The reliable path is straightforward: provision an Ubuntu VPS, create a sudo-capable non-root account, install Nginx, open the firewall without locking yourself out, upload a page, configure a domain-specific server block, point DNS to the VPS, and use Certbot to obtain a free Let’s Encrypt certificate. This guide takes you from an empty virtual machine to a working HTTPS website and shows how to verify and maintain it.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you need before you start
A virtual private server (VPS) is a Linux virtual machine that you administer remotely. You receive a public IP address and control the operating system, web server, firewall and application files. That control also means you are responsible for updates, access security, backups and recovery.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- An Ubuntu VPS image with a public IPv4 address.
- The provider’s web console or recovery console, kept available in case SSH access fails.
- A domain name whose DNS you can edit.
- Credentials for an account that can create a sudo-capable user, preferably through an SSH key.
- A local terminal for SSH access.
Use example.com as the placeholder below. Replace it with your real domain everywhere, including directory names, Nginx configuration and Certbot arguments. Do not mix the placeholder with your actual domain.
1. Provision the VPS and create a safe administrator account
Connect through the provider console or SSH
Choose an Ubuntu image during VPS creation. Sign in with the temporary account supplied by the provider, or use the console if SSH has not been configured. Keep the console session available while changing SSH or firewall settings; it is your fallback if a remote rule blocks you.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
If you received a root login, use it only to create a normal account and then perform routine administration with sudo. A separate account limits the damage from an accidentally destructive command and gives you a clear audit trail.
sudo adduser deploy
sudo usermod -aG sudo deployGive the new account a strong password if your setup requires password authentication. If you use SSH keys, install the key in /home/deploy/.ssh/authorized_keys, set ownership to deploy:deploy, and make sure the directory and file are not writable by other users before disabling any temporary root access.
Free tools Windows power users keep installed
One-click scans. No signup required.
Update the operating system
sudo apt update
sudo apt upgrade -yReboot if the package manager reports that a restart is required, then reconnect as deploy. Starting from current packages avoids debugging an old Nginx or security library later in the setup.
2. Install Nginx and configure the firewall
Install and check Nginx
sudo apt install nginx -y
sudo systemctl status nginxUbuntu normally starts Nginx immediately. The status output should show an active running service. If it is not running, inspect the service error before continuing:
sudo journalctl -u nginx --no-pager -n 50Allow SSH before enabling UFW
UFW (Uncomplicated Firewall) can protect the server, but enabling it before allowing your administration channel can disconnect you. Add the SSH rule first, then enable UFW and permit web traffic.
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw allow 'Nginx Full'
sudo ufw status verboseThe Nginx Full profile permits HTTP on port 80 and HTTPS on port 443. If you are not ready for HTTPS yet, allow only Nginx HTTP first and add the HTTPS rule before requesting a certificate. Verify that the SSH rule remains listed after every firewall change.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Create the website files
Make a domain-specific web root
sudo mkdir -p /var/www/example.com/html
sudo chown -R deploy:deploy /var/www/example.com/html
sudo chmod -R 755 /var/www/example.comThe ownership command lets the deploy account update the site without making the web server’s entire filesystem writable. The 755 permissions allow Nginx to read directories and files while limiting write access to the owner.
Add a first page
nano /var/www/example.com/html/index.htmlPaste a minimal page, save it, and exit:
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Example.com</title>
</head>
<body>
<h1>It works</h1>
<p>Nginx is serving this page from the VPS.</p>
</body>
</html>At this stage the file exists on disk, but Nginx may still be serving Ubuntu’s default page. The server block in the next section selects this directory for your hostname.
4. Create and enable an Nginx server block
Write the configuration
Nginx uses a server block to associate hostnames with a web root. Create a file in /etc/nginx/sites-available:
sudo nano /etc/nginx/sites-available/example.comUse this configuration for a static first site:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example.com/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}listen 80accepts normal HTTP requests.server_namematches both the apex domain and thewwwhostname.rootpoints to the directory containingindex.html.indextells Nginx which file to use for a directory request.try_filesserves an existing file or directory and returns a 404 response when neither exists.
Enable the site safely
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo nginx -t
sudo systemctl reload nginxsudo nginx -t is the required checkpoint after every configuration edit. Reload only when it reports that the syntax is successful. A reload applies the new configuration without dropping existing connections.
Now test the server locally from the VPS, then test the public IP in a browser. The domain may not work until DNS points to this address, but the configuration itself should be valid.
curl -I http://127.0.0.1Visit the IP over HTTP and confirm that the “It works” page is yours. Only after the new server block responds correctly should you disable the default site:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginxRemoving the default site too early makes it harder to distinguish a broken custom configuration from a missing site match.
5. Point your domain’s DNS to the VPS
Create records for both hostnames
At your registrar or DNS host, create these records:
| Hostname | Record type | Value |
|---|---|---|
example.com (the apex) |
A | VPS public IPv4 address |
www.example.com |
A | The same VPS public IPv4 address |
Some DNS interfaces display the apex as @. Use the equivalent notation supplied by that interface. If your DNS provider documents another way to make www reach the same server, follow that documented equivalent, but ensure the hostname resolves to this VPS.
Wait until both names resolve to the VPS before requesting a certificate. Check from a terminal:
dig +short example.com A
dig +short www.example.com AEach command should return the VPS address. DNS caches can cause a delay, so a result that is still the old address means certificate validation will fail even when Nginx is configured correctly.
6. Add free HTTPS with Let’s Encrypt and Certbot
Install Certbot’s Nginx integration
sudo apt update
sudo apt install certbot python3-certbot-nginx -yLet’s Encrypt issues TLS certificates at no charge. A certificate is valid for 90 days, so automation and renewal checks are part of the installation rather than an optional later task.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Request and install the certificate
sudo certbot --nginx -d example.com -d www.example.comCertbot asks for an email address, agreement to the certificate authority’s terms and whether HTTP requests should redirect to HTTPS. Choose the redirect when this is the only production version of the site. Certbot edits the Nginx configuration, obtains the certificate and enables HTTPS for both names.
The HTTP-01 validation used here requires that the names resolve to this VPS and that inbound ports 80 and 443 are reachable. If a network policy prevents inbound HTTP/HTTPS validation, or if you need a wildcard certificate such as *.example.com, use a DNS-01 challenge instead. DNS-01 proves control by requiring a specific TXT record in your DNS zone.
Test renewal immediately
sudo certbot renew --dry-runA successful dry run demonstrates that the renewal process can complete before the 90-day certificate period ends. Also inspect the installed certificate in a browser and confirm that the name includes the hostname you are visiting.
7. Verify the complete launch
Check the visitor path
- HTTP: opening
http://example.comshould either show the page or redirect to HTTPS, depending on the Certbot choice. - HTTPS: opening
https://example.comshould show the intended page without a certificate warning. - Both names: test the apex and
wwwhostname separately. - Certificate: inspect the certificate name and expiration date in the browser’s security details.
- Nginx syntax: run
sudo nginx -tafter any edit. - Service state: run
systemctl status nginxif a request fails. - DNS: confirm that both A records still resolve to the VPS address.
Useful diagnostics
curl -I http://example.com
curl -I https://example.com
sudo systemctl status nginx
sudo journalctl -u nginx --no-pager -n 50
sudo ufw status verboseAn HTTP 404 usually means the request reached the correct server block but the requested file does not exist. A default Nginx page usually means the hostname did not match your server_name, the custom site is not enabled, or the default site is still taking the request. A timeout points first to DNS, the VPS network firewall or UFW; check that SSH, HTTP and HTTPS rules are present before changing Nginx.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →8. Recover from common mistakes
You lost SSH access after enabling UFW
Open the provider’s recovery console and run sudo ufw status. Add the SSH rule before changing anything else:
sudo ufw allow OpenSSHReconnect, then review the remaining rules. The console is the reason to keep an out-of-band access method available during firewall work.
Nginx refuses to reload
Do not repeatedly reload a broken configuration. Run:
sudo nginx -tThe error identifies the file and line that need correction. Check missing semicolons, unmatched braces, an incorrect root path and duplicate or conflicting server definitions. Test again before reloading.
Certbot cannot validate the domain
- Confirm that both
example.comandwww.example.comresolve to the VPS public IP. - Confirm that UFW permits the Nginx HTTP and HTTPS profiles.
- Confirm that the provider’s network firewall also permits ports 80 and 443.
- Open the HTTP URL and verify that the custom page, not a provider parking page, responds.
- Wait for DNS changes to reach resolvers before trying again.
If HTTP validation is impossible by design, switch to DNS-01 and publish the TXT record Certbot requests. Do not guess the TXT value or remove it until validation has completed.
9. Keep the VPS healthy after launch
Patch and monitor
Repeat package maintenance regularly:
sudo apt update
sudo apt upgradeAfter upgrades that affect Nginx, check the service and configuration:
sudo nginx -t
sudo systemctl status nginxKeep an eye on certificate renewal rather than assuming the timer is working. A periodic sudo certbot renew --dry-run provides an explicit test, and the browser’s certificate date gives a second confirmation.
Back up what would be expensive to recreate
- Website files under
/var/www/example.com. - Nginx files in
/etc/nginx/sites-availableand enabled-site symlinks. - Certificate and renewal configuration managed by Certbot.
- Any application data or database that you add later.
Use provider snapshots or another backup destination, and periodically confirm that a backup can actually be restored. A snapshot is not a substitute for documenting the domain, DNS records, firewall rules and deployment steps.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDocument recovery
Record the VPS public IP, the administrative account name, where the SSH key is stored, the DNS host, the location of the recovery console and the commands used to test Nginx and Certbot. If the server becomes unreachable, this information lets you recover methodically instead of rebuilding from memory.
How to evaluate a VPS before buying
Prices, quotas and included features change by provider and region, so verify the current plan page before committing. For a first website, compare the operational details that determine whether you can complete and maintain this workflow:
Quick Recap
| Decision area | What to verify |
|---|---|
| Ubuntu images | An available, current Ubuntu release and the ability to reinstall or rebuild the server. |
| Account and SSH workflow | SSH-key support, console access and a clear way to create non-root users. |
| Firewall and network controls | Whether a provider-level firewall exists in addition to UFW, and how ports 22, 80 and 443 are managed. |
| DNS tools | Convenient editing for apex and www records, with clear propagation information. |
| HTTPS automation | Documentation for Certbot, inbound port requirements and renewal monitoring. |
| Snapshots and backups | How snapshots are created, retained and restored, and what data they include. |
| Support and recovery | Availability of a console, recovery mode and support in the regions where you operate. |
| Region | A location suitable for your audience and compliance requirements. |
| Recurring cost | The current monthly compute, storage, bandwidth, backup and public-IP charges. |
The finished launch checklist
- Ubuntu is updated and you can log in with a sudo-capable non-root account.
- The recovery console is available.
- Nginx is installed and running.
- UFW allows SSH before it is enabled, plus the required HTTP and HTTPS traffic.
/var/www/example.com/html/index.htmlcontains the intended page.- The server block names both
example.comandwww.example.com. sudo nginx -tsucceeds before each reload.- Both DNS A records point to the VPS public IPv4 address.
- HTTP and HTTPS reach the intended site.
- Certbot installed a certificate for both names and
sudo certbot renew --dry-runsucceeds. - Backups, patching and recovery instructions are documented.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
