To launch a website on a VPS, provision an Ubuntu Linux virtual machine, create a sudo-capable user, install Nginx, place your files in a domain-specific web root, point DNS records to the server’s public IP, and use Certbot to obtain a free Let’s Encrypt certificate. The sequence below takes you from an empty VPS to a site that serves over HTTPS, with firewall, renewal and recovery checks included.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
A virtual private server (VPS) is a Linux-based virtual machine that you administer remotely. You receive a public IP address, log in through SSH or the provider’s console, install software and decide how the web server is configured. That flexibility also means you are responsible for updates, access control, backups and recovery.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThis guide uses an Ubuntu image, Nginx as the web server and Let’s Encrypt certificates installed through Certbot. Replace your_domain and YOUR_SERVER_IP in every example with your real domain and VPS address. The commands assume an Ubuntu release with apt, a user with sudo privileges and a domain whose DNS you can edit.
Choose and provision the VPS
At signup, select an Ubuntu image rather than a preconfigured application stack. Record the server’s public IPv4 address, the region, the provider-console URL and the recovery method. Keep the console available: it is your fallback if an SSH rule, firewall change or Nginx error locks you out.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Compare providers on operational features
| Decision point | What to verify before buying |
|---|---|
| Ubuntu images | The Ubuntu release you need is offered as a standard server image and can be reinstalled from the control panel. |
| Account and SSH workflow | You can upload an SSH public key, create a non-root user or use the console to do so, and reset access without opening a support ticket. |
| Firewall and network controls | There is a provider-level firewall or security-group layer in addition to the host firewall, with documented inbound and outbound behavior. |
| DNS tools | You can create A and TXT records and inspect their current values. If DNS is hosted elsewhere, confirm that the registrar allows these records. |
| HTTPS automation | The VPS has reachable ports 80 and 443 and no provider rule blocks certificate validation. |
| Backups and snapshots | Snapshot frequency, retention, restore time and whether snapshots are application-consistent are stated clearly. |
| Support and regions | The available data-center regions, support hours and escalation method fit your audience and recovery needs. |
| Recurring cost and quotas | Current monthly price, bandwidth, storage, IPv4 charges and backup fees are shown on the provider’s plan page; these values change, so verify them immediately before ordering. |
Log in and create a normal administrator
Use the provider’s console or SSH with the temporary account supplied at provisioning. If you were given only a root login, create a personal account immediately and use it for routine work:
ssh root@YOUR_SERVER_IP
adduser deploy
usermod -aG sudo deploySet a strong password if the account requires one, then install your SSH public key in /home/deploy/.ssh/authorized_keys. Test a second session before ending the first:
Free tools Windows power users keep installed
One-click scans. No signup required.
ssh deploy@YOUR_SERVER_IP
sudo -vOnce the second session works, use the provider’s documented method to disable routine root SSH access and password authentication. Do not make that change until key-based access has been tested and the recovery console is available.
Update the operating system
Refresh package indexes and install current updates before adding the web stack:
sudo apt update
sudo apt upgradeReboot if the package manager reports that a kernel or critical system service requires it, then reconnect as deploy. Keeping the initial setup current reduces the chance that a later Nginx or Certbot installation depends on outdated packages.
Install Nginx and protect SSH with UFW
Install Nginx from Ubuntu’s repositories:
sudo apt update
sudo apt install nginxUFW (Uncomplicated Firewall) can block every new connection if enabled without an SSH exception. Allow SSH first, then enable the firewall and permit the web profiles:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- Pi5 8GB Pack: RasTech Pi 5 8GB kit includes 1 x Pi5 8GB board ,1 x 64GB Card, 2 x Card Readers,1 x Active Cooler,1 x Case for Pi5, 2 x 4K Micro HD Out Cable,1 x GaN 27W 5A USB-C Power supply,1 x Screwdriver and 1 x instructions.
- Pi5 8GB Board: The Pi5 board is equipped with a 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz and an 800MHz VideoCore VII GPU with support for OpenGL ES 3.1 and Vulkan 1.2, which delivers a significant increase in graphics performance. Dual HD Out 4Kp60 display outputs and a built-in dual 4-channel MIPI camera/display transceiver provide state-of-the-art camera support. The Pi 5 offers a 2-3 times increase in CPU performance compare to Pi4.
- Important Graphics Features: Equipped with an 800MHz VideoCore VII GPU and providing better graphics performance, suitable for multimedia applications,gaming,and graphics intensive tasks.Provides 1 UART interface,1 card slot that supports high-speed operation, 2 USB. 3 0.5 ports that support synchronous 0Gbps operation,2 USB 2.0 port ports,2 4Kp60 display outputs that support HDR.Built-in dedicated dual 4-channel 1Gbps MIPI DSI/CSI connectors,triple the total bandwidth.
- Cooling Kit for Pi 5: Compatible with Active Cooler for Raspberry Pi5, It can provide Pi 5 board with better cooling effect in using. The Case can accurately access usb-c power jack,Micro HD Out ports, usb ports, Ethernet jack, card slot, power button, 4-lane MIPI DSI/CSI connectors and so on, and it also supports installation of cooling fan.
- 64GB Card Kit and GaN 27W USB-C Power Supply: With extra 64GB card to store more files and card readers for multiple medium, keep better performance for Raspberry Pi 5, 27W USB C Power Supply is Compatible with Pi5 8GB, offers a variety of output voltage options, including 5.1V at 5A, 9.0V at 3.0A, 12.0V at 2.25A, and 15.0V at 1.8A, providing for different device requirements.
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw allow 'Nginx HTTP'
sudo ufw allow 'Nginx HTTPS'
sudo ufw status verboseIf you prefer one rule for both web protocols, the Nginx Full profile covers ports 80 and 443. Use either the separate HTTP and HTTPS rules above or the combined profile, not both unnecessarily. Confirm that the SSH rule is present before closing your existing connection.
Check that the service started:
sudo systemctl status nginxA successful installation normally shows an active service. Visiting the VPS IP in a browser should display Nginx’s default page; that page is only a temporary diagnostic and will be replaced by your site.
Create the website files and web root
Give the site its own directory. A separate root prevents one domain’s files from being mixed with another site you may add later:
sudo mkdir -p /var/www/your_domain/html
sudo chown -R deploy:deploy /var/www/your_domain/html
sudo chmod -R 755 /var/www/your_domainCreate a minimal page to prove that Nginx, the directory permissions and the eventual server block all point to the same place:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
cat > /var/www/your_domain/html/index.html <<EOF
<!doctype html>
<html lang='en'>
<head>
<meta charset='utf-8'>
<meta name='viewport' content='width=device-width, initial-scale=1'>
<title>your_domain</title>
</head>
<body>
<h1>your_domain is online</h1>
<p>This page is served by Nginx on the VPS.</p>
</body>
</html>
EOFFor a real application, deploy through your chosen process rather than making the web server’s entire directory writable. The deploy user should own files it must update; Nginx only needs read and directory-traverse permission for static content.
Configure an Nginx server block
Nginx chooses a site by matching the requested hostname to a server block. Ubuntu stores available definitions in /etc/nginx/sites-available/ and activates them through symbolic links in /etc/nginx/sites-enabled/.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Write the domain configuration
sudo nano /etc/nginx/sites-available/your_domainPaste this configuration, changing both hostnames if your DNS naming scheme differs:
server {
listen 80;
listen [::]:80;
server_name your_domain www.your_domain;
root /var/www/your_domain/html;
index index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
}root identifies the directory containing your files. The index directive defines default documents, and try_files serves an existing path or returns a 404 instead of silently routing a missing file elsewhere.
Recommended Free Tools
Enable, test and reload
sudo ln -s /etc/nginx/sites-available/your_domain /etc/nginx/sites-enabled/your_domain
sudo nginx -t
sudo systemctl reload nginxNever reload after an edit without running sudo nginx -t. The test checks syntax and referenced files while the current configuration keeps serving traffic. If it reports an error, fix the indicated line and test again; do not reload a failed configuration.
Before DNS is changed, you can test the virtual host locally by sending the hostname in an HTTP request:
curl -I -H 'Host: your_domain' http://YOUR_SERVER_IPOnce DNS points to the VPS, visit both the apex name and the www name over HTTP and confirm that your page appears. Only after the new block works should you remove Ubuntu’s default site:
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginxRemoving the default too early can make troubleshooting harder because a typo in server_name may leave you with an unexpected response.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (4GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- CanaKit Mega Heat Sink - Black Anodized
Point the domain at the VPS
At your registrar or DNS host, create two A records:
| Hostname | Type | Value | Purpose |
|---|---|---|---|
example.com |
A | YOUR_SERVER_IP |
Routes the apex domain to the VPS. |
www.example.com |
A | YOUR_SERVER_IP |
Routes the www hostname to the same VPS. |
Some DNS panels represent the apex with @; use the panel’s documented notation. If your provider supports an alias record for www, its equivalent is acceptable, but the hostname must ultimately resolve to the VPS. Remove conflicting A or AAAA records that send either name to an old server. An unused or incorrect IPv6 record can cause some visitors to bypass the working IPv4 address, so add an AAAA record only when the VPS has a configured public IPv6 address and Nginx is listening for it.
DNS changes are cached according to each record’s TTL. Check from an external network before requesting a certificate:
dig +short example.com A
dig +short www.example.com ABoth commands should return the VPS public IPv4 address. Certificate validation also requires that ports 80 and 443 be reachable from the internet; check provider firewalls, UFW and any network appliance in front of the VPS.
Enable free HTTPS with Let’s Encrypt and Certbot
Let’s Encrypt is a certificate authority that issues free TLS certificates. A certificate obtained for the apex and www names is valid for 90 days. Certbot can request the certificate, edit the Nginx configuration and arrange renewal.
Install the Nginx integration
sudo apt update
sudo apt install certbot python3-certbot-nginxRequest both names and allow Certbot to configure Nginx:
Best Value
- Design for Raspberry Pi: Supports installation of 4 Raspberry Pis and 4 ssds, compatible with any 2.5” Solid State Drive (7mm/9mm) and Rpi 4B/3B+, and other B/B+ models.
- The SSD mounting bracket also has two holes reserved for the SD card extension adapter ASIN: B09CKRDFTH, which allows you to access the SD card from the front of the rack.
- Easy to Setup: Just use two included thumbscrews to mount the rackmount, which adopts a screw-in design, which helps you install and replace quickly and easily, no tools needed!
- Applications: This is a hardware solution to get ingenious use of the Raspberry Pi, with this kit and open source software OpenMediaVault, you can use the Pi as a NAS Server, Surveillance station, or even a Web server.
- Optional accessories: Single mounting bracket: B09GFQLPTY; Micro SD card extension adapter ASIN: B09CKRDFTH. I/O Panel: B09FXRQPFM
sudo certbot --nginx -d example.com -d www.example.comCertbot will ask for an email address, acceptance of the terms and whether HTTP requests should redirect to HTTPS. For a public production site, choose the redirect so visitors use the encrypted URL. The command can succeed only when DNS resolves correctly and the certificate authority can reach your server on port 80.
Check the result and renewal
Open https://example.com and https://www.example.com. Confirm that the certificate covers the hostname shown in the browser and that an HTTP request is redirected:
curl -I http://example.com
curl -I https://example.comTest the automated renewal path without replacing the live certificate:
sudo certbot renew --dry-runCertificates expire after 90 days, so renewal is an operational task, not a one-time setup step. Keep the Certbot timer or scheduled service enabled, review dry-run results after major firewall or Nginx changes and monitor expiry from outside the VPS.
When HTTP validation is not possible
If inbound HTTP or HTTPS cannot be exposed, or you need a wildcard certificate such as *.example.com, use a DNS-01 challenge. Certbot (or another ACME client) asks you to publish a DNS TXT record proving control of the domain. The certificate authority validates that TXT record instead of connecting to port 80. DNS-01 requires access to the DNS zone and careful cleanup of the temporary TXT value; follow your DNS host’s documented automation method if you want unattended renewals.
Verify the complete launch
Run these checks from the VPS and from a separate network:
- Configuration:
sudo nginx -treturns a successful test. - Service:
systemctl status nginxshows the service active. - Firewall:
sudo ufw status verboseshows SSH plus the required HTTP and HTTPS rules. - DNS: both A records resolve to the VPS public IPv4 address.
- HTTP behavior: port 80 redirects to the HTTPS URL after Certbot’s change.
- TLS identity: the certificate names include the apex and
wwwhostnames, with a future expiry date. - Content: the intended page, not the default Nginx page, is returned for each hostname.
Common failure symptoms and fixes
| Symptom | Likely cause | Action |
|---|---|---|
| SSH stops working immediately after enabling UFW | The SSH rule was not added first, or SSH uses a nonstandard port. | Use the provider recovery console, allow the actual SSH port, then reconnect before closing the console session. |
| The browser shows the default Nginx page | The default site is still selected, the hostname does not match, or DNS points elsewhere. | Check the A records, verify server_name, confirm the symlink in sites-enabled, then run nginx -t and reload. |
| 502 Bad Gateway | A proxy configuration points to an application that is stopped or listening on another socket. | Check the application service and its listen address. A static site should not contain a proxy directive. |
| Certbot reports a failed challenge | DNS has not propagated, port 80 is blocked, or another server answers the hostname. | Verify both A records with dig, open port 80 at the provider and UFW layers, and retry after the hostname reaches this VPS. |
| One hostname works while the other fails | The apex and www records differ, or only one name was included in the certificate. |
Make both records resolve to the VPS and rerun Certbot with both -d options. |
| Nginx will not reload after an edit | A syntax error, missing semicolon or invalid path is present. | Run sudo nginx -t; correct the reported file and line before attempting another reload. |
Maintain the VPS after launch
A working first deployment is the beginning of administration. Put a recurring routine on your calendar:
- Apply Ubuntu security updates with
sudo apt updateandsudo apt upgrade; schedule reboots when the system requests one. - Review Nginx and application logs for repeated errors, unexpected paths or authentication attempts.
- Keep UFW limited to the ports the site actually needs. SSH, HTTP and HTTPS are the usual minimum for this workflow.
- Run
sudo nginx -tbefore every reload, including changes made by deployment scripts. - Run
sudo certbot renew --dry-runperiodically and alert on certificate expiry. - Create provider snapshots or external backups of site files, application data, database dumps and deployment configuration. A snapshot is not a substitute for a separate copy.
- Document the provider console path, VPS IP, DNS host, user accounts, SSH-key ownership and the exact restore steps. Store secrets outside the web root.
Plan a recovery test
At least once, practice restoring a snapshot or rebuilding a second VPS from your notes. Verify that you can recreate the sudo user, firewall rules, Nginx server block, DNS records and certificate process without relying on the original machine. Keep the old server available until DNS and HTTPS on the replacement have been checked from an external network.
What a successful launch looks like
Your domain’s apex and www records resolve to the VPS, Nginx serves files from /var/www/your_domain/html through the matching server block, UFW allows only the required traffic, and HTTP redirects to a valid Let’s Encrypt certificate over HTTPS. With syntax tests before reloads, renewal checks, current packages and recoverable backups, the VPS is ready for your first website and for later application deployments.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
