To turn a Linux VPS into a production web server, secure the operating system first, open only the required ports, install either nginx or Apache2, create a site configuration, point DNS to the VPS, enable HTTPS with Let’s Encrypt, and then add only the runtime, database, monitoring, and backup services your application actually needs. A static site can be simple; a dynamic application is a collection of separately operated services.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What “full web server” means on a VPS
A VPS becomes a web server when it can accept web requests, select the correct site, return files or proxy requests to an application, and do so securely and reliably. The minimum production path is:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- A supported Linux distribution with administrative access.
- A public IPv4 address, and an IPv6 address only if you will publish an AAAA record.
- A web server such as nginx or Apache2.
- A DNS name pointing to the VPS.
- TCP ports 80 and 443 available for web traffic.
- TLS certificates, preferably from Let’s Encrypt for an internet-facing site.
- Logs, patching, backups, and a way to recover the machine.
Static HTML needs only the web server and site files. A dynamic service may also require PHP-FPM, Node.js, Python, Ruby, a process manager, a database, a queue, a reverse-proxy arrangement, application secrets, and monitoring. Do not install every component by default: each additional daemon increases maintenance and attack surface.
Prepare access and define the deployment model
Confirm the prerequisites
- Use a currently supported Linux release and know how to obtain its provider console or recovery environment.
- Record the VPS public IP address and the DNS provider that controls your domain.
- Confirm that you have working sudo credentials and a tested SSH login.
- Decide where application files, logs, uploads, and backups will live before creating directories.
- Choose whether deployments will run as a dedicated, unprivileged application user or through a controlled deployment account.
Keep the provider console available while changing SSH or firewall settings. Never remove the only working access path until the replacement has been tested in a separate session.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Create a named administrative user
Log in through the provider’s initial account, create a named user, add it to the sudo group, and test a new SSH session as that user. Use SSH keys rather than a reusable password wherever your operating model permits. After confirming the key-based session, restrict direct administrative login and disable password authentication only when you have verified that your recovery method still works.
Application processes should not run as root. Create a separate service account with access only to its own code, uploads, sockets, and logs. Keep database passwords, API keys, and private certificates outside any directory served as public web content.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Update and harden the operating system
Refresh package indexes and install all available security updates before exposing the VPS. Enable unattended security updates if they fit your change-control and restart policy. Reboot when a kernel or other update requires it, then confirm that SSH and the services you depend on return normally.
Review listening sockets before installing the web server. A useful baseline is to have SSH and, after installation, the web service as the only public listeners. Databases, caches, development dashboards, and internal application ports should bind to localhost or a private network unless a documented external client must reach them.
Configure the firewall before publishing the site
Use UFW and the provider firewall together
Ubuntu’s default firewall frontend is ufw, which programs the kernel’s Netfilter packet filter. Configure it before DNS points visitors at the machine. If your VPS provider supplies a separate network firewall, apply an equivalent policy there; traffic must pass both layers.
Allow SSH on the port you actually use, then allow web traffic and enable the firewall. Substitute your real SSH port for 22 and, where practical, restrict it to trusted source networks.
sudo apt update
sudo apt full-upgrade
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseDo not copy the SSH rule blindly if your daemon uses another port. Verify the rule before enabling UFW, and keep the provider console open until you have tested a new SSH connection. Never add public rules for MySQL, PostgreSQL, Redis, Memcached, a queue broker, or an administration panel merely to make local development easier.
Choose nginx or Apache2
Both are capable production web servers. Choose based on application compatibility, configuration conventions, required modules, reverse-proxy and FastCGI needs, team familiarity, and migration cost rather than an assumed universal performance winner.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Decision factor | nginx | Apache2 |
|---|---|---|
| Site configuration | Server blocks, commonly stored in /etc/nginx/sites-available and linked into sites-enabled. |
VirtualHost files managed under /etc/apache2 and its site directories. |
| Common fit | New static sites, reverse-proxy front ends, and applications using FastCGI or an upstream service. | Applications that require Apache modules, .htaccess behavior, or an established LAMP operating standard. |
| Static-file routing | Often uses a root, index, and try_files rule. |
Uses a document root and Apache directory and rewrite configuration. |
| Port ownership | Only one service should own public TCP 80 and 443 unless one is deliberately configured as the other’s reverse proxy. | |
Check listeners before starting a second server. If nginx is already bound to port 80, Apache2 cannot also bind there without a deliberate proxy design. Stop and disable the unused service instead of repeatedly changing ports to hide the conflict.
Install and configure nginx
Install the package and create a document root
sudo apt update
sudo apt install nginx
sudo mkdir -p /srv/example.com/html
sudo chown -R $USER:$USER /srv/example.com/html
sudo chmod -R 755 /srv/example.comUse ownership that matches your deployment process. If deployments are performed by a CI account, grant that account access without making the entire tree writable by the web-service user. Place a test file in the document root:
Free tools Windows power users keep installed
One-click scans. No signup required.
printf '%sn' '<h1>example.com is online</h1>' > /srv/example.com/html/index.htmlCreate the server block
Create /etc/nginx/sites-available/example.com with a unique name and a minimal static configuration:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /srv/example.com/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
access_log /var/log/nginx/example.com.access.log;
error_log /var/log/nginx/example.com.error.log;
}Enable it, check the syntax, and reload only after the test succeeds:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo nginx -t
sudo systemctl reload nginx
sudo systemctl status nginx --no-pagerRemove or disable the distribution’s default site if it can answer requests for an unintended hostname. Keep each domain’s files and logs separate so incidents and migrations do not become ambiguous.
Proxy a dynamic application through nginx
For an application listening on localhost, retain the public server block and proxy only the required paths. A typical upstream location is:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitcheslocation / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}The application must listen on a private address or Unix socket, not an unprotected public port. Configure websocket, upload-size, timeout, and buffering settings only when the application requires them; broad defaults can conceal failures or consume memory.
Install and configure Apache2
Create a VirtualHost
Apache2 stores its main configuration under /etc/apache2. Install it and create a document root with permissions appropriate to your deployment account:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo apt update
sudo apt install apache2
sudo mkdir -p /srv/example.com/public
sudo chown -R $USER:$USER /srv/example.com/public
printf '%sn' '<h1>example.com is online</h1>' > /srv/example.com/public/index.htmlCreate /etc/apache2/sites-available/example.com.conf:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /srv/example.com/public
<Directory /srv/example.com/public>
Options -Indexes +FollowSymLinks
AllowOverride None
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
</VirtualHost>Enable the site, disable an unintended default site, test syntax, and reload:
Recommended Free Tools
sudo a2ensite example.com.conf
sudo a2dissite 000-default.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
sudo systemctl status apache2 --no-pagerIf an application depends on .htaccess, enable overrides only for the directory that needs them and document the rules. Otherwise, keeping AllowOverride None makes behavior more explicit and avoids per-request configuration-file scanning.
Run PHP through PHP-FPM when needed
A PHP site needs a PHP runtime and usually PHP-FPM in addition to Apache2 or nginx. Install only the extensions required by the application, configure the web server to pass PHP scripts to the FPM socket, and keep the socket permissions limited to the relevant service accounts. Do not expose the FPM listener directly to the internet. Test a harmless application endpoint and remove any temporary diagnostic page that reveals environment details.
Point DNS to the VPS
Create an A record for the domain’s IPv4 address. Add an AAAA record only when the VPS has working IPv6 connectivity and the web server and firewall are configured for it. If you publish an AAAA record while IPv6 is broken, some visitors will fail even though IPv4 works.
For a www hostname, use either an A/AAAA record or a CNAME that points to the chosen canonical name. Decide which hostname is canonical before issuing the certificate and configure the other one to redirect. DNS changes are controlled by the record’s TTL and resolver caches, so verify from outside the VPS rather than assuming an immediate global change.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →dig +short example.com A
dig +short example.com AAAA
dig +short www.example.comThe returned addresses must be the VPS addresses. If they are not, check the authoritative DNS provider, conflicting records, and stale local caches. Do not request a certificate until the names resolve correctly from an external network.
Enable HTTPS with Let’s Encrypt
Understand the certificate and challenge
Let’s Encrypt is a free, automated certificate authority recommended by Ubuntu for internet-facing servers. Its certificates are valid for 90 days. The ACME HTTP-01 challenge requires the domain to resolve to the server and TCP port 80 to be reachable from the public internet during issuance and renewal, even if visitors will ultimately be redirected to HTTPS.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Confirm that the selected web server answers the domain on port 80 before installing Certbot. Check both the VPS firewall and any provider-level firewall.
Issue a certificate with Certbot
Install Certbot using the distribution-supported method, then use the plugin matching the server that owns the public port:
sudo certbot --nginx -d example.com -d www.example.comsudo certbot --apache -d example.com -d www.example.comThe matching plugin writes certificate directives and can configure the HTTP-to-HTTPS redirect. Review the proposed changes, keep a copy of the resulting configuration, and test the site before closing your recovery session.
What HTTPS configuration must contain
An nginx TLS server block needs a listen 443 ssl directive, a certificate path, a private-key path, and suitable TLS protocol settings. The private key must be readable by the nginx master process but not by ordinary users or the public document root. Apache2 has equivalent certificate, key, and chain directives in its SSL VirtualHost.
After issuance, request both HTTP and HTTPS explicitly. HTTP should redirect to the chosen HTTPS hostname, while HTTPS should serve the correct certificate name and chain. Mixed-content warnings, an incorrect canonical hostname, or an incomplete chain usually indicate a site configuration or application URL problem rather than a DNS problem.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Verify automatic renewal
Certbot installs a systemd timer that attempts renewal twice a day. A successful renewal normally reloads nginx or Apache2 through the integration. Custom services need an explicit renewal hook so they reload the new certificate.
sudo certbot renew --dry-run
systemctl list-timers --all | grep -i certbot
sudo systemctl status certbot.timer --no-pagerThe dry run validates the renewal path without replacing the live certificate. Treat a failure as an incident: check DNS, port 80 reachability, firewall rules, web-server configuration, and the renewal logs. Test renewal after any change to the site’s HTTP routing or firewall.
Add application runtimes and data services deliberately
| Workload | Additional components commonly required | Security boundary |
|---|---|---|
| Static HTML, CSS, JavaScript, images | Web server, document root, DNS, TLS, access and error logs. | Serve only the intended directory; do not expose deployment files or secrets. |
| PHP application | PHP-FPM, required PHP extensions, and possibly MySQL or PostgreSQL. | Use a private FPM socket and a database account limited to that application. |
| Node.js, Python, or Ruby application | Language runtime, dependency manager, process manager or service unit, and nginx or Apache2 as reverse proxy. | Bind the app to localhost or a private socket; expose only the proxy. |
| Background jobs | Queue worker, scheduler, and durable queue or database where required. | Run workers as an unprivileged account and monitor failed jobs. |
Ubuntu documents PHP, MySQL, PostgreSQL, Apache2, and nginx as separate services rather than one mandatory stack. Keep databases on localhost or a private network unless a documented external access requirement exists. Use separate credentials per application, rotate them through a controlled process, and store them outside the web root.
Validate before launch
- Test configuration. Run
sudo nginx -tfor nginx orsudo apache2ctl configtestfor Apache2 before every reload. - Check service state. Review
systemctl statusand recent journal entries for the web server and every application service. - Test DNS externally. Resolve A, AAAA, and the selected
wwwname from a network outside the VPS. - Test HTTP behavior. Confirm that port 80 responds and redirects to the intended HTTPS hostname without a loop.
- Test TLS. Verify the certificate name, expiration, chain, and that the application serves the expected content over HTTPS.
- Exercise the application. Load representative static assets, submit a safe test request, and check a health endpoint if one exists.
- Inspect exposure. Confirm that only intended ports are reachable and that databases, caches, FPM, and internal dashboards are not public.
- Test renewal. Run the Certbot dry run and record the timer status.
- Test recovery. Confirm that you can reach the provider console and restore a known file or database backup.
Troubleshoot the failures that matter most
SSH stopped working after firewall changes
Use the provider console or recovery environment, inspect ufw status numbered, and restore an allow rule for the actual SSH port and trusted source range. Do not flush every rule without understanding the provider firewall layer. Once access is restored, open a second SSH session before ending the console session.
The domain shows the wrong site
Check DNS answers, the requested Host header, enabled server blocks or VirtualHosts, and any default site. A stale DNS record, missing server_name or ServerName, or an enabled catch-all configuration can all produce the wrong content.
Certbot cannot complete HTTP-01
Verify that the domain resolves to this VPS over IPv4 and, if published, IPv6; TCP 80 passes both firewalls; the web server answers the challenge path; and no redirect or proxy rule blocks it. Temporarily removing an incorrect AAAA record can be necessary when IPv6 is not operational.
The web server will not reload
Run the configuration test first, then inspect the service journal. Common causes are a duplicate listener, a missing semicolon or directive, an unreadable certificate key, a typo in a path, or a referenced upstream that no longer exists. Restore the last known-good configuration rather than repeatedly reloading a broken one.
The application returns 502 or 504
Check that the upstream process is running, listening on the address and port configured in the proxy, and permitted to access its socket. Read both proxy and application logs. A timeout may indicate a slow dependency, a deadlock, an undersized worker pool, or a proxy timeout that is shorter than the application’s legitimate response time.
Operate the VPS after launch
- Patch the operating system, web server, runtime, dependencies, and database on a documented schedule.
- Monitor disk space, memory, load, service health, certificate expiry, request latency, and error rates.
- Rotate or centralize logs so an active incident cannot fill the root filesystem.
- Back up application data, databases, configuration, and certificate-related recovery information according to their sensitivity.
- Test restoration regularly; a backup that has never been restored is only an assumption.
- Document the provider-console path, DNS records, firewall rules, deployment commands, service units, secrets location, and rollback procedure.
- Review public listeners after installing or upgrading a component.
Keep deployment, runtime, and administrative privileges separate. A clean rollback plan is safer than making emergency edits directly in a live document root, and a documented recovery path is more valuable than an elaborate configuration nobody can reproduce.
How to choose the final architecture
Use nginx when you want a straightforward server-block layout, a static-file front end, or a reverse proxy for an application that listens privately. Use Apache2 when the application depends on Apache modules, established .htaccess rules, or a team’s existing Apache operational tooling. In either case, let one service own public ports 80 and 443, keep application processes private, terminate TLS deliberately, and operate the result with patching, logs, monitoring, tested backups, and renewal checks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
