Setting up a VPS for the first time is one of those tasks that sounds intimidating right up until you’ve actually done it once. There’s no single “install wizard” the way there is with shared hosting — you’re building a working server from a blank slate — but the actual process is a well-worn, well-documented sequence of steps that hasn’t fundamentally changed in years. This walkthrough covers the full process from provisioning a new VPS to having a secured, functioning server ready to host a real website or application.
Step 1: Choose a Provider and a Plan
Picking a Provider
DigitalOcean, Vultr, and Linode are all solid, developer-friendly starting points, offering straightforward interfaces, clear documentation, and entry-level plans typically starting around $4 to $6 a month. If you’re just learning, prioritize a provider with strong documentation and community tutorials over one with the absolute lowest price — the time you save troubleshooting will be worth far more than a dollar or two a month.
Sizing Your Plan
For a first VPS running a small website or a learning project, an entry-level plan with 1GB of RAM and a single CPU core is usually sufficient to start. You can almost always resize to a larger plan later without much friction, so there’s little benefit to over-provisioning before you actually know your project’s real resource needs.
Step 2: Choose an Operating System
Pick a Well-Supported Linux Distribution
Ubuntu LTS (Long Term Support) releases are the most common and most broadly documented choice for a first VPS, meaning that if you run into an issue, there’s a very high chance someone else has already documented the exact same problem and solution somewhere online. Debian and AlmaLinux are also solid, stable alternatives with their own strong communities. Unless you have a specific reason to choose otherwise, a current Ubuntu LTS release is the safest default for a beginner.
Step 3: Provision the Server
Create the Instance
Through your provider’s dashboard, select your chosen operating system image, your plan size, and a data center region — generally, pick a region physically close to your expected audience to minimize latency. Most providers will have your server up and running within about a minute of confirming the order.
Choose Your Authentication Method
You’ll be asked to set up either a root password or an SSH key pair for logging in. SSH keys are significantly more secure than password authentication and are the standard recommended approach — if you don’t already have an SSH key pair, generating one is a quick, one-time setup step most providers walk you through directly in their dashboard.
Step 4: Connect to Your Server
Using SSH
Once your server is provisioned, you’ll connect to it via SSH (Secure Shell) from your local computer’s terminal, using the commandssh root@your_server_ip, substituting your server’s actual IP address. If you set up an SSH key, this connection happens automatically without a password prompt; if you’re using password authentication, you’ll be prompted to enter it.
First Login Checks
Once connected, it’s worth confirming basic details — checking the operating system version, confirming your allocated disk space and memory are what you expected, and updating the system’s package list — before making any further changes.
Step 5: Update the System
Apply the Latest Security Patches
Before installing anything else, update your server’s software packages to the latest available versions. On Ubuntu or Debian, this means running apt update followed by apt upgrade. This ensures you’re starting from a server with current security patches rather than whatever was baked into the base image at the time it was created.
Step 6: Create a Non-Root User
Why This Matters
Running everything as the root user is a common beginner habit, but it’s a real security risk — a mistake or a compromised process running as root has unrestricted access to the entire system. Best practice is to create a separate user account with limited privileges for day-to-day work, and grant that account sudo access for the specific occasions when elevated permissions are genuinely needed.
How to Do It
On most Linux distributions, this involves running adduser yourusername to create the account, then usermod -aG sudo yourusername (on Ubuntu/Debian) to grant it administrative privileges when needed. From this point forward, log in and work as this new user rather than as root directly.
Step 7: Set Up a Firewall
Basic Firewall Configuration
A firewall controls which network ports are allowed to receive incoming connections, closing off anything you’re not actively using. On Ubuntu, the built-in ufw (Uncomplicated Firewall) tool makes this straightforward: allow SSH access (typically port 22, though changing this to a non-standard port adds a small extra layer of protection), allow HTTP and HTTPS (ports 80 and 443) if you’re hosting a website, and deny everything else by default.
Enable and Verify
After configuring the specific rules you need, enable the firewall and check its status to confirm the rules are active. This single step meaningfully reduces your server’s exposed attack surface right from the start.
Step 8: Harden SSH Access
Disable Password Authentication
If you’re using SSH keys (which you should be), disabling password-based SSH login entirely removes an entire category of brute-force attack risk. This is configured in the SSH daemon’s configuration file, typically located at /etc/ssh/sshd_config.
Consider Disabling Root Login
Once your non-root user with sudo privileges is set up and working, disabling direct SSH login as the root user is another meaningful hardening step — anyone needing root access has to first log in as your regular user and then elevate privileges, adding a layer of friction against unauthorized access.
Step 9: Install the Software Your Project Needs
Web Server Software
If you’re hosting a website, you’ll need web server software — Nginx and Apache are the two most common choices, both well-documented and broadly compatible with most applications. Nginx has become the more popular default for new setups due to its performance characteristics, but either is a perfectly reasonable choice.
Database Software, If Needed
If your application requires a database, install and configure it now — MySQL, PostgreSQL, and MariaDB are all common choices depending on what your specific application or framework requires.
Programming Language Runtime
Install whatever language runtime your application needs — Node.js, Python, PHP, or others — along with any package managers or version managers relevant to your stack.
Step 10: Set Up a Domain
Point Your Domain to the Server
In your domain registrar’s or DNS provider’s dashboard, create an A record pointing your domain (or a subdomain) to your VPS’s IP address. This change typically takes anywhere from a few minutes to several hours to fully propagate across the internet.
Configure Your Web Server for the Domain
Once DNS is pointing correctly, configure your web server software (Nginx or Apache) with a server block or virtual host that ties your domain name to the correct directory or application on the server.
Step 11: Set Up SSL/TLS (HTTPS)
Get a Free Certificate
Let’s Encrypt provides free SSL/TLS certificates, and the Certbot tool automates the process of obtaining and installing one, along with configuring your web server to use it and automatically renewing it before expiration. There’s essentially no good reason to run a public-facing website without HTTPS in 2026, and this step takes only a few minutes with Certbot.
Step 12: Set Up Backups
Provider-Level Snapshots
Most VPS providers offer an automated or manual snapshot feature that captures your entire server’s state, which you can restore from if something goes seriously wrong. Enabling automated snapshots, even at a modest additional monthly cost, is cheap insurance against a catastrophic mistake or failure.
Application-Level Backups
Beyond full-server snapshots, set up regular backups of anything critical at the application level too — database dumps, uploaded files, configuration files — ideally stored somewhere separate from the server itself, such as an object storage service, so a single point of failure can’t take out both your live server and your backups simultaneously.
Step 13: Set Up Basic Monitoring
Know When Something Goes Wrong
At minimum, set up some form of uptime monitoring that alerts you if your server or website becomes unreachable. Many providers include basic resource monitoring (CPU, memory, disk usage) in their dashboard by default, and free third-party uptime monitoring tools can alert you by email or text if your site goes down, often before your users even notice.
Common First-Time Mistakes to Avoid
Skipping the Firewall
It’s tempting to skip firewall configuration when you’re just trying to get something running quickly, but an unprotected server is discovered and probed by automated bots within minutes of being connected to the internet. This step takes only a few minutes and meaningfully reduces real risk.
Using Weak or Default Passwords
If you’re using password authentication anywhere on the server — for the database, for any admin panel — use genuinely strong, unique passwords, or better yet, avoid password authentication entirely in favor of SSH keys and application-level authentication tokens where possible.
Never Updating the System
A server that’s set up once and never patched again accumulates security vulnerabilities over time. Set up automatic security updates where your operating system supports it, or establish a regular manual update routine.
No Backup Plan
Treating a VPS as permanent and unbreakable is a mistake that eventually catches up with everyone. Set up both provider-level snapshots and application-level backups before you actually need them, not after a failure has already happened.
The Bottom Line
Setting up a VPS from scratch involves more manual steps than shared hosting, but each individual step is well-documented, widely used, and genuinely not that difficult once you’ve walked through it a single time. The core sequence — provision, update, secure, install, configure, back up — applies almost universally regardless of which provider or specific software stack you choose, and following it methodically the first time builds a foundation of habits that will serve you well on every VPS you set up after this one.
