Key takeaways
- By hand you need Nginx, PHP FPM, MariaDB, TLS, backups and updates, and you own every one of them.
- A panel adds a licence cost or a learning curve but removes most routine jobs, and it matters more as the number of sites grows.
- For one or two sites and some Linux skill, a manual stack is cheap and fine. From about five sites or any client sites, use a panel.
- As of 30 October 2026 WordPress recommends PHP 8.3 or greater and MariaDB 10.11 or greater (or MySQL 8.0).
You can host WordPress on a plain VPS in an hour, or let a control panel do it in ten minutes. Both work. The real question is who does the maintenance in month six.
What WordPress needs
WordPress.org lists the current needs on its requirements page: PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, Apache or Nginx, and HTTPS (as of 30 October 2026). Older PHP and MySQL versions still run it, but WordPress warns that they are end of life.
The manual route
On Ubuntu or Debian you install Nginx, PHP FPM with the usual extensions, MariaDB, and an ACME client for certificates. You create a database and user, unpack WordPress, write an Nginx server block that sends PHP to the FPM socket, and tries index.php for pretty links. Then you add what makes it a real service:
- A separate system user and PHP FPM pool per site, so one hacked site cannot read the next. Our server hardening guide covers this.
- Firewall, SSH keys and automatic security updates for the operating system.
- Page caching (FastCGI cache or a plugin), and limits on
xmlrpc.phpandwp-login.php. - Daily backups of files and database to somewhere else, and a tested restore.
- Certificate renewal checks, log rotation and disk space alerts.
Cost is the VPS only. Time is a few hours at the start, then an hour or two a month per server, plus the bad nights.
The panel route
A control panel gives you a form to add a site, a database, a certificate, a mail account and a backup schedule, and it handles the PHP version per site. Most can install WordPress with a click. What you pay is a licence (or accept a free panel's limits), plus some memory for the panel itself. See what a server control panel is and the free panel options for a VPS before you price it.
Panels differ a lot in price. Per account licences grow with every site you add, flat per server ones do not, and free panels cost nothing but more of your time. Check each vendor's own price page on the day you decide.
Side by side
| By hand | With a panel | |
|---|---|---|
| Time to the first site | A few hours | Minutes |
| Cost | VPS only | VPS plus licence, or free with limits |
| Per site isolation | You configure it | Usually built in |
| Backups | Scripts you write | A schedule in the panel |
| Updates of the panel and stack | You | Vendor releases |
| Skill needed | Linux, Nginx, PHP | Basic admin |
| Risk of a mistake | Higher | Lower, but the panel is software too |
What about security
Neither route fixes plugins. Keep WordPress core, themes and plugins updated, remove what you do not use, use a strong admin password with a second factor, and avoid pirated themes. A panel helps with the layer below (isolation, certificates, backups) but cannot decide which plugins you install.
Which one should you pick
- One or two of your own sites, and you like Linux: do it by hand. It is cheap and teaches you the stack.
- Three to five sites, or any site a client pays for: a panel pays for itself in saved evenings.
- You resell hosting or run many sites: use a panel, and compare per account against flat per server pricing in our pricing comparison.
- You cannot afford a night of downtime: use whichever route has tested backups. That is the real dividing line.
If you want to try a panel without paying, RespireCloud has a free plan for one account and three sites, which is enough to host a WordPress site and see if the workflow suits you.
Questions
Can I run WordPress on a very small VPS?
Yes, for one low traffic site with page caching. WordPress is light when cached and heavy when it is not, so give it enough memory for PHP workers and the database, and add swap as a safety net, not a plan.
Is Nginx better than Apache for WordPress?
Both are recommended by WordPress.org. Nginx with PHP FPM uses less memory under load, while Apache with .htaccess is easier for plugins that write rewrite rules. Pick the one your panel or your habits support.
Do I need a panel to get free TLS certificates?
No. Certbot or another ACME client does it by hand. A panel mostly saves you the renewal and wildcard hassle across many sites.
What is the most common way a self hosted WordPress site gets hacked?
An outdated plugin or theme, a weak admin password, or a nulled (pirated) theme. The server layer matters, but the plugin layer is where most incidents begin.
