How to Install HestiaCP on a VPS

Content

Important — Self-Managed Software
The control panel described in this article is third-party software and is not developed, maintained, or officially supported by Libyan Spider.
This guide is provided for informational purposes to assist customers using self-managed VPS and cloud servers.
Customers are responsible for the installation, configuration, security, updates, backups, maintenance, and troubleshooting of the control panel and its associated services.
For control-panel-specific assistance, please refer to the software project’s official documentation, community resources, or available commercial support.
Libyan Spider continues to provide support for the underlying infrastructure and services covered by the customer’s applicable service agreement.

Overview

HestiaCP is a GPLv3 panel for websites, databases, DNS and optional email services. This guide uses a fresh Debian 12 server and its interactive installer. Select services to match your workload rather than assuming every installer default is required.

Compare the options first: Free and Open-Source Hosting Control Panels: Alternatives to cPanel

Before you begin

The current requirements list Debian 12/13 and Ubuntu 22.04/24.04/26.04 LTS on 64-bit x86_64 or ARM64. Minimum: 1 CPU core, 1 GB RAM without SpamAssassin and ClamAV, and 10 GB disk. Recommended: 4 cores, 4 GB RAM and 40 GB SSD. A default mail-enabled installation should not be sized from the reduced 1 GB configuration. Allow additional capacity for your workload and backup staging.

Current official installation procedure

A self-managed VPS/cloud server with a fresh Debian 12 installation, working networking and outbound package-download access.
SSH access, the correct public IP, and root access or a sudo-capable account that can become root. A sudo account is not the same as starting a root shell.
A hostname you control, access to authoritative DNS, a suitable domain for hosted sites, and independently stored backups of any existing data.

Install on a new, empty server. A panel can replace web, mail, DNS and database configuration. Do not install over an existing production stack or another panel unless upstream explicitly supports that migration and you have a tested recovery plan.

Step 1 — Prepare your VPS

From your local terminal, connect using your provisioned SSH account. Replace the placeholders and verify the server host-key fingerprint through a trusted channel before accepting a new key. Use your configured SSH port if it differs from the default.

ssh username@SERVER_IP

Confirm that you reached the intended server and that its operating system matches this guide:

cat /etc/os-release
uname -m
free -h
df -h /

If you logged in directly as root, continue in that shell. From a sudo-capable account use the following to become root; the installer and commands labelled root below must run in that root shell.

sudo -i

Apply the package preparation and update commands for the chosen OS from the linked installer guide. Review available disk space and pending reboot requirements. Do not reuse Debian/Ubuntu package commands on a different distribution or pre-install an unrelated web/database stack.

Step 2 — Configure the hostname and DNS

An FQDN is a complete hostname such as server.example.com. Use a dedicated hostname, not the bare domain you intend to host. Create an A record to the public IPv4 address. Add AAAA only if IPv6 is configured and reachable. Follow the selected installer’s hostname and /etc/hosts procedure rather than overwriting that file blindly.

Check hostname resolution before installation. DNS caches may retain old answers until their TTL expires. A wrong AAAA record can break access and certificate validation even when A is correct. For local mail hosting, coordinate matching reverse DNS/PTR with the infrastructure provider and plan MX, SPF, DKIM and DMARC; the panel does not automatically control the provider’s PTR records.

Step 3 — Install HestiaCP

Run the following documented commands as root on the fresh supported OS. The first downloads the release installer; review its source and the current installation page before executing the second command. If you need a smaller service set, use the official installer generator and review its generated options instead of adding unverified flags.

Open the verified installation instructions

wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh

bash hst-install.sh

An internet-downloaded installer runs with full server privileges. Confirm its official source, read the current instructions, inspect the downloaded file and use any upstream integrity checks. Do not bypass failed TLS or checksum checks. The commands in this article are documentation examples, not a claim that Libyan Spider tested a deployment.

Follow the interactive questions for hostname, administrator details and email, and check the proposed software list before approving installation. Save the administrator username, password and HTTPS URL shown at completion in a password manager. Follow any requested reboot and reconnect.

Step 4 — Configure the firewall

Before applying rules, keep your current SSH session open, allow the actual SSH port from your trusted address, and test a second SSH connection. Confirm Console/recovery access. A mistaken rule can lock you out.

There may be several layers: the Linux host firewall, any service-specific LS network firewall/security group, and the panel’s firewall UI. The panel UI often manages the host firewall rather than a separate independent layer. Traffic must be allowed through every applicable layer. Do not run conflicting firewall managers or assume all LS services use the same controls.

For this panel, permit TCP 8083 for administrative HTTPS from trusted IPs or a secure access mechanism. Public websites normally need TCP 80/443. Enable other ports only for selected services: authoritative DNS uses TCP/UDP 53; mail and FTP require their own documented ports. A passive FTP range is needed only if you actually use that service. Do not copy an all-services allow list or disable the host firewall.

LS VPS network-firewall guide applies where that interface is available; consult your service controls for other cloud products.

Step 5 — Access the panel with HTTPS

https://server.example.com:8083

Use the administrator credentials shown by the installer and its final access URL; the default backend port is 8083 unless changed during installation. The panel account is not necessarily the same as your SSH account.

An initial self-signed certificate can trigger a browser warning. Verify the endpoint and certificate identity independently before entering credentials; use a trusted administrative connection and configure a valid hostname certificate promptly. Do not permanently suppress warnings or make exceptions a routine login method.

After confirming the hostname resolves to this server, follow the panel TLS guide. Its documented root commands set the hostname and request a Let’s Encrypt certificate. Replace server.example.com with your real hostname, confirm it first, and ensure certificate validation can reach the required service.

v-change-sys-hostname server.example.com

v-add-letsencrypt-host

Step 6 — Perform initial configuration

Follow HestiaCP’s best practice: create a regular panel user before adding web or mail domains, rather than hosting everything as admin. Add the web domain and database under that user, configure DNS at the authoritative provider, and request site TLS. Enable two-factor authentication on the administrator account through the account guide. Configure mail domains only if you selected and intend to operate the mail stack.

Test a non-production site, database access and certificate renewal before moving customers. Check runtime versions and extensions required by the application. Use separate limited accounts and protect administrator/recovery credentials in a password manager.

Step 7 — Secure the installation

Keep OS, panel and application packages patched using supported stable sources.
Use SSH keys where possible; test recovery and a second session before changing SSH access.
Use unique strong passwords, enable MFA where supported, and retain a secure recovery method.
Restrict administrative access, review both IPv4/IPv6 rules and remove unnecessary enabled services using upstream procedures.
Use trusted HTTPS; review user permissions, logs, failed logins, resource usage and certificate expiry.
Schedule independent backups, test restoration and follow upstream release/security announcements.

Completing the installer is not evidence of a secure or production-ready server. Validate the application, recovery and monitoring plan before going live.

Step 8 — Configure backups

Configure user backup schedules and retention using the official backup/restore documentation. Set up a supported remote destination such as SFTP or Rclone, secure its credentials and run a first backup. Verify the remote files and test restoration. Check free staging space; a backup job may need substantial additional space. Preserve any encryption/recovery keys separately if using an encrypted backup method.

Keep backups separately from the primary VPS, protect storage credentials and define retention and recovery targets. Native panel backups usually cover selected accounts/services; infrastructure snapshots capture supported storage state and may need application-consistency preparation. A managed backup service has its own scope and contract. None is automatically included merely because you purchased a VPS. Verify your entitlements and test restores.

Step 9 — Updates and ongoing maintenance

The official README says automatic panel updates are enabled by default for new installs and can be managed in Server Settings > Updates. Confirm the actual setting and monitor failures. For manual package updates it documents the following root commands. Read release notes and back up first; do not treat an OS release upgrade as an ordinary package update.

apt-get update

apt-get upgrade

Maintain the OS, panel, web server, PHP or other runtimes, databases, any mail services, CMS/plugins, permissions and backup jobs. Check available disk/memory and logs regularly. After updates, test websites, login, TLS and backups. Document changes and recovery actions. For major OS or runtime upgrades, check panel compatibility and use a separate migration plan.

Troubleshooting and documentation

Issue	Check first	Documentation
Cannot reach the panel	Verify IP/hostname, running server, the actual management port and every firewall layer.	Official troubleshooting / administrator resources
Login unsuccessful	Use the installer’s panel credentials, not an assumed shared password; check MFA, time and upstream recovery instructions.	Official troubleshooting / administrator resources
Installation failed / insufficient resources	Preserve the error, confirm clean supported OS, capacity and outbound access. Consult upstream before rerunning.	Official troubleshooting / administrator resources
Web, DNS or certificate error	Check authoritative records, A/AAAA reachability, the selected service, certificate name and application logs.	Official troubleshooting / administrator resources
Update failure	Review release notes, free space, repository access and logs; avoid force/reinstall workarounds without upstream guidance.	Official troubleshooting / administrator resources
Email delivery	Check whether mail was installed, plus MX/PTR/authentication records and permitted network traffic; consult the project’s mail documentation.	Official troubleshooting / administrator resources

For software-specific help, use the project’s documentation and community. Share redacted logs, OS and panel versions and the exact failure; never post passwords, tokens or private keys. Contact Libyan Spider only for infrastructure or services covered by your agreement.

SSH Gate access for services using LS Cloud — this is a service-specific alternative; a standalone VPS may use direct SSH.

The snapshot guide describes an infrastructure feature. It does not establish backup-service entitlement or replace a tested off-server backup.

Official resources

Documentation reviewed: 23 October 2026. Recheck upstream requirements and release notes before installation or upgrades.