root.
• Generate an SSH key pair on your computer (`ssh-keygen`), copy the public key to the server (`ssh-copy-id`) and turn off password logins in the SSH configuration.
• Enable a firewall such as UFW and allow only SSH (22), HTTP (80) and HTTPS (443).
• Turn on automatic security updates (the `unattended-upgrades` package on Ubuntu and Debian).
• Optionally install Fail2ban to ban addresses that keep guessing logins.

Step 3: install a web server and connect your domain

Nginx is the classic choice: install it with your package manager, put your files in a folder such as `/var/www/yoursite` and add a short server block that points to it. Caddy is simpler for beginners because it obtains and renews HTTPS certificates by itself from a two-line configuration file. Either one is fine for a static site.

Then point your domain at the server. In your registrar's or DNS provider's panel create an A record for the root domain (and one for `www`, or a CNAME to the root) with your server's IPv4 address. If the server has IPv6, add an AAAA record too. DNS changes can take from a few minutes to a few hours to spread.

Step 4: HTTPS and deploying the site

With Caddy, HTTPS is automatic once DNS points to the server. With Nginx, install Certbot, run it for your domain and let it edit the configuration; it sets up automatic renewal for the free Let's Encrypt certificate. Check that port 80 and 443 are open, or issuing the certificate will fail.

To deploy, build the site on your computer and copy the output folder to the server with `rsync` or `scp`. Later you can automate this with a Git hook or a CI job. Always upload to a folder your web server user can read, but not write.

Updates, backups and when a panel is easier

A static site has a small attack surface, but the server underneath still needs care. Keep the operating system and the web server updated, and watch the certificate renewal logs once after setup.

• Keep your site in a Git repository, so the source of truth is not the server.
• Take a provider snapshot before big changes, and keep a copy of configuration files off the server.
• Test a restore once on a spare server, because an untested backup is only a hope.
• If you would rather click than type, a free control panel such as CloudPanel or HestiaCP sets up sites, certificates and databases from a browser. It uses some RAM, so leave headroom on the smallest plans.
• When NOT to do this: if the site earns money and nobody on your team can fix a broken server at night, use managed hosting.