How to Choose and Set Up Your First VPS
Choose the operating workflow before you compare plans. Hostinger keeps more recovery and Docker tasks in a browser dashboard. Hetzner exposes network, image, SSH key, firewall, backup and cloud-init choices in the server creation flow. DigitalOcean documents a production baseline built around SSH keys, a non-root user, monitoring, backups and user data.
Choose the workflow, not a universal winner
All three options give you a Linux server with administrative control. The meaningful difference for a first server is where the setup and recovery work happens. Start with the row that matches how you want to operate the machine after checkout.
| Provider path | What the official workflow exposes | Choose it when | Commercial path |
|---|---|---|---|
| Hetzner Cloud | Plan, location, OS image, public or private networking, SSH key, cloud firewall, backups and cloud-init can be chosen around server creation. | You want infrastructure controls before first boot and are comfortable using a terminal after that. | Open Hetzner → |
| Hostinger VPS | The dashboard groups a browser terminal, Docker Manager, OS controls, SSH keys, firewall, monitoring, snapshots, backups and emergency mode. | You prefer browser controls for common setup and recovery tasks while retaining root access. | Open Hostinger → |
| DigitalOcean Droplets | The recommended setup joins SSH keys, a VPC, IPv6, monitoring, backups and cloud-init user data with a non-root administrative user. | You want a documented production baseline that can later be repeated through user data or the command line. | Open DigitalOcean → |
The provider links above are affiliate links. They lead to the same three destinations used on the previous version of this page. Provider documentation remains the source for product behavior.
Seven checks before you create the server
- Confirm that the VPS is self-managed. Root access is control, not administration by the provider. Decide who will install updates, watch disk use and respond when a service stops.
- Use the application's own requirements. Pick the smallest plan that meets the software vendor's documented RAM, CPU, storage and architecture requirements. Resize after observing the workload instead of buying from a generic score.
- Choose the region for the users and data. Latency, data location and available services can matter more than another CPU tier.
- Add an SSH key during creation. Hetzner notes that a key cannot be added later through its Console to an already created server. Hostinger and DigitalOcean also expose key-based setup in their documented workflows.
- Decide which ports must be public. A new web server usually needs SSH first, then HTTP and HTTPS when the web service is ready. A database or cache should not become public merely because the default installation listens on a port.
- Read the backup scope. A disk image is not automatically an application-consistent backup. Hetzner explicitly excludes attached Volumes from server backups and snapshots.
- Locate recovery access before changing SSH. Know where the browser console, emergency mode or rescue path is. This is the route back in if a firewall or SSH change locks you out.
First boot sequence for an Ubuntu VPS
This sequence is deliberately conservative. Keep the original session open until the replacement login works, and use the provider's recovery console if a step behaves differently from its documentation.
1. Create the SSH key locally
Run ssh-keygen on your own computer and add only the public key to the provider. Protect the private key and do not paste it into a web form or support message.
2. Create the server from a supported LTS image
Ubuntu recommends a Long Term Support release for servers. Select the current supported LTS image offered by the provider, attach the SSH key and record the server IP, region and image before you leave the creation screen.
3. Apply the cloud firewall without losing SSH
Allow SSH from your own IP before applying a restrictive inbound policy. Add ports 80 and 443 only when the web service needs them. Hetzner's firewall documentation states that connections not covered by an inbound allow rule are dropped. A changing home IP needs a recovery plan before you narrow the rule.
4. Create a non-root administrative user
DigitalOcean's production setup uses a sudo user for routine work and key-only SSH access. Create that user, copy the authorized key with the correct ownership and permissions, then open a second terminal and prove the new login works. Disable a login method only after that check passes.
5. Update the system and confirm automatic security updates
Install pending updates, reboot if the system requires it and reconnect. Ubuntu includes unattended-upgrades in supported Server installations, but the configuration still needs checking. Its default coverage does not automatically extend to every third-party repository.
6. Add a host firewall as a second control
Ubuntu documents ufw as its default firewall configuration tool. Allow the SSH service before enabling it, verify the resulting rules with sudo ufw status verbose, then add only the application ports you intend to serve. The provider firewall and host firewall solve related problems at different layers.
7. Configure backups and prove one restore path
Enable the provider backup option you selected, then add an application-level backup for data that must survive a server loss. Store at least one copy outside the VPS. Our editorial rule is simple: a backup is not a recovery plan until you have restored a sample and written down the steps.
Three mistakes that turn a first VPS into repair work
Closing SSH too early
A firewall rule, disabled password login or changed SSH configuration can end the only working session. Test a second key-based login first.
Treating a snapshot as every backup
Read which disks and volumes are included. Keep application data and secrets in a separately tested backup path.
Installing before defining the ports
List the public services first. Databases, dashboards and caches normally need a private path or a narrow allow rule, not open internet access.
Use the checklist while creating the server
Hetzner's creation screen exposes the key, firewall, backup and cloud-init choices described above. Recheck the current plan and region in the provider interface before purchase.
Open Hetzner Cloud →Continue with the task you actually want to run
Official sources checked
These sources were checked on October 21, 2026. Product interfaces and policies can change, so confirm the provider page again when you create the server.