How to Set Up a VPS Server: Step-by-Step Guide

Setting up a VPS takes five steps: connect to the server over SSH, create a non-root user with sudo access, install system updates, turn on a firewall, then deploy your app. This guide walks through each one with copy-paste commands so you can go from a fresh IP address to a running, secured server in under an hour. No prior server administration experience is assumed, though basic comfort with a terminal helps.

A VPS (virtual private server) gives you a slice of a physical machine with your own operating system, root access, and dedicated resources. Once you know how to set up a VPS properly, you can host websites, game servers, APIs, or personal projects without paying for a full dedicated box.

How to set up a VPS: step 1, choose your OS and connect via SSH

When you order a VPS, you pick an operating system image. For most people, a long-term-support Linux distribution is the right call. Ubuntu Server LTS and Debian are the two most beginner-friendly options, with the widest set of tutorials and package availability. If you specifically need Windows, most providers offer Windows Server images you reach over RDP instead of SSH, but this guide focuses on Linux.

After provisioning, your host gives you three things: the server's IP address, a username (usually root), and either a password or the ability to add an SSH key. On Bytehosty, you set the OS and root credentials from the Virtualizor panel and the VPS is live in minutes.

To connect from macOS or Linux, open a terminal and run:

ssh root@YOUR_SERVER_IP

On Windows 10 or later, the same command works from PowerShell or Windows Terminal. The first time you connect, you will see a prompt asking you to confirm the server's fingerprint. Type yes, then enter your password.

If you were given an SSH key instead of a password, point to it with the -i flag:

ssh -i ~/.ssh/your_key root@YOUR_SERVER_IP

Key-based login is more secure than a password and you will switch to it fully in the next step.

Step 2: Create a non-root user and lock down access

Logging in as root all the time is dangerous. One wrong command can destroy the system, and root is the first account attackers target. According to Cloudflare's 2025 analysis of authentication traffic, over 94% of authentication requests came from bots rather than humans, and leaked credentials were used in over 44% of human authorization requests (Cloudflare, 2025). A brand-new VPS starts getting probed within minutes, so hardening login is the first thing to do.

Create a new user (replace alex with your chosen name):

adduser alex

Give that user administrative rights by adding it to the sudo group:

usermod -aG sudo alex

Now set up SSH key authentication for the new user so you can stop using passwords. On your local machine, generate a key pair if you do not already have one:

ssh-keygen -t ed25519

Copy the public key to the server:

ssh-copy-id alex@YOUR_SERVER_IP

Log out, then log back in as the new user to confirm it works:

ssh alex@YOUR_SERVER_IP

Once you can log in as alex with your key, harden the SSH daemon. Open the config file:

sudo nano /etc/ssh/sshd_config

Set these three values, adding the lines if they are missing:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Save the file, then restart SSH:

sudo systemctl restart ssh

Root can no longer log in directly, and password guessing no longer works because only your key is accepted. For a deeper look at why this matters and what a protected server stack includes, see our guide on VPS hosting with DDoS protection.

Step 3: Install updates, a firewall, and essential packages

Fresh server images ship with software that already has known fixes waiting. Unpatched systems stay exposed for a long time: CISA added 245 vulnerabilities to its Known Exploited Vulnerabilities catalog in 2025, roughly 20% growth over the prior year (The Cyber Express, 2025). Patch first.

On Ubuntu or Debian:

sudo apt update && sudo apt upgrade -y

Next, turn on a firewall. UFW (Uncomplicated Firewall) is the simplest option. Allow SSH first so you do not lock yourself out, then enable it:

sudo ufw allow OpenSSH
sudo ufw enable

Check what is open at any time with:

sudo ufw status

Only open ports you actually use. If you plan to run a website, add HTTP and HTTPS:

sudo ufw allow 80
sudo ufw allow 443

A few packages make life easier on a new server. Install them together:

sudo apt install -y curl git ufw fail2ban

fail2ban watches your logs and temporarily bans IP addresses that fail login repeatedly, which cuts down brute-force noise automatically. It starts working as soon as it is installed.

Step 4: Point a domain and deploy your first app

With the server secured, you can put something on it. Most first projects are a website or a small web app, so install the Nginx web server:

sudo apt install -y nginx

Nginx starts serving a default welcome page immediately. Open http://YOUR_SERVER_IP in a browser and you should see it. If you do not, confirm ports 80 and 443 are allowed in UFW.

To use a real domain instead of the raw IP, log in to your domain registrar or DNS provider and create an A record:

• Type: A
• Name: @ (for the root domain) or www
• Value: your server's IP address

DNS changes are not instant. Propagation usually finishes within an hour but can take longer. You can watch the current record with:

dig +short yourdomain.com

When it returns your server IP, point Nginx at your domain by editing the server block in /etc/nginx/sites-available/default and setting server_name yourdomain.com www.yourdomain.com;. Test and reload:

sudo nginx -t && sudo systemctl reload nginx

Finally, add free HTTPS with a Let's Encrypt certificate. Certbot automates the whole process. Follow the official instructions for your setup on the Certbot documentation, maintained by the Electronic Frontier Foundation. In a couple of prompts it issues a certificate and reconfigures Nginx to redirect traffic to HTTPS.

At this point you have a live, secured server answering on your own domain. Deploying a specific app (a Node.js API, a Python service, a Minecraft server) follows the same pattern: install the runtime, open the port you need, and run the process behind a service manager like systemd.

Step 5: Common beginner mistakes and how to avoid them

A few habits separate a stable server from one that gets compromised or breaks in a week.

That last point is worth planning for before you launch anything public. Bytehosty includes AS203446 SmartMitigate DDoS protection and unmetered traffic on every KVM plan, so attack traffic is filtered upstream rather than eating your bandwidth or knocking your service offline.

Next steps

You now have a working method for standing up a VPS: connect, create a secure user, patch, firewall, and deploy. The best way to lock in what you learned is to build something real on a low-cost plan you control end to end. Spin up a Bytehosty KVM VPS, run through these five steps on it tonight, and by morning you will have a hardened server hosting a project of your own.