Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
VGSources
Blog

How to Configure a Linux VPS as a Full Web Server

Turn an Ubuntu VPS into a production web server: harden SSH, configure UFW, choose nginx or Apache2, create a site, point DNS, automate Let’s Encrypt renewal, and operate the host safely.
Length13 min Posted Quest giverVGSources Team

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To turn a Linux VPS into a production web server, secure the operating system first, install one web server, create an isolated site configuration, point DNS to the VPS, enable HTTPS, and then add only the runtimes and data services your application actually needs. A static game community site may need only nginx or Apache2, files, DNS, TLS, and logs; a dynamic API or control panel may also require PHP-FPM, Node.js, Python, a database, queues, monitoring, and backups.

This guide uses Ubuntu conventions and shows both nginx and Apache2 paths. The commands assume a current supported Ubuntu release, a VPS with a public IPv4 or IPv6 address, console or recovery access, and an account that can use sudo.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What “full web server” means on a VPS

A VPS is an internet-connected virtual machine, not a finished hosting service. You are responsible for its operating-system updates, users, firewall, web-server configuration, application processes, certificates, logs, backups, and recovery plan.

The correct stack depends on the workload:

  • Static site: HTML, CSS, JavaScript, images, a web server, DNS, TLS, and logs.
  • PHP application: everything above plus PHP-FPM and often MySQL or PostgreSQL.
  • Node.js, Python, Ruby, or another application: a runtime, a process manager or service unit, a reverse proxy, application logs, and usually a database or queue.
  • Game-related backend: authentication or account services, leaderboards, webhooks, asset downloads, and administrative endpoints may need separate processes and stricter network boundaries than a brochure site.

Do not install every component in a traditional “full stack” by default. Each additional daemon increases patching, configuration, and attack-surface work.

#1 Best Overall
Sale
Gaoye Blue Light Blocking Glasses
  • BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
  • EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
  • COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
  • LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
  • WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

Prepare access and a recovery path

Verify the prerequisites

  • A supported Linux distribution, such as a currently maintained Ubuntu Server release.
  • A public IP address and control of the domain’s DNS zone.
  • Working SSH credentials with a tested key or another authentication method.
  • Provider console, serial console, or recovery access before changing firewall or SSH settings.
  • Enough storage for the operating system, site files, logs, databases, and backups. Leave free space for package upgrades and log rotation.

Record the VPS address, SSH port, provider console path, DNS provider, and the person responsible for recovery. Keep an existing SSH session open while testing a new configuration; do not close the only known-good session until the replacement path works.

Create a named administrative user

Log in with the provider’s initial account, create a named user, and grant only administrative access through sudo. Replace adminuser with your chosen name:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo adduser adminuser
sudo usermod -aG sudo adminuser

Open a second terminal and confirm that the new account can log in and run a harmless privileged command:

ssh adminuser@SERVER_IP
sudo -v
sudo id

Use separate, unprivileged service accounts for applications where possible. A web process should not own the entire operating system or have write access to its own executable code unless the deployment design requires it.

Update and harden Ubuntu before publishing a port

Apply updates

sudo apt update
sudo apt full-upgrade
sudo reboot

Reconnect after the reboot and check whether a reboot is still required. Enable unattended security updates if they fit your change-management policy. Automatic security patching reduces exposure, but you still need a plan for application updates, kernel reboots, and testing after upgrades.

Use SSH keys and restrict administration

Install your public key for the administrative user before disabling password access. After verifying key login in a separate terminal, create a drop-in SSH configuration file:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudoedit /etc/ssh/sshd_config.d/10-hardening.conf

Typical settings are:

PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

Do not copy these settings blindly if your provider requires a different authentication method. Validate and reload SSH without terminating the current session:

sudo sshd -t
sudo systemctl reload ssh

Restrict SSH to trusted source addresses at the VPS firewall or provider network firewall when your team has stable office or VPN ranges. If you cannot guarantee a fixed source range, use key authentication, strong account controls, and monitoring rather than locking yourself out.

Configure both firewall layers

Ubuntu’s default firewall frontend is ufw, built on the kernel’s Netfilter packet-filtering system. A VPS provider may also supply a network firewall; a packet must pass both layers.

Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)
  • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
  • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
  • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
  • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
  • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed

Allow only required public ports

Allow SSH on the port you actually use before enabling the firewall. Then permit web traffic:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

If SSH uses another port, substitute it for 22. The important rule is to permit the real management path before activating the default deny policy.

Do not expose MySQL, PostgreSQL, Redis, queues, control panels, or internal application ports to the public internet unless there is a documented requirement. Prefer localhost or a private network binding. If external administration is necessary, restrict the source CIDRs and use encrypted authentication.

Confirm listeners after installation

sudo ss -tulpn

Before launch, the expected public listeners are normally the chosen web server on TCP 80 and 443, plus SSH on its management port. An unexpected listener is an investigation item, not something to ignore.

Choose nginx or Apache2

Both are capable production web servers. Choose according to application compatibility, configuration style, module requirements, team knowledge, and migration cost—not an assumed universal performance ranking.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Decision area nginx Apache2
Configuration model Server blocks, commonly stored in /etc/nginx/sites-available and enabled through /etc/nginx/sites-enabled. VirtualHost files under /etc/apache2/sites-available, enabled with Apache’s site tooling.
Good fit New sites, static files, reverse-proxy front ends, and FastCGI applications. Applications that depend on Apache modules, .htaccess behavior, or an established LAMP operating standard.
Dynamic applications Usually proxies to PHP-FPM or another application process. Can use modules or proxy to separate application processes; PHP deployments commonly use PHP-FPM as well.
Port ownership Must own 80 and 443 unless deliberately placed behind another proxy. Must own 80 and 443 unless deliberately placed behind another proxy.
Validation nginx -t before reload. Apache syntax testing before reload, followed by a controlled reload.

Do not install both and let them compete for ports 80 and 443. If you deliberately run one in front of the other, document which service terminates TLS and which one receives the proxied traffic.

Install and configure nginx

Install the package

sudo apt update
sudo apt install nginx
sudo systemctl enable --now nginx
sudo systemctl status nginx

Allow the web ports in UFW if you have not already done so. Visiting the VPS IP should show the default page until you replace its configuration.

Create an isolated document root

sudo mkdir -p /srv/example.com/html
sudo chown -R adminuser:www-data /srv/example.com
sudo find /srv/example.com -type d -exec chmod 755 {} ;
sudo find /srv/example.com -type f -exec chmod 644 {} ;
sudo tee /srv/example.com/html/index.html <<'EOF'
<!doctype html>
<html lang="en">
<meta charset="utf-8">
<title>Example site</title>
<p>The VPS web server is working.</p>
EOF

Adjust ownership to match your deployment process. Avoid making the document root world-writable. If an application needs an upload directory, grant write access only to that directory, not to the complete site tree.

Create a server block

sudoedit /etc/nginx/sites-available/example.com

For a static site, use a minimal configuration:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    root /srv/example.com/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/example.com.access.log;
    error_log  /var/log/nginx/example.com.error.log;
}

The try_files rule serves an existing file or directory and returns a 404 otherwise. A single-page application may need a deliberate fallback such as /index.html; do not add one unless the application requires it, because it can hide missing-file errors.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men
  • Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
  • Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
  • Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
  • ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
  • Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

Enable and test the site

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

Keep the default site until the new server block works if you need a safe rollback. The test must report a successful syntax check before every reload. If it fails, read the reported file and line, correct the error, test again, and only then reload.

Proxy a dynamic application

For an application listening privately on port 3000, add a proxy location instead of exposing port 3000 publicly:

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Run the application as a service account, bind it to localhost or a private address, and define restart behavior, environment variables, resource limits, and logs in its service manager. Never place database passwords directly in a file served from the document root.

Install and configure Apache2 instead

Install Apache2

sudo apt update
sudo apt install apache2
sudo systemctl enable --now apache2
sudo systemctl status apache2

Apache’s configuration lives under /etc/apache2. Its site definitions are normally kept in /etc/apache2/sites-available and enabled into the active configuration.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create a VirtualHost

sudo mkdir -p /srv/example.com/html
sudo chown -R adminuser:www-data /srv/example.com
sudoedit /etc/apache2/sites-available/example.com.conf

A basic static host can look like this:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /srv/example.com/html

    <Directory /srv/example.com/html>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
</VirtualHost>

Use AllowOverride All only when the application genuinely requires .htaccess; allowing distributed overrides adds per-request work and can make configuration harder to audit.

Enable, test, and reload

sudo a2ensite example.com.conf
sudo a2dissite 000-default.conf
sudo apache2ctl configtest
sudo systemctl reload apache2

If Apache reports a syntax error, do not reload. Fix the named directive or module dependency and run the test again. Use a2enmod proxy proxy_http only when you intentionally proxy to an application process, and keep that process off public interfaces.

Point DNS at the VPS

At your DNS provider, create an A record for the domain’s IPv4 address and an AAAA record only when the VPS has working IPv6 and the web server and firewall are configured for it. Add a www record as an alias or separate address according to your naming plan.

DNS changes are cached according to their TTL. Check from outside the VPS:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
dig +short example.com A
dig +short example.com AAAA
curl -I http://example.com

Every address returned by DNS must reach the intended server. A stale or incorrect AAAA record can make IPv6 clients fail even when IPv4 works. Do not request a certificate until the public name resolves correctly and TCP port 80 is reachable.

Rank #4
Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack
  • Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
  • Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
  • 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
  • Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
  • USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

Enable HTTPS with Let’s Encrypt

For an internet-facing server, use TLS. Let’s Encrypt is a free automated certificate authority whose certificates are trusted by major browsers and clients. Certificates are issued through ACME and are valid for 90 days, so renewal is part of the service design, not a one-time setup task.

Install Certbot and issue a certificate

Install Certbot using the method supported by your Ubuntu release, then use the plugin matching the web server. For nginx:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo certbot --nginx -d example.com -d www.example.com

For Apache2:

sudo certbot --apache -d example.com -d www.example.com

The plugin can write certificate directives and reload the matching service. Follow the prompts carefully, including the choice to redirect HTTP to HTTPS after you have confirmed that the site works.

The HTTP-01 challenge requires the registered domain to point to the VPS and TCP port 80 to be reachable from the internet. A closed firewall, wrong DNS record, proxy rule that blocks the challenge path, or an unreachable IPv6 address can cause issuance to fail.

Understand the HTTPS configuration

An nginx TLS server block normally listens on 443 and names the certificate and private key:

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    root /srv/example.com/html;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}

Use the paths generated for your certificate. The private key must be protected from ordinary users while remaining readable by the nginx master process. Do not copy it into the document root or commit it to source control.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Apache’s Certbot-managed configuration places equivalent certificate directives in an SSL VirtualHost. Keep HTTP available for renewal challenges and redirect ordinary requests to HTTPS once the certificate is working.

Test automated renewal

sudo certbot renew --dry-run
systemctl list-timers | grep -i certbot
sudo systemctl status certbot.timer

Ubuntu documents a systemd timer that attempts renewal twice daily. Successful renewal reloads nginx or Apache through the integration. If you terminate TLS in a custom service, add a renewal deploy hook that reloads that service and test the hook explicitly.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Add application runtimes and data services selectively

PHP

A PHP application generally needs PHP-FPM, the extensions required by the application, and a web-server integration. Keep PHP-FPM on a Unix socket or localhost rather than publishing its listening port. Match the PHP version and extensions to the application’s supported matrix, and set upload, execution-time, and memory limits deliberately.

Best Value
Sale
HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs
  • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
  • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
  • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
  • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
  • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.

Node.js, Python, Ruby, and other runtimes

Run the application process under a dedicated account and supervise it with a service manager or process supervisor. The web server should proxy to a private listener, provide the public TLS endpoint, and enforce request limits appropriate to the application. Store secrets in protected environment files or a secrets manager, not in JavaScript bundles or publicly readable configuration.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Databases and queues

Install MySQL, PostgreSQL, Redis, or a queue only when the workload requires it. Bind databases to localhost or a private network, use separate credentials per application, and deny public access in both firewall layers. Schedule backups and verify that a restore works on a separate location; a backup that has never been restored is only an assumption.

Validate before launch

  1. Configuration: run nginx -t for nginx or apache2ctl configtest for Apache2 before every reload.
  2. Service state: check systemctl status nginx or systemctl status apache2, then inspect recent logs with journalctl -u nginx -n 100 or journalctl -u apache2 -n 100.
  3. DNS: resolve the domain from an external network and verify every returned address.
  4. HTTP behavior: confirm that port 80 redirects as intended and does not create a redirect loop.
  5. TLS: verify the certificate name, expiry, chain, and that both the apex and www names behave consistently if both are published.
  6. Application: request a health endpoint, log in with a test account, submit representative forms or API calls, and load representative static assets.
  7. Exposure: scan the VPS from an external network or use an approved port-checking tool to confirm that only intended ports are reachable.
  8. Renewal: complete certbot renew --dry-run and record the timer status.

Operate the VPS after launch

Patch and review

Keep Ubuntu packages, the web server, runtimes, dependencies, and application code patched. Subscribe to security advisories relevant to the distribution and frameworks you use. Review enabled services and firewall rules after every major change.

Monitor the signals that predict failure

  • Disk usage, inode usage, memory pressure, load, and swap activity.
  • Web-server 4xx and 5xx rates, latency, and connection saturation.
  • Application health checks, worker queues, and database connectivity.
  • Certificate expiry and renewal failures.
  • Repeated SSH failures and unexpected process or listener changes.

Rotate or centralize logs so a busy site cannot fill the root filesystem. Keep enough retention to investigate incidents without storing unlimited data on the VPS.

Back up and document recovery

Back up site files, databases, application configuration, deployment metadata, and TLS-related account information according to the service’s recovery objective. Store copies outside the VPS and test restoration periodically. Document DNS changes, firewall rules, provider-console access, deployment commands, rollback steps, and the person authorized to make emergency changes.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Troubleshoot common failures

SSH stopped working after hardening

Use the provider console or recovery environment, inspect /etc/ssh/sshd_config and its drop-ins, run sshd -t, and restore the last known-good setting. Keep a second verified session open whenever changing SSH.

The domain shows the wrong site

Check DNS answers, the server’s server_name or ServerName, enabled-site links, and the default site. Confirm that the request reaches the expected IP and that no stale AAAA record sends clients elsewhere.

Certbot cannot validate the domain

Confirm that DNS resolves publicly, port 80 is allowed in UFW and the provider firewall, and the web server serves the challenge path. Temporarily remove rules that redirect or block the challenge, then retry. If IPv6 is published but not working, repair IPv6 or remove the incorrect AAAA record before requesting again.

502 Bad Gateway

For a proxied application, verify that the process is running, listening on the address and port in proxy_pass, and permitted by its service account. Read both the web-server error log and the application log. A local listener is safer than a public one, but the proxy target must match it exactly.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

403 or 404 responses

Check the document root, file ownership, directory execute permissions, index filename, and the location or directory rules. For nginx, test the actual path selected by try_files. For Apache2, inspect Require directives and whether the intended site is enabled.

The VPS runs out of disk space

Use df -h and df -i, identify large logs or temporary files with an approved inspection process, rotate logs, remove obsolete packages, and expand storage before the filesystem reaches 100 percent. Do not delete database or application files merely to recover space.

Choosing the simplest safe architecture

For a static site, stop after the web server, DNS, TLS, access logs, and monitoring are working. For a dynamic site, add one runtime and one data service at a time, keep internal listeners private, and validate the complete request path after each change. nginx is a practical default for a new reverse-proxy front end; Apache2 is often the lower-risk choice when the application depends on Apache modules or established .htaccess conventions. In either case, security, recoverability, and a tested renewal process matter more than choosing a server by reputation alone.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.