Install HestiaCP on a VPS (2026): Ubuntu Hosting Panel, Nginx/Apache, Email, SSL, Backups and Security Hardening

HestiaCP is an open-source hosting control panel that lets you manage from one backend:

• Web domains, Nginx/Apache templates and multiple PHP versions;
• MariaDB/MySQL databases and phpMyAdmin;
• DNS zones and records;
• Exim, Dovecot, Webmail, DKIM and email accounts;
• Users, packages, quotas, cron jobs and backups;
• Firewall, Fail2Ban, service status and system updates.

It is especially suited to the need for "a small number of ops staff managing many sites." If you are only deploying a container application, Docker Compose plus Caddy is often more transparent; if you need multi-user teams, site packages and traditional shared-hosting features, HestiaCP saves more time.

You can first read the VPS control panel comparison, then decide based on the differences below:

If you care more about modern PHP site hosting and do not need self-hosted email, you can also compare with the CloudPanel installation tutorial. Do not install multiple control panels that take over Nginx, the database and the firewall on the same server.

As of August 2026, the latest official stable version of HestiaCP is 1.10.4. It officially supports 64-bit AMD64/x86_64 and ARM64/aarch64, and lists Debian 11, 12, 13 as well as Ubuntu 22.04, 24.04, 26.04 LTS.

The official minimum configuration is 1 core, 1GB RAM and 10GB disk, but 1GB is only suitable for a lightweight environment with ClamAV and SpamAssassin disabled. In practice, choose based on the service combination:

Prefer SSD/NVMe for disk, and confirm the VPS uses KVM or fully featured virtualization. Email, databases and backups continuously generate small files and random I/O, and a disk with large capacity but poor random performance will slow down panel operations.

The HestiaCP installer deploys and configures components such as Nginx, Apache, PHP-FPM, MariaDB, Exim, Dovecot, BIND, Fail2Ban and iptables. If the machine already has Baota, 1Panel, Docker port mappings, hand-written Nginx or an existing database, the installer may overwrite configurations, occupy the same ports, or even take existing websites offline.

Before installation you should:

1. Use a fresh Ubuntu 24.04 LTS 64-bit system;
2. Save the VPS console or VNC login method;
3. Record the public IPv4, IPv6 and reverse DNS settings entry point;
4. Prepare a dedicated hostname for the panel, for example panel.example.com;
5. Back up important data to another machine or object storage in advance;
6. Do not "try installing" on a machine hosting existing production websites.

Snapshots can be used for full-machine rollback if installation fails, but they cannot replace off-machine backups. If you are unsure of the difference, read VPS backup and restore drills first.

The HestiaCP panel hostname should use a fully qualified domain name, not the root domain directly:

panel.example.com

At your DNS provider, add:

类型：A
名称：panel
内容：VPS 公网 IPv4
代理：关闭，仅 DNS

If the server has IPv6 correctly configured, add AAAA as well; otherwise do not leave AAAA records pointing to the wrong address. Incorrect IPv6 resolution can cause intermittent Let's Encrypt validation or panel access failures.

After logging in to the VPS, check the current hostname:

hostnamectl
hostname -f
getent ahosts panel.example.com

First change the system hostname to the panel domain:

sudo hostnamectl set-hostname panel.example.com

Check /etc/hosts to make sure the hostname resolves locally, but do not copy the example IP verbatim:

127.0.0.1 localhost
服务器主IP panel.example.com panel

If you plan to host email, also set PTR/reverse DNS to panel.example.com in the VPS provider's backend, and make it resolve forward to the same IP. Without correct PTR, SPF, DKIM, DMARC and good IP reputation, even if the panel shows successful sending, email may land in spam or be rejected.

Do not open all ports to the whole internet first. Configure the cloud firewall and the Hestia firewall according to the components actually enabled:

Cloud platform security groups and the system firewall are two layers of control. After installing the panel, maintain rules through Hestia's Firewall page; the official docs warn that when Hestia updates the firewall it may clear temporary iptables rules not managed by Hestia.

If the service is fine but the external network cannot reach it, check layer by layer according to the port, firewall and security group troubleshooting guide, and do not keep all firewalls disabled for long periods just for testing.

Log in as root, or enter a root shell first:

ssh root@服务器IP

A regular sudo user can run:

sudo -i

Confirm the system and architecture:

cat /etc/os-release
uname -m
free -h
df -h /

Update base packages and reboot:

apt update
apt full-upgrade -y
apt install -y ca-certificates wget curl
reboot

After logging back in, check whether a reboot is still pending:

uname -r
uptime

The default HestiaCP installation combination covers web, DNS, email, database, firewall and FTP, which is feature-complete but also has a larger resource footprint and attack surface. Before choosing, answer three questions:

1. Has DNS already been delegated to an external DNS provider?
2. Do you really want to send and receive email on this VPS?
3. Can file uploads use only SSH/SFTP?

wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
less hst-install.sh
bash hst-install.sh

bash hst-install.sh -h

HestiaCP can by default use Nginx as the front-end reverse proxy and Apache to handle backend dynamic requests, or you can disable Apache and use Nginx + PHP-FPM.

Do not disable Apache just because "Nginx is faster." First confirm whether the application depends on .htaccess rewrites, directory permission rules or Apache modules. When migrating old sites, compatibility is usually more important than saving a few hundred MB of memory.

Do not install every PHP version either. Choose based on actual site needs, for example 8.3 and 8.4; the more versions, the harder it is to manage updates, extension consistency and disk usage.

After installation finishes, the terminal will show:

• The panel login address;
• The administrator username;
• A random password or the password you set;
• The hostname and port.

Save this information to a password manager immediately, and do not screenshot it into chat groups. The default panel access form is:

https://panel.example.com:8083

If the domain certificate has not yet been issued, the browser may first show a self-signed certificate warning. After confirming the domain really resolves to your VPS, you can run the official command in a root shell:

v-change-sys-hostname panel.example.com
v-add-letsencrypt-host

Verify the panel:

curl -Ik https://panel.example.com:8083
ss -lntup
systemctl status hestia --no-pager

Complete these immediately after the first login:

1. Change the administrator to a strong password;
2. Enable two-factor authentication in account settings;
3. Check the administrator email and system notifications;
4. Disable unused API and Web Terminal;
5. Restrict 8083 to administrator IPs or VPN ranges only;
6. Create a daily management user, and avoid keeping all sites under the highest-privilege account long term.

First point the business domain's A/AAAA records to the VPS, then go to the Web page in HestiaCP to add the domain. It is recommended to proceed in this order:

1. Create a regular Hestia user;
2. Add a Web Domain with that user;
3. Choose the appropriate Web Template and Backend Template;
4. Enable SSL;
5. Check Let's Encrypt;
6. Enable forced HTTPS redirect as needed;
7. Create a separate database and database user;
8. Upload the website or use Quick Install App.

Each site should use its own system user, database and password. Do not let multiple customer websites share the admin user or the same database account, otherwise if one site is compromised it is easier to read other sites' files laterally.

Taking WordPress as an example, after installation you should also set up automatic updates, restrict administrator logins, delete unused plugins and themes, and copy site backups to another machine. For more detailed application-layer configuration, you can refer to the caching, backup and restore ideas in the WordPress Docker and security hardening tutorial, but do not apply that article's Docker port configuration directly to the HestiaCP host.

When the panel certificate or website certificate application fails, check in order:

getent ahosts panel.example.com
curl -I http://panel.example.com
ss -lntp | grep -E ':(80|443|8083)\b'
ls -lah /var/log/hestia/

Common causes include:

• The A record has not yet taken effect;
• An incorrect AAAA record routes validation traffic to another host;
• The cloud firewall does not open 80/TCP;
• Cloudflare proxy status or SSL mode conflicts with the validation flow;
• The Nginx/Apache configuration failed to reload;
• Repeated applications in a short time trigger Let's Encrypt rate limits.

The official Hestia docs recommend checking the corresponding LE-用户-域名.log under /var/log/hestia/. Fix DNS and HTTP-01 reachability first, then reapply, and do not click a dozen times in a row.

The hard part of self-hosted email is not creating mailboxes, but deliverability, IP reputation, anti-spam, DNS and ongoing operations. If you only need WordPress to send verification codes, order notifications or password resets, using a trusted SMTP relay is usually more reliable than self-hosting a full email server.

Before deciding to host email, confirm:

• Whether the VPS allows outbound 25/TCP;
• Whether the IP has a spam history;
• Whether the provider can set PTR;
• Whether you are willing to maintain SPF, DKIM, DMARC and anti-spam policies;
• Whether you have separate off-machine backups and monitoring.

The official Hestia docs also note that many providers block outbound port 25 by default; if it cannot be opened, you can configure an SMTP relay in Global SMTP or the mail domain settings.

A      mail                 VPS_IP
MX     @                    mail.example.com
TXT    @                    v=spf1 a mx ip4:VPS_IP -all
TXT    _dmarc               v=DMARC1; p=quarantine; rua=mailto:[email protected]
TXT    Hestia生成的DKIM名称    Hestia生成的DKIM公钥
PTR    VPS_IP               mail.example.com

Go to Server Settings → Firewall and delete or tighten unneeded rules:

• 8083/TCP: allow only the administrator's fixed IP or VPN range;
• 22/TCP: allow only ops sources; changing the port cannot replace key authentication;
• DNS, FTP, POP3: disable if the corresponding service is not enabled;
• Database ports: do not open to the public internet;
• Web ports: open only 80/443.

View current listeners and rules:

ss -lntup
iptables -S
fail2ban-client status

Hestia's firewall updates rebuild the rules. If you really need advanced customization, place scripts in the official way at:

/usr/local/hestia/data/firewall/custom.sh

Before modifying, keep a VPS console session open and test that the script will not lock you out of SSH. Do not repeatedly overwrite the same port with UFW, manual iptables, the cloud firewall and panel rules at the same time, or it will eventually be very hard to tell which layer is in effect.

First configure an SSH public key for the daily administrator, and verify in another terminal that you can log in:

install -d -m 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

After confirming key login works, then consider disabling root password login. Before editing the SSH configuration, keep a console access method:

sshd -t
systemctl reload ssh

Site users should not get unnecessary SSH privileges by default. When Shell access is really needed, use least privilege, and avoid adding panel users to the sudo or Docker group. The Docker group is close to root privileges and is not suitable as a convenience tool for regular website users.

HestiaCP can generate backups per user; the common command is:

v-backup-user 用户名
ls -lh /backup

Before restoring, rehearse in a test environment:

v-restore-user 用户名 用户名.日期-时间.tar

The local /backup is still on the same VPS as the website. If the system disk fails, the account is deleted or the whole machine is lost, local backups may be lost too, so copy them to at least one other off-machine storage location.

Hestia officially supports FTP, SFTP and Rclone backup hosts. When using SFTP, prefer keys and do not treat plaintext passwords as a long-term solution. Hestia 1.9 and later also includes a Restic-based incremental backup process; the restic.conf generated when first creating the repository contains the key needed for restore and must be backed up separately and securely.

Complete at least one restore drill before going live:

1. Manually trigger a user backup;
2. Confirm the off-machine object really exists and has a reasonable size;
3. Restore on a test user or test VPS;
4. Check website files, databases, mailboxes and DNS configuration;
5. Record restore duration and missing items.

"The backup task shows success" is not enough; only a backup that can be restored counts as a valid backup.

The control panel has near-root administrative capability and must not stay on an old version for long. 1.10.4 is the current stable version at the time of writing, but it will keep changing; before actual operations, check the official Releases and the panel update page.

Before upgrading:

v-backup-user 用户名
df -h
free -h
apt update
apt list --upgradable

Then:

1. Read the release notes between the current version and the target version;
2. Save the panel configuration, user backups and off-machine copies;
3. Confirm there is enough disk and inode space;
4. Perform the upgrade from the Hestia update page during off-peak hours;
5. After upgrading, check web, database, email, certificates, cron jobs and backups;
6. Do not upgrade Ubuntu across distributions directly without official instructions.

Recent versions include multiple security fixes, which further shows that "the panel opens, so no update needed" is not a security strategy. Also do not enable unused Web Terminal and API, to avoid expanding the exposed management surface.

• Use a fresh 64-bit system officially supported;
• panel.example.com resolves correctly to the VPS;
• The panel has a valid HTTPS certificate issued;
• The administrator password is unique and two-factor authentication is enabled;
• 8083 and SSH are restricted to administrator sources;
• Unused DNS, FTP, email, API and Web Terminal are disabled;
• Each site uses its own user, database and password;
• Websites, databases, mailboxes and panel certificates have all been tested;
• Backups have been copied off-machine and a restore drill has been completed;
• Upgrade, troubleshooting and emergency login methods are documented.

The value of HestiaCP is not "click to install WordPress," but putting multi-site, users, databases, certificates, DNS, email, firewall and backups into a repeatable management process. What really determines stability is using a clean system before installation, enabling only the components you need, restricting panel entry, isolating site users, and putting backups on another machine and verifying they can be restored.

When hosting websites only, prefer Ubuntu 24.04, Nginx/PHP-FPM, MariaDB and Fail2Ban, and disable email, BIND, FTP, API and Web Terminal; when you really need self-hosted email, reserve extra operational cost for PTR, DNS, ports, IP reputation and off-machine backups.

• HestiaCP Getting Started and installation parameters
• HestiaCP 1.10.4 Releases
• HestiaCP SSL Certificates
• HestiaCP Firewall
• HestiaCP Backup & Restore
• HestiaCP Email and mail server