Migrating a website to a VPS: a step-by-step guide

On shared hosting the provider runs the web server, PHP, the database, email, backups and security updates. On an unmanaged VPS, all of that is now yours. The upside is control and predictable resources; the cost is that nothing is set up until you set it up. Plan the move as two projects: build the server, then move the site onto it.

Start from a supported Linux release. The commands below are for Ubuntu or Debian; adapt package names for other distributions.

# Updates and a non-root user with sudo
apt update && apt upgrade -y
adduser deploy && usermod -aG sudo deploy

# Firewall: SSH, HTTP and HTTPS only
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

# Automatic security updates
apt install -y unattended-upgrades

Log in with an SSH key, then disable password logins for SSH. Install the stack the site needs, for example nginx or Apache, PHP-FPM with the same version and extensions as the old host, and MySQL or MariaDB. Matching the PHP version avoids surprises; upgrade it later as a separate step.

1. 1

   Step 1: Lower the TTL

   Set the A records to a 300-second TTL a day before the switch. Check the current value with the TTL checker.

2. 2

   Step 2: Secure the VPS and install the stack

   Apply updates, create a sudo user, enable SSH keys and a firewall, then install the web server, PHP and database versions the site needs.

3. 3

   Step 3: Copy the files

   Copy the site with rsync -avz over SSH, or download an archive from the old host and upload it. Set ownership to the web server user.

4. 4

   Step 4: Import the database

   Export it on the old host, create a database and user on the VPS, import the dump and update the application’s configuration with the new credentials.

5. 5

   Step 5: Configure the virtual host

   Add a server block for the domain and www, translate any .htaccess rules, and reload the web server.

6. 6

   Step 6: Test on the VPS IP before DNS

   Create a preview link with the domain and the VPS IP, and use HTTP only or Skip verification mode until a certificate is installed. Click through, submit forms, sign in.

7. 7

   Step 7: Run a QA report

   Crawl the preview with a QA report to catch default web server pages, 502 errors from PHP-FPM, missing rewrite rules and PHP errors.

8. 8

   Step 8: Switch DNS and issue the certificate

   Do a final file and database sync, point the A records at the VPS, then issue the certificate and watch propagation with the DNS propagation checker.

The web server picks the site by the domain name in the request. Configure a server block for both example.com and www.example.com:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/public;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    }
}

If the site relied on .htaccess rules on the old host, translate them for nginx: pretty URLs, redirects and access restrictions do not carry over on their own. Adjust the PHP-FPM socket path to the version you installed. Test the configuration with nginx -t before every reload, and check the PHP-FPM pool settings: the default number of worker processes is small, and a busy site that runs out of workers answers with 502 or 504 errors.

Let’s Encrypt’s usual HTTP challenge only works once the domain points at the VPS. You have three options: issue the certificate right after the switch (a few minutes over plain HTTP or a self-signed certificate), use the DNS challenge, which works before the switch if your DNS provider has an API, or copy the existing certificate from the old host.

For testing, a fresh VPS without any certificate works with a DNSPeek preview in HTTP only mode: visitors still open the preview over HTTPS, and DNSPeek talks plain HTTP to the server. Make the application trust the proxy’s HTTPS first, or a forced-HTTPS redirect will loop. The docs show the PHP and nginx settings: Origin without SSL.

If the old shared host also handled your email, the move is a good moment to separate them. Running a mail server well (spam filtering, reputation, DKIM, blocklists) is a job of its own, and many cloud providers block outbound port 25 by default. Move mailboxes to a dedicated email provider, update MX, SPF, DKIM and DMARC, and let the website send transactional mail through an authenticated SMTP service. Verify the records with the MX lookup, SPF checker and DMARC checker.

• Issue or verify the certificate and check it with the SSL checker.
• Set up backups that leave the server: database dumps and files, to object storage or another machine, and test a restore.
• Add basic monitoring: uptime checks, disk space and certificate expiry.
• Recreate cron jobs from the old host.
• Follow the post-move checklist.