How to Host a Website on a VPS: Beginner Guide | Carpathian
How to Host a Website on a VPS: A Beginner's Guide
Seven steps to host a website on a VPS: pick a server, connect over SSH, secure it, install a web server, upload your site, point your domain, and add HTTPS.
GeneralBy Samuel Malkasian | FounderNovember 9, 20269 min read
To host a website on a VPS, like Carpathian or others, you rent a small virtual server, connect to it over SSH, install a web server like Nginx, copy your site's files into the folder Nginx serves, point your domain name at the server's IP address, and turn on HTTPS with a free certificate. That's the whole job, and on a fresh Ubuntu server it takes about an hour the first time and fifteen minutes every time after.
A VPS, or virtual private server, is your own slice of a physical machine with its own operating system, IP address, and root access. Compared with shared hosting, you get to run whatever you want and nobody else's site can slow yours down. The trade is that you're the administrator now. This guide walks the seven steps in order, says what each one is for, and points at the deeper articles for the commands. If you've never opened a terminal, you can still follow it.
Step 1: What VPS should you pick?
Pick a small Ubuntu server with one virtual CPU, 1 to 2 GB of memory, and 20 GB or more of disk, from a provider that gives you root access over SSH and a plain monthly price. That's enough for a brochure site, a blog, or a small store, and you can resize it later.
What to look for on the provider's page:
Ubuntu as an option. It's the distribution most guides, this one included, are written against.
Root access over SSH with a key. A control panel is fine as an extra. It shouldn't be the only door.
A transfer allowance you can read as a number and a plain statement of what happens past it.
Snapshots or backups. You will break something in step 4, and a snapshot from before you did is the fastest fix.
Any provider that meets those works. Carpathian's smallest instance meets them, with Ubuntu, Debian, CentOS, or Windows Server as the image and SSH from first boot, and the sizing guide is How to Choose a VPS. The one thing a VPS doesn't give you, anywhere, is someone else doing steps 2 through 7. If you'd rather not, managed hosting is the fit and Which Hosting Type Is Best for Small Websites? says when.
Written by
Samuel Malkasian | Founder
Samuel Malkasian is the founder and lead cloud architect at Carpathian, where he designed the platform's core architecture along with a range of client enterprise systems and open-source tools for AI workflows and integration. He serves as a Cyber Warfare Officer in the U.S. Army and has a background in machine learning, data science, and LLM architecture. He is currently focused on building AI infrastructure that is secure, efficient, and sustainable.
Google's AI Overviews can't be switched off, but you can still search without AI answers. Three ways to do it, and how to make one your browser's default.
You connect with SSH, a command that opens a secure terminal on the server from your own computer. On a Mac or Linux machine it's built into the terminal. On Windows it's built into PowerShell. You type one command with the server's IP address and you're in.
When you create the server, the provider shows you its IP address and asks for an SSH public key, or gives you a root password. With a key already set up:
ssh root@203.0.113.10
Replace the address with yours. The first connection asks you to confirm the server's fingerprint, type yes, and you're at a prompt on the server. Everything from here on is typed at that prompt.
If you don't have an SSH key yet, make one first on your own computer with ssh-keygen, accept the defaults, and paste the contents of the .pub file into the provider's key field when you create the server. A key is both safer and less annoying than a password.
Step 3: How do you secure a new VPS?
Before you install anything, make a user account that isn't root, give it permission to run admin commands, turn off password logins over SSH, and turn on the firewall with only SSH and web ports open. That's twenty minutes, and it closes the doors that automated scanners start knocking on within hours of a server going live.
The order:
Update the system.apt update && apt upgrade -y, then reboot if it asks.
Make a user.adduser yourname, then usermod -aG sudo yourname. From now on log in as that user and use sudo for admin commands.
Copy your SSH key to the new user so you can log in as them, then disable root login and password login in the SSH configuration.
Turn on the firewall.ufw allow OpenSSH, ufw allow 80, ufw allow 443, ufw enable. Nothing else is open.
Install fail2ban so repeated failed logins get banned automatically.
The full version, with every command and what each line does, is Initial Server Setup and Hardening on Ubuntu. Do it before step 4, not after. A web server on an unhardened box is the thing the scanners are looking for.
Step 4: How do you install a web server?
Install Nginx with one command, and it starts serving a placeholder page on your server's IP address immediately. Nginx is the program that takes a browser's request and hands back your files. It's small, fast, and the configuration for a static site is about ten lines.
sudo apt install nginx -y
Open http://203.0.113.10 in a browser, with your IP, and you'll see the Nginx welcome page. That confirms the firewall allowed port 80 and the web server is running.
Two notes before you go further:
Static site or application? If your site is HTML, CSS, and images, Nginx serves it directly and you're nearly done. If it's a Node, Python, PHP, or Docker application, Nginx sits in front as a reverse proxy and passes requests to your app. That setup is its own guide: How to Deploy a Web App on a VPS with Nginx and Docker.
WordPress needs PHP and a database beside Nginx. It works on a VPS, and the same reverse-proxy article covers the shape, but a managed WordPress host does those steps for you if that's all the server is for.
Step 5: How do you upload your website?
Copy your site's files into the folder Nginx serves, which by default is /var/www/html, using scp or rsync from your own computer. Then tell Nginx which domain name those files answer to, in a short configuration file called a server block.
From your computer, with your site in a folder called site:
Then on the server, create /etc/nginx/sites-available/mysite with a server block that names your domain and points root at /var/www/mysite, link it into sites-enabled, test with sudo nginx -t, and reload with sudo systemctl reload nginx. The provider's docs and the Nginx docs both have the ten-line example, and once it's in place, a request for your domain serves your files.
Run that rsync again every time you change the site. That's your deploy process, and for a small site it's all the deploy process you need.
Step 6: How do you point your domain at the VPS?
Log in wherever you bought the domain, find its DNS records, and create an A record with your domain name pointing at the server's IP address. Add a second A record for www pointing at the same address. Within minutes to an hour, typing your domain in a browser reaches your server.
What to set:
An A record for the bare domain (@ or blank in most panels) with the server IP.
An A record for www with the same IP, so both forms work.
A low TTL, 300 seconds or so, while you're setting up, so a mistake is quick to fix.
You can check whether it's taken effect with dig yourdomain.com from your computer, or any online DNS lookup. When the answer is your server's IP, step 7 is ready. The detailed version, including what to do about a domain that's still pointing at an old host, is How to Point a Domain to a VPS and Set Up SSL.
Step 7: How do you add HTTPS?
Install Certbot, run it once against your domain, and it fetches a free certificate from Let's Encrypt, configures Nginx to use it, redirects plain HTTP to HTTPS, and schedules the renewal. From then on the padlock is there and you don't think about it again.
Certbot asks for an email for expiry notices, has you agree to the terms, and offers to redirect HTTP to HTTPS. Say yes to the redirect. The certificate renews on its own every sixty days or so through a timer Certbot installs, and sudo certbot renew --dry-run confirms the renewal works.
Step 6 has to be finished first, because Let's Encrypt checks that your domain reaches this server before it issues anything. If Certbot fails, DNS is almost always why.
What should you do after the site is live?
After the site is live, take a snapshot, set up a backup you don't run by hand, and check the memory and disk graphs once a week for the first month. A VPS doesn't maintain itself, and those three habits cover most of what goes wrong on a small server.
The three:
Snapshot now. You have a working server. Capture it before you change anything.
Automate a backup. Nightly, to somewhere that isn't this server. A provider snapshot is a start, and a copy of your site folder and database on a second machine or in object storage is the version that survives the provider having a bad day.
Watch the graphs. Memory above 80% for a sustained stretch means add a gigabyte. Disk filling means find the log that's doing it.
The limitation of everything in this guide is that it's one server. If it goes down, the site goes down until it's back. For a small site that's an acceptable trade for the price and the simplicity. When it stops being acceptable, that's a different architecture and a different article.
