Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To turn a Linux VPS into a production web server, secure the operating system first, install one web server, create a site configuration, point DNS to the VPS, enable HTTPS, and add only the application components your workload requires. A static site needs fewer services than a PHP, Python, Node.js, or database-backed application, but every deployment needs controlled access, tested configuration, logs, backups, and a renewal plan for certificates.
What a “full” web server includes
A VPS becomes a web server when it can accept requests from the internet and return your site’s content. The smallest useful stack has four parts:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- A supported Linux distribution with administrative access.
- A web server such as nginx or Apache2 listening on TCP ports 80 and 443.
- DNS records that resolve your domain to the VPS public IP address.
- TLS certificates and a renewal process for HTTPS.
Dynamic workloads add services rather than changing that foundation. A PHP application commonly needs PHP-FPM and a database. Applications written in Node.js, Python, or Ruby may need a runtime, a process manager, and a reverse-proxy arrangement. You might also need queues, object storage, centralized logs, monitoring, and scheduled jobs. Ubuntu documents PHP, MySQL, PostgreSQL, Apache2, and nginx as separate services; there is no single mandatory “full stack.”
Before you change the VPS
Confirm access and recovery options
Use a currently supported Linux release and record the VPS public IPv4 address. Confirm that you control the domain’s DNS zone and that you can reach the provider’s console or recovery environment. Keep the provider console available while changing SSH or firewall settings: a mistake in either can lock you out even when the operating system is healthy.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Do not close the only working SSH session while changing authentication. Open a second session and test it before ending the first one. If your provider supplies a snapshot facility, take a clean snapshot before major changes and document how to restore it.
Create a named administrator
Use a personal, named account with sudo rather than performing routine work as root. The exact command depends on the distribution, but on Ubuntu the normal sequence is:
- Create the user with
sudo adduser deployadmin. - Grant administrative privileges with
sudo usermod -aG sudo deployadmin. - Open a new SSH session as
deployadminand run a harmless command such assudo -vto verify that elevation works.
Use SSH keys, protect the private key, and restrict administrative login after the new path has been tested. Where practical, permit SSH only from trusted source networks. Keep application processes under their own least-privilege accounts instead of using the administrative user.
Patch and harden the base operating system
Refresh package indexes and install available security and maintenance updates before exposing a service:
sudo apt update
sudo apt full-upgradeReboot when the package manager or kernel requires it, then verify that SSH still works. Enable unattended security updates if they fit your change-control process. Automatic updates reduce the time a known vulnerability remains unpatched, but they do not replace application updates, review, or backups.
Remove software and listening services you do not need. Store secrets outside the document root, use restrictive file permissions, and avoid placing database credentials in files that the web server can serve as static content. Record the operating system version, installed runtimes, service names, and configuration locations so another administrator can recover the host.
Configure the firewall before publishing the site
Ubuntu’s default firewall frontend is ufw, built on the kernel’s Netfilter packet-filtering system. Permit the SSH port you actually use, plus web traffic on TCP 80 and 443. A typical Ubuntu sequence is:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseReplace port 22 if SSH uses another port, and substitute your own restricted source range when you can limit SSH by address. Do not expose database, cache, queue, or internal administration ports to the public internet unless a documented requirement demands it. Bind those services to localhost or a private network.
Many VPS providers add a network firewall outside the machine. Apply an equivalent policy there and check both layers. A provider rule can block a correctly configured host, while a permissive provider rule cannot override a host firewall that is denying traffic.
Choose nginx or Apache2
Both servers can host static files, terminate TLS, and proxy requests to an application. Choose based on the workload and the team’s operating knowledge rather than an assumed universal performance winner.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Decision factor | nginx | Apache2 |
|---|---|---|
| Per-site configuration | Server blocks, commonly kept in /etc/nginx/sites-available and enabled through /etc/nginx/sites-enabled. |
VirtualHost files, commonly managed under /etc/apache2/sites-available and the corresponding enabled-site structure. |
| Typical fit | New sites, static delivery, and reverse-proxy front ends. | Applications that require Apache modules, .htaccess behavior, or an established LAMP operating standard. |
| Application gateway | Can proxy to an upstream service or pass requests to PHP-FPM. | Can serve through modules and proxy mechanisms appropriate to the application. |
| Configuration check | sudo nginx -t |
sudo apache2ctl configtest |
Do not let both services bind the same public ports. Decide which process owns 80 and 443, and check listeners before starting the second service:
sudo ss -ltnpSet up a site with nginx
Install and create a document root
sudo apt update
sudo apt install nginx
sudo mkdir -p /srv/example.com/html
sudo chown -R deployadmin:deployadmin /srv/example.com/html
printf '%sn' '<h1>example.com is online</h1>' | sudo tee /srv/example.com/html/index.htmlChoose ownership deliberately. A deployment account may own release files while nginx only needs read access; do not make the web-server account the owner of writable application code unless the application genuinely requires it.
Create and enable a server block
Create /etc/nginx/sites-available/example.com:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /srv/example.com/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
access_log /var/log/nginx/example.com.access.log;
error_log /var/log/nginx/example.com.error.log;
}Enable it with a symbolic link, test the complete configuration, and reload only after the test succeeds:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo nginx -t
sudo systemctl reload nginxIf the distribution’s default site would answer requests for an unknown host, disable it after confirming your own server block works:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginxFor a dynamic application, replace the static try_files behavior with a carefully scoped proxy or FastCGI location. Keep the upstream service bound to localhost or a private address, and do not expose its development port directly.
Set up a site with Apache2
Install and create the document root
sudo apt update
sudo apt install apache2
sudo mkdir -p /srv/example.com/html
sudo chown -R deployadmin:deployadmin /srv/example.com/html
printf '%sn' '<h1>example.com is online</h1>' | sudo tee /srv/example.com/html/index.htmlApache’s configuration is kept under /etc/apache2. Separate each domain’s files and logs so that an incident or migration does not require untangling unrelated sites.
Create and enable a VirtualHost
Create /etc/apache2/sites-available/example.com.conf:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /srv/example.com/html
<Directory /srv/example.com/html>
Options -Indexes +FollowSymLinks
AllowOverride None
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
</VirtualHost>Enable the site, test syntax, and reload:
sudo a2ensite example.com.conf
sudo apache2ctl configtest
sudo systemctl reload apache2If the application depends on .htaccess, enable only the overrides it needs and understand the resulting security and performance implications. For PHP or another runtime, enable the matching Apache integration or proxy arrangement rather than placing an interpreter in the public document root.
Point DNS at the VPS
At your DNS provider, create an A record for the domain that contains the VPS IPv4 address. Add an AAAA record only when the VPS has working IPv6 configured and the web server and firewall accept IPv6 traffic. Add a separate record for www if you intend to serve that hostname.
Wait for the records to resolve before requesting a certificate. Check from outside the VPS:
dig +short example.com A
dig +short example.com AAAAThe returned address must be the VPS address. If an old address appears, check authoritative nameservers, record names, and DNS proxy settings. A local hosts-file entry can make a site appear to work on one computer while public DNS is still wrong.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Enable HTTPS with Let’s Encrypt
Meet the HTTP-01 requirements
Let’s Encrypt is a free, automated certificate authority trusted by major browsers and clients. Its ACME HTTP-01 challenge requires the registered domain to point to the server and TCP port 80 to be reachable from the internet during issuance and renewal. Keep port 80 open even when every normal visitor is redirected to HTTPS.
Check that DNS resolves correctly, the selected web server is running, and the provider firewall permits port 80 before invoking Certbot. If a CDN, load balancer, or second server answers the hostname, the challenge must still reach the machine running the ACME challenge.
Request the certificate with the matching plugin
Install Certbot using the distribution-supported method, then use the plugin for the server that owns the site:
sudo certbot --nginx -d example.com -d www.example.comFor Apache2, use:
sudo certbot --apache -d example.com -d www.example.comThe plugin writes certificate directives and can reload the service. Read each prompt: choose whether HTTP requests should redirect to HTTPS, and confirm that every hostname in the certificate is one you control and intend to serve.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUnderstand the TLS configuration
An nginx HTTPS server block needs listen 443 ssl, a certificate path, a private-key path, and suitable TLS protocols. Certbot normally inserts these directives. Restrict private-key permissions while keeping the key readable by the nginx master process. Never place the private key in the document root or commit it to source control.
After issuance, visit both the bare domain and any intended aliases. Confirm the certificate name covers the hostname, the browser receives a complete chain, and HTTP redirects to HTTPS without a loop. Only force HSTS after you are confident that every required hostname and subdomain is correctly served over HTTPS.
Test automatic renewal
Let’s Encrypt certificates are valid for 90 days. Certbot normally installs a systemd timer that attempts renewal twice a day. Test the complete renewal path without replacing a live certificate:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
sudo certbot renew --dry-run
systemctl list-timers | grep -i certbot
sudo systemctl status certbot.timerThe nginx and Apache integrations reload the service after a successful renewal. If your deployment uses a custom proxy or application gateway, add an explicit renewal hook that reloads the service and test that hook. A certificate that renews on disk but is not loaded by the running process will still appear expired to visitors.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Add only the runtime services your application needs
Static site
For HTML, CSS, JavaScript, images, and downloadable files, the web server, document root, DNS, TLS, and logs are sufficient. Keep uploads in a controlled directory, disable directory listing unless it is intentional, and set cache headers appropriate to your release process.
PHP application
A PHP site generally uses PHP-FPM behind nginx or an Apache PHP integration, plus a database when the application requires one. Keep the database on localhost or a private network, create a database user with only the required privileges, and store credentials outside the web root. Do not expose a database port merely to make administration convenient.
Node.js, Python, Ruby, or another service
Run the application as a dedicated non-root user under a process manager or service supervisor. Bind it to localhost or a private interface, then have nginx or Apache proxy public requests to it. Define restart behavior, environment variables, log destinations, health checks, and a rollback path before launch. The reverse proxy should be the only component handling public TLS and internet-facing ports unless your architecture deliberately requires otherwise.
Validate before announcing the site
Use this sequence after every substantial configuration change:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Run
sudo nginx -tfor nginx orsudo apache2ctl configtestfor Apache2. - Reload the service, then inspect
sudo systemctl status nginxorsudo systemctl status apache2. - Resolve the hostname from an external network and confirm that it returns the VPS address.
- Request the HTTP URL and verify the intended redirect behavior.
- Request the HTTPS URL and inspect the certificate name, chain, and expiry.
- Load representative static assets and exercise an application health endpoint.
- Review recent access and error logs for unexpected status codes, permission errors, or upstream failures.
- Check that only intended ports are reachable from outside the VPS.
- Run
sudo certbot renew --dry-runand record the renewal timer status.
Test from a network other than the VPS itself. Local success can hide provider firewall rules, incorrect public DNS, broken IPv6, or a proxy that is answering only from one location.
Operate the server after launch
Patch and monitor
Keep the operating system, web server, runtimes, libraries, and application dependencies patched. Monitor disk space, memory, load, service health, certificate expiry, request latency, and error rates. Configure log rotation or central collection so a busy access log cannot fill the filesystem and stop the application.
Back up data and test restoration
Back up application files, databases, deployment configuration, and any user-uploaded data. Store copies separately from the VPS and protect them with appropriate access controls. Schedule restoration tests; a backup that has never been restored is only an assumption.
Document change and recovery procedures
Record the provider console path, DNS records, firewall rules, service ownership of ports 80 and 443, deployment commands, certificate locations, renewal hooks, and rollback steps. Before a migration or risky update, know which snapshot, package version, or release can be restored and who can authorize that action.
Common failures and the fastest checks
SSH stopped working after hardening
- Use the provider console or recovery environment instead of repeatedly changing rules remotely.
- Check that the SSH daemon is running and listening on the port allowed by both firewalls.
- Verify the key, username, source-address restriction, and file permissions.
The browser shows the wrong site or a default page
- Confirm the hostname resolves to the VPS rather than an old address.
- Check that the nginx server block or Apache VirtualHost contains the exact
server_name,ServerName, and aliases. - Verify the site is enabled and reload the service after a successful configuration test.
- Inspect access logs to see which host and path the server received.
Certbot cannot complete the challenge
- Confirm public DNS for every requested hostname.
- Allow TCP 80 in both the VPS firewall and provider firewall.
- Ensure the hostname reaches this VPS, not a different backend or proxy.
- Check that another service has not claimed port 80 and that the web server can serve the challenge path.
The application returns 502 or 503
- Check that the upstream process is running and listening on the address and port configured in the proxy.
- Verify the proxy user can reach the socket or TCP endpoint.
- Read both the web-server error log and the application’s service log.
- Confirm that a recent deployment did not change the runtime, environment variables, permissions, or database connection.
Production readiness checklist
- Supported Linux release is patched.
- Named sudo account and tested SSH-key access exist.
- Provider console or recovery access is available.
- Only the intended SSH, HTTP, and HTTPS paths are allowed publicly.
- Exactly one service owns public ports 80 and 443.
- Each domain has an isolated document root, configuration, and log files.
- DNS A and, when deliberately configured, AAAA records resolve correctly.
- HTTPS works for every published hostname and HTTP redirects as intended.
- Certificate renewal dry run succeeds and the timer is enabled.
- Databases and internal runtimes are private, not publicly exposed.
- Logs, monitoring, backups, restoration tests, and rollback instructions are in place.
A Linux VPS is a dependable web host when its public surface is small, its configuration is tested before reloads, and its operational obligations are treated as part of the web server rather than as optional extras. Start with the smallest stack that serves the workload, then add runtimes, data services, and automation only when the application requires them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
