A VPS for a small business

What a small business actually needs

Most small businesses need four things online, and only one of them is a server. You need a domain that is yours, a website that loads, email that arrives, and a way to get your data back when something goes wrong. Everything else is a preference.

A virtual server is a good way to provide the second of those. It is a poor way to provide the third, and it provides the fourth only if you set that up deliberately. Keep those distinctions in mind and the rest of this guide is mostly arithmetic.

Three ways to host it

Shared hosting

Cheapest, most constrained. Your site sits in a directory on a machine full of other people’s sites. Fine for a brochure site that will not change much. You get the software versions the host offers and the performance your neighbours leave behind.

A self-managed VPS

Your own machine, your own root password, any software you like, and complete responsibility for keeping it patched and backed up. Cheap for what you get, and a real job — small, but never zero, and it does not pause when you are busy.

Managed hosting

Someone else runs the machine and is accountable for the site being up. Ours starts at $29.00 a month with the server included, 1 website and first reply within 4 business hours. More expensive per unit of hardware, and the correct answer for a business with nobody in-house who wants the work.

The comparison in full, with backups counted on both sides, is on the managed versus self-managed page.

The whole bill, not the headline

Hosting is advertised as one number and paid as three or four. For a small business running a single production site on our recommended plan, the honest total looks like this:

• The server — VPS-4: 4 vCPU, 8 GB RAM, 80 GB NVMe, 3 TB of transfer, at $23.90 a month with no setup fee.
• Nightly backups — $4.78 a month, being 20% of the plan price. Optional, and you should not treat it as optional.
• The domain — $13.49 for the first year of a .com and $13.49 a year afterwards, with WHOIS privacy included rather than sold back to you.
• Email — a separate hosted mailbox service, bought from somebody who does only that. See below for why.
• Tax — every price we publish excludes it. What applies depends on where you are and whether you give us a business tax number, so it is calculated at checkout.

That is $28.68 a month for server and backups, $357.65 across the first year once the domain is in. Paying twelve months of the server up front takes 10% off — $258.12 instead of $286.80 — though monthly remains the default we recommend, because a prepaid term is not refunded if you change your mind.

How big a server

Start at VPS-4. It is the smallest size where a normal web stack has a second core to fall back on, which is why it is our default recommendation and why most “my site is slow” tickets from smaller plans end with the same advice.

• VPS-2 at $14.90 — one low-traffic site with a page cache in front of it. Adequate, not comfortable.
• VPS-4 at $23.90 — a production site with its database beside it. The right starting point for most businesses.
• BD-8 at $11.90 — logged-in users, a shop with carts, or several small sites on one machine.

Resizing up happens in place from the panel and keeps the same IP address, so starting in the middle and moving up is cheap. Resizing down needs a rebuild, so starting too big is the more expensive mistake. The sizing guide goes through the reasoning properly.

What to keep off the server

Email, above all

Do not run your own mail server. Deliverability is a full-time discipline involving reputation, authentication records, blocklists and years of accumulated sending history, and losing an invoice to a spam folder costs more than the mailbox service you were avoiding. Buy hosted mailboxes and point your MX records at them. Your server hosts the website; somebody else hosts the mail.

Card details

Use a payment processor and let the card data live with them. Storing card numbers yourself takes you into compliance obligations that are wildly out of proportion to a small business’s revenue.

Your only copy of anything

A backup on the same machine is not a backup; it is a second copy of a single point of failure. Our nightly backups are stored off the host, and a snapshot is free to take before any risky change. Whatever you choose, make sure one copy is somewhere the server cannot reach.

The six things to get right

1. 1Updates. Apply security updates on a schedule you actually keep. Nobody is going to remind you on a self-managed server.
2. 2SSH keys, not passwords. Disable password authentication entirely. This single change removes most of the automated attacks you will otherwise see in your logs from the first hour.
3. 3A firewall that denies by default. Open the ports you need and nothing else. Your database does not need to be reachable from the internet.
4. 4Backups you have restored. Turn them on, then restore one to a throwaway server and confirm the result works. A backup nobody has tested is a rumour.
5. 5HTTPS, renewed automatically. Free certificates are a solved problem. Set up automatic renewal and then confirm it renewed, sixty days later, rather than assuming.
6. 6Know where the console is. The browser console reaches the machine when SSH is what you broke. Find it before you need it, not during.

When not to buy a VPS

We would rather sell you the cheaper thing than the wrong thing, so here is the case against. Do not buy a self-managed server if nobody in the business wants the job of running it. It is not a large job, but it is a recurring one, and it is exactly the sort of task that slips when the business gets busy — which is precisely when an unpatched server becomes expensive.

Signs the managed plan is the right purchase: nobody reads release notes, the last backup restore was never, the site goes down and you find out from a customer, or the person who set it up has left. In those cases the $29.00 a month is not an indulgence — it is cheaper than one bad weekend.

A first month that works

1. 1Register or transfer in the domain, and leave the DNS pointing at the old site while you build.
2. 2Deploy VPS-4 in the region nearest your customers — we have 48, all at the same price. Choose a Linux image and take an hour to set up SSH keys, the firewall and updates.
3. 3Build or migrate the site, and run it on the server’s IP address until it behaves exactly as it should.
4. 4Turn on backups, then restore one to a temporary server to prove the restore works. Destroy the temporary server afterwards — it costs pennies by the hour.
5. 5Lower the DNS TTL a day in advance, cut over, and watch the logs for an hour. Put the TTL back afterwards.
6. 6Diarise a monthly half hour for updates and a quarterly restore test. That is the whole ongoing job, and doing it is what makes the self-managed option the cheaper one.