Your First Hostinger VPS: OS Choice, Panel and Hardening

What you are actually buying

A Hostinger VPS is a KVM virtual machine with full root access and no managed layer on top. Hostinger runs the hardware, the network and the hypervisor. Everything inside the operating system — updates, firewall rules, the web server, the database, backups of your own data — is yours.

That is the trade. You get more control and more performance per dollar than shared hosting, and in exchange nobody is going to fix your broken nginx config at 2am. If that sentence sounds like a bad deal, a Cloud Startup plan is the better answer and you can stop here.

If it sounds fine, the rest of this guide is the setup order that avoids the mistakes people make in their first week.

Choosing a plan

Every KVM plan includes AMD EPYC processors, NVMe storage, a 1 Gbps network, one IPv4 and one IPv6 address, full root access, a free domain for the first year, free weekly backups, firewall management, an AI web terminal and a public API.

Two things about those numbers. The promotional rates require the 24-month term paid upfront, and the renewal rate is what you will actually pay in year three — the gap between $8.99 and $14.99 on KVM 2 is the one that catches people. Second, RAM is usually the constraint that arrives first, not CPU. A LAMP stack with a panel idles at around 1 GB, so KVM 1’s 4 GB is comfortable for one site and tight for two.

A rule of thumb worth trusting: size for memory first, then CPU. Most small VPS problems are the out-of-memory killer arriving silently at 3am, not a CPU bottleneck.

The OS decision

You choose a template when you create the server, and reinstalling later wipes everything, so it is worth thirty seconds of thought.

Pick a clean OS if you intend to install a control panel, because the panels expect to own the web server configuration. Pick a 1-click app if you want one thing running quickly and do not plan to customise much underneath it.

The dashboard is not hPanel

This confuses almost everybody at first. Your VPS shows up in hPanel’s sidebar, but hPanel manages Hostinger’s shared, cloud and email products. The server itself is managed from the VPS dashboard, which is where you:

• Reinstall or change the operating system
• Read the root password or add an SSH key
• Set firewall rules at the network layer
• Take snapshots and restore them
• Watch CPU, RAM, disk and bandwidth graphs

If you cannot find a server setting in hPanel, it is in the VPS dashboard. Our hPanel tour covers what the shared-hosting side of the panel does, and the two do not overlap.

Hardening, in the right order

Do these five things before you install anything else. Each one takes a few minutes and each one removes a class of problem permanently.

1. SSH key authentication

Generate an ed25519 key pair on your own machine:

ssh-keygen -t ed25519 -C "you@laptop"

Add the public key to the server when you create it, or afterwards through the VPS dashboard. Then confirm you can log in with the key before you change anything else — this is the step where people lock themselves out by disabling passwords first.

2. A non-root user

Create a normal account and give it sudo rights:

adduser deploy
usermod -aG sudo deploy

Copy your public key into /home/deploy/.ssh/authorized_keys and set the permissions to 700 on the directory and 600 on the file. From now on you log in as deploy and escalate with sudo when needed. Working as root for everything means one mistyped command can destroy the server instead of returning permission denied.

3. Turn off password login

Edit /etc/ssh/sshd_config and set:

PasswordAuthentication no
PermitRootLogin no

Restart the SSH service. Now keep your current session open and open a second terminal to test a fresh connection. If the new connection works, close the first one. If it does not, you still have a session in which to fix the mistake — which is the entire reason for testing this way.

4. The firewall

Allow SSH before anything else, or you will lock yourself out of a remote machine.

On Ubuntu and Debian:

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

On AlmaLinux and Rocky, use firewall-cmd with the equivalent rules.

Then check the firewall in the VPS dashboard as well. It operates at a different layer and can drop traffic before it reaches your server, which produces the confusing situation where your server’s rules say the port is open and connections still time out.

5. Unattended security updates

Install unattended-upgrades on Debian-family systems or dnf-automatic on Red Hat-family systems and enable the security repository. This handles the steady stream of package vulnerabilities without you remembering to run updates.

Kernel updates still need a reboot, so either schedule one or configure automatic reboots during a maintenance window. A server that has been up for four hundred days is not a badge of honour; it is a machine running a four-hundred-day-old kernel.

Choosing a control panel

You do not need one, but if you are hosting websites rather than containers, one will save you a lot of time.

The pattern that works: if you are replacing shared hosting with a VPS to host a few websites, install CloudPanel and stop thinking about it. If you need mail, CyberPanel. If you are building an application and deploying from Git, skip the panel and use Docker.

Whichever you choose, install it on a clean OS, and take a snapshot from the VPS dashboard before you do. Snapshots are the fastest rollback available and they cost you nothing but a couple of minutes.

Domain, DNS and TLS

Point the domain at the VPS’s IP address, either by changing nameservers or by adding an A record — both routes are covered in our domain pointing guide. Unlike shared hosting, there is no automatic SSL here: your panel handles certificates, and most panels issue and renew Let’s Encrypt certificates for you once DNS resolves.

If you are running Docker without a panel, use a reverse proxy such as Caddy or Traefik for automatic certificate issuance rather than managing certificates by hand.

Where the VPS stops making sense

A self-managed VPS is the wrong purchase if you want someone else to handle updates, if you are not comfortable in a terminal, or if the site is a business asset that cannot afford you being unavailable. The performance is real, but so is the responsibility.

If you are still deciding, the honest comparison is between a $12.99 KVM 4 and a Cloud Startup plan at $7.99 with 4 CPU cores, 4 GB RAM and 100 GB NVMe — on paper the managed plan wins on price and resources, and the VPS wins on control. The plan comparison lays the specs side by side, and the plan finder will tell you which side of that line you are on in about thirty seconds.