Yes. A VPS can host a production WebSocket server. The most dependable arrangement is to run your application on a private loopback address such as 127.0.0.1:8080, place NGINX on the public interface, terminate TLS there, and proxy authenticated wss:// connections to the backend. You must configure WebSocket upgrade headers, both firewall layers, process supervision, origin policy, and an idle-connection strategy.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a VPS WebSocket deployment actually looks like
A WebSocket server is an ordinary long-running application until a client upgrades an HTTP connection. After the upgrade, the same TCP connection carries messages in both directions without a new HTTP request for every message. That makes WebSockets useful for game lobbies, presence, chat, matchmaking events, live dashboards, and server-pushed notifications.
As an Amazon Associate I earn from qualifying purchases.
A VPS supplies the virtual machine, network interface, storage, and operating-system environment. It does not automatically configure your WebSocket application, TLS certificate, reverse proxy, firewall, or service restarts. You are responsible for those layers.
For most public deployments, use this traffic path:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- A DNS record points
ws.example.comto the VPS address. - NGINX accepts public traffic on ports 80 and 443.
- NGINX terminates TLS for
wss://ws.example.com/.... - NGINX forwards the upgraded connection over plain HTTP to
127.0.0.1:8080. - Your WebSocket process runs as an unprivileged service account under systemd.
Keeping the application on loopback means the backend port is not directly reachable from the internet. The public-internet guidance for websocketd describes loopback binding as the usual choice when a reverse proxy fronts the service: nothing else can reach the backend listener directly.
NGINX has supported this tunnel mode since version 1.3.13. Its documentation describes a special operating mode that sets up a tunnel between a client and a proxied server. The tunnel only works when the HTTP upgrade is explicitly passed through.
Requirements before you start
- A VPS or cloud virtual machine with an operating system you can administer.
- A DNS name whose record can point to the VPS public address.
- A WebSocket application that can listen on a chosen local port, such as 8080.
- Administrative access for initial package installation, firewall configuration, and service creation.
- A TLS certificate and private key for the DNS name. The example below uses the conventional Let’s Encrypt paths.
- Access to both firewall layers: the operating-system firewall and the provider’s network firewall or security group.
- An external WebSocket client for handshake, authentication, reconnect, and idle-connection checks.
Do not assume that a VPS provider’s network rules and your host firewall are the same control. A connection can be blocked by either one. Google’s Compute Engine WebSocket example, for instance, creates an instance and separately adds a rule allowing TCP port 8000.
Step 1: Provision the VPS and point DNS
Choose the machine around workload, not a connection-count promise
No authoritative source publishes one universal concurrent-connection number for “a VPS.” Capacity depends on the VM’s CPU and memory, the WebSocket implementation, message rate, payload size, TLS overhead, kernel limits, and what each connected client does. Start with a measured workload and record the limits of the selected VM rather than repeating a generic connection figure.
Assign a stable public address when your provider offers one. Create a DNS record such as ws.example.com pointing to that address, then wait for the record to resolve before requesting a certificate. If the service will share a machine with a website, use a separate hostname or a distinct NGINX location so routing is unambiguous.
Open only the public entry points
At the provider firewall or security-group layer, allow TCP 80 if you need HTTP certificate issuance or redirects, and TCP 443 for secure WebSockets. Allow SSH only from the administration networks that need it. Do not open the backend port 8080 to the internet when NGINX is in front. Mirror the same policy in the VPS host firewall.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Step 2: Run the WebSocket application on loopback
Configure the application to listen on 127.0.0.1:8080, or another high local port that you reserve for this service. Binding to loopback is important: it prevents an accidental firewall rule from exposing a second, unencrypted public entry point.
Keep the application protocol plain HTTP on the loopback hop unless the application itself must terminate TLS. TLS between NGINX and a loopback process adds certificate and configuration work without protecting traffic that never leaves the host. The client-facing connection remains encrypted as wss://.
Before adding NGINX, verify that the process starts and that it responds on the local port. Use the application’s own health endpoint or a WebSocket-capable client from the VPS. A local success proves only that the backend is running; it does not prove DNS, TLS, firewall, or proxy configuration.
Step 3: Create a supervised, unprivileged service
Run the backend under a dedicated non-root account. Process supervision prevents a crash from becoming a silent outage and makes startup behavior predictable after a reboot. The recommended policy is a systemd unit with Restart=on-failure.
Recommended Free Tools
An illustrative unit looks like this; adapt the executable, working directory, and environment to your application:
[Unit]
Description=WebSocket application
After=network-online.target
Wants=network-online.target
[Service]
User=wsapp
WorkingDirectory=/srv/wsapp
ExecStart=/srv/wsapp/bin/server --listen 127.0.0.1:8080
Restart=on-failure
[Install]
WantedBy=multi-user.targetAfter saving the unit, reload systemd, enable it at boot, and start it. Use journalctl -u <service> to inspect startup failures, permission errors, bind errors, and application crashes. Keep secrets in a protected environment file or secret-management mechanism rather than placing them directly in a world-readable unit.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Step 4: Configure NGINX for the WebSocket upgrade
HTTP/1.1 upgrade headers are hop-by-hop headers. A reverse proxy does not forward them automatically, so a normal HTTP proxy configuration can produce a failed handshake even when the backend is healthy. NGINX requires HTTP/1.1 plus explicit Upgrade and Connection headers.
Place the connection map in the NGINX configuration’s http context, then use the server block for the WebSocket hostname:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 443 ssl;
server_name ws.example.com;
ssl_certificate /etc/letsencrypt/live/ws.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ws.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_read_timeout 3600s;
}
}The map preserves ordinary HTTP behavior when no upgrade is requested and sends Connection: upgrade for a WebSocket handshake. proxy_http_version 1.1 is required for the upgrade mechanism. Passing the original Host header lets the application apply host-based routing or origin checks consistently.
Run NGINX’s configuration test before reloading it. A syntax error should be fixed before the reload; otherwise the old configuration may continue serving while you believe the new one is active. After a successful reload, confirm that NGINX can read the certificate and reach the loopback port.
Step 5: Add TLS and expose wss://
Clients should use wss://your-domain.example/... in production. Terminating TLS at NGINX centralizes certificate management and leaves the application with a simple local HTTP connection. The certificate’s hostname must match the DNS name clients use.
Port 80 is commonly retained for certificate issuance and an HTTP-to-HTTPS redirect; the WebSocket client should ultimately connect to 443. If you use a nonstandard public TLS port, that port must be allowed in both firewall layers and included in the client URL.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Do not confuse a successful HTTPS page request with a successful WebSocket handshake. The handshake must return the WebSocket switching response and preserve the upgraded connection. Test the exact path, hostname, authentication headers, and origin that your game or client will send.
Step 6: Test the complete path from outside the VPS
- Resolve the DNS name from an external network and confirm it returns the VPS address.
- Check that TCP 443 is reachable while the backend port 8080 remains unreachable from the same external network.
- Connect with a WebSocket client to
wss://ws.example.com/.... - Confirm the server receives the expected path, headers, authentication data, and origin.
- Exchange messages in both directions and verify that a server push reaches the client without a polling request.
- Stop the backend temporarily and confirm systemd restarts it; inspect
journalctl -u <service>for the event. - Leave a connection idle for longer than the expected quiet period, then verify that heartbeat or ping traffic keeps it open.
- Force a client network change or process restart and confirm the client’s reconnect logic behaves safely.
These checks distinguish a DNS or firewall problem from an upgrade-header problem, an application authentication problem, and an idle-timeout problem. Test from outside the VPS because a local loopback test bypasses the public network and proxy.
Why idle WebSocket connections disconnect
proxy_read_timeout is an idle timer, not a maximum lifetime. NGINX documents a 60-second default when the proxied server sends no data. If your application sends nothing for longer than that interval, NGINX can close an otherwise healthy connection.
Set the timeout above the longest expected period of silence, as in the example’s 3600s, and still implement an application-level heartbeat. A longer proxy timeout is not a substitute for detecting half-open mobile or home-network connections.
Heartbeat choices
- Use WebSocket ping frames at a regular interval shorter than the shortest idle timeout in the path.
- Have the client answer with pong frames according to the protocol and treat missed responses as a reconnect condition.
- If your framework does not expose protocol ping frames, send a small application heartbeat message and make both sides recognize it.
- Ensure heartbeat traffic is frequent enough for NGINX and any intervening network device, but not so frequent that thousands of clients create unnecessary CPU or bandwidth load.
Record disconnect reasons and timestamps. A burst of closures at nearly the same idle interval points toward a proxy or firewall timer; random closures under load point toward resource pressure, process failure, or network instability.
Security controls that matter on a public VPS
Limit network exposure
- Bind the backend to loopback when NGINX fronts it.
- Expose 443 publicly and keep 80 only when required for redirects or certificate workflows.
- Restrict SSH and other management ports to trusted source networks.
- Apply the policy in the provider firewall or security group and in the host firewall.
Validate the origin
WebSockets carry cookies and other browser credentials, so an origin policy is part of the application’s security model. Choose an allowlist that matches the sites permitted to open connections. websocketd documents an --origin option for strict origin matching. Do not treat the browser’s origin header as authentication; require the application’s own session or token checks as well.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Protect the service account and secrets
Use a non-root account with only the file and network permissions the process needs. Keep private keys readable only by the account that must use them. Log authentication failures and rate-limit expensive actions at the application layer. NGINX can protect the public edge, but it cannot decide whether a game action is authorized.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Deployment options compared
| Decision area | Common VPS arrangement | Alternative | Trade-off |
|---|---|---|---|
| TLS termination | NGINX terminates TLS; backend uses loopback HTTP | Application terminates TLS directly | NGINX centralizes certificates and routing. Direct termination removes one proxy layer but moves certificate and upgrade handling into the application. |
| Public exposure | Only NGINX is public; application binds to loopback | Application listens on a public port | Loopback reduces accidental exposure. A direct listener is simpler only when you intentionally manage its TLS, firewall, and hardening yourself. |
| Process supervision | systemd with Restart=on-failure |
Manual process or a container supervisor | systemd integrates with boot and journal logs. Other supervisors can fit containerized workflows but still need restart and logging policies. |
| Idle handling | Raised NGINX timeout plus protocol ping/pong | Application messages only or default timeout | Heartbeats keep connections observable and prevent idle expiry. A default timeout can close quiet clients after about 60 seconds. |
| Firewall | Provider security group plus host firewall | Only one layer configured | Two layers provide defense in depth; either layer can also block legitimate traffic if misconfigured. |
| Scaling | One VPS while measured capacity is adequate | Multiple instances behind a load balancer | A single host is operationally simple. Multiple hosts require connection distribution, shared authentication state where needed, and coordinated deployment. |
There is no universally correct row in this table. Select the arrangement that matches your operational skills, failure tolerance, and measured workload.
Capacity planning and growth
WebSocket connections consume memory even when idle, while active message traffic consumes CPU, bandwidth, and application-specific resources. A presence server that sends tiny updates has a different profile from a relay that broadcasts large game-state messages.
Measure at the VPS size you intend to run. Increase the number of idle and active clients gradually, record CPU, memory, file descriptors, network throughput, event-loop latency, and message-delivery latency, and identify the first resource to saturate. Repeat the test after changing TLS settings, heartbeat frequency, payload size, or application logic.
When one VPS is no longer sufficient, adding instances is not merely a DNS change. Existing WebSocket connections remain attached to the process that accepted them. A load balancer must distribute new handshakes, and any state required by more than one process needs a shared design or deliberate session affinity. The consulted primary guidance does not publish a general connection limit, so your own workload measurements are the authoritative capacity signal.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshooting failed handshakes and disconnects
| Symptom | Likely layer | Checks and fix |
|---|---|---|
| DNS name does not resolve | DNS or address assignment | Verify the record points to the current VPS address and allow propagation before testing TLS. |
| Connection times out | Provider or host firewall | Confirm TCP 443 is allowed in both firewall layers. Ensure NGINX is listening on the expected address and port. |
| HTTP works but WebSocket upgrade fails | NGINX proxy | Confirm HTTP/1.1, Upgrade, and Connection directives are present and that the request reaches the correct location. |
| 502 Bad Gateway | Backend process or local routing | Check systemd status and journalctl -u <service>; verify the application is listening on 127.0.0.1:8080 and that NGINX can reach it. |
| TLS warning or hostname error | Certificate or DNS | Use a certificate covering the exact hostname in the client URL and confirm NGINX is reading the intended certificate and key. |
| Disconnects at nearly one minute | Idle timeout | Raise proxy_read_timeout above the expected silence and send periodic ping/pong or heartbeat traffic. |
| Authentication succeeds locally but fails publicly | Host, origin, or proxy headers | Inspect the forwarded host, origin, path, and authorization data. Align the application’s origin policy with the real client origin. |
| Backend port is reachable from the internet | Binding or firewall mistake | Bind the service to loopback and remove public rules for port 8080. Retest from an external network. |
A practical operating checklist
- DNS resolves to the intended VPS address.
- NGINX listens on 443 with a valid certificate for the WebSocket hostname.
- The application listens only on loopback when NGINX is the public edge.
- NGINX uses HTTP/1.1 and forwards both upgrade headers.
- Port 8080 is not exposed by either firewall layer.
- The provider firewall and host firewall both allow the required public ports.
- The service runs as an unprivileged account and restarts on failure.
- Origin and authentication policies match the actual game clients.
- Heartbeat traffic is shorter than the strictest idle timeout.
- External tests cover handshake, message exchange, authentication, reconnect, and idle behavior.
- Monitoring records process restarts, handshake failures, active connections, disconnect reasons, and resource saturation.
Bottom line
A VPS is a suitable home for a WebSocket server in 2026. Use the VPS as the compute layer, keep the application on loopback, let NGINX handle public TLS and the HTTP upgrade, protect both firewall layers, supervise the process with systemd, and send heartbeats so idle connections remain healthy. Treat concurrency as a workload-specific measurement rather than a fixed VPS specification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
