Self-Host Matomo on a VPS for Three Client Sites: Setup and Cost (2026)

Published on

Matomo On-Premise for three client sites on one VPS: Matomo's sizing, the archive cron, GeoIP, updates, backups, consent and a dated cost sum against Cloud.

Illustration of three stacked server units with blue status lights next to a terminal window with green code

You build websites for clients and want their analytics on a server you control. Matomo On-Premise is free software, so the bill is a VPS, backup storage and your time. Below: Matomo's own sizing advice, the upkeep you sign up for, and a cost sum against Matomo Cloud's prices of 15 November 2026. Space-Node is not affiliated with the Matomo project; this guide uses the name only to describe the software.

Quick answer: Matomo's documentation puts up to 100,000 tracked page views a month on one server with 2 CPUs, 2 GB RAM and 50 GB SSD, so three client sites under that total fit on a VPS with 3 vCores, 4 GB RAM and 60 GB NVMe, such as our Standard VPS-S at €4.99 a month with VAT. You then run an hourly core:archive cron, GeoIP and Matomo updates, daily backups kept 30 days off the server, and privacy settings per client country. On 15 November 2026 Matomo Cloud Business cost €38 a month excluding VAT for 100,000 hits; self-hosting at that volume leaves about €31 a month after an example €3 for backup storage, and that is your budget for upkeep.

What Is Free and What Costs Money

Matomo "is released under the GNU General Public License v3.0 (or later)"; the tracker that goes into client sites, matomo.js, is under the New BSD License. The pricing page lists the self-hosted Community edition as free "forever", with "Unlimited users and hits". The free core covers several websites in one install, a login per client, ecommerce and event tracking, segments, scheduled email reports and a custom logo. Premium plugins cost extra: heatmaps and session recording, funnels, form analytics, custom reports, A/B testing, roll-up reporting, SAML or LDAP login and White Label, sold one by one or in bundles (Team: €275 a month).

How Big a VPS Three Client Sites Need

Matomo sizes a server by "how many requests you will be tracking per month" (page views, events, downloads and so on) and says the number of websites and segments matters too. Count the three sites together.

Tracked per month, all sites togetherMatomo's minimum recommendation
Up to 100,000One server for app and database: 2 CPU, 2 GB RAM, 50 GB SSD
Up to 1 millionOne server can be enough: 4 CPU, 8 GB RAM, 250 GB SSD

On our plans, in an EU data center:

  • Up to 100,000: the Standard VPS-S (3 vCores, 4 GB RAM, 60 GB NVMe, 10 TB transfer) is above all three figures. The Premium VPS-XS (20 GB) and Premium VPS-S (40 GB) have less disk than Matomo's 50 GB.
  • Up to 1 million: the VPS-M (4 vCores, 8 GB RAM, 80 GB NVMe) matches the CPU and RAM, not the 250 GB of disk. Treat it as a starting point and watch the database size (the query is under Backups).

RAM is dedicated, vCores are shared, and the plans are self-managed: you install and maintain everything below.

What You Sign Up For

1. The Install (Once)

Point a subdomain such as analytics.youragency.com at the VPS. Ubuntu 24.04 ships PHP 8.3 and MariaDB 10.11 (Debian 12: PHP 8.2, MariaDB 10.11), enough for Matomo 6 as well, now a release candidate that needs "PHP 8.1 or newer and MySQL 8.0 or MariaDB 10.6". Install Matomo's recommended packages with MariaDB and PHP-FPM, then create the database user with the privileges from Matomo's database FAQ, minus the optional FILE privilege:

sudo apt update
sudo apt install -y nginx mariadb-server php-fpm php-cli php-mysql php-curl php-gd php-xml php-mbstring unzip certbot python3-certbot-nginx
sudo mariadb -e "CREATE DATABASE matomo;
CREATE USER 'matomo'@'localhost' IDENTIFIED BY 'use-a-long-random-password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, INDEX, DROP, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES ON matomo.* TO 'matomo'@'localhost';"

Download the current release (5.14.2 on 15 November 2026) and give the folder to the web server user, so the one-click updater can replace files later. Matomo's install guide prefers write access on only tmp/ and config/; then you update by replacing the files yourself.

cd /var/www && sudo curl -fLO https://builds.matomo.org/matomo.zip
sudo unzip -q matomo.zip && sudo rm matomo.zip 'How to install Matomo.html'
sudo chown -R www-data:www-data /var/www/matomo

Get a certificate with sudo certbot certonly --nginx -d analytics.youragency.com (see our Nginx and Let's Encrypt guide), then use sites-available/matomo.conf and ssl.conf from Matomo's matomo-nginx repository. They redirect HTTP to HTTPS, pass only entry points such as index.php and matomo.php to PHP, and block config, tmp and the other internal folders. Set server_name, the certificate paths and fastcgi_pass unix:/run/php/php8.3-fpm.sock;, then run sudo nginx -t and reload.

Run the web installer, add the other two sites under Administration, Websites, Manage, and give each client a login with View access to their own site. Add an SMTP account under Administration, System, General settings for password resets and scheduled reports, turn on two-factor login under Administration, Personal, Security, and once HTTPS works, set force_ssl = 1 under [General] in config/config.ini.php.

2. The Archiving Cron (Every Hour)

Matomo turns raw visits into reports in a step called archiving. By default that happens when someone opens a report, which "quickly becomes unsustainable" unless "your amount of data is very small". Run it from cron instead, and test it once by hand:

sudo install -d -o www-data -g www-data /var/log/matomo
echo '5 * * * * www-data /usr/bin/php /var/www/matomo/console core:archive --url=https://analytics.youragency.com/ > /var/log/matomo/archive.log 2>> /var/log/matomo/archive-errors.log' | sudo tee /etc/cron.d/matomo-archive
sudo -u www-data /usr/bin/php /var/www/matomo/console core:archive --url=https://analytics.youragency.com/

Then, under Administration, System, General settings, set "Archive reports when viewed from the browser" to No and "Archive reports at most every X seconds" to 3600, and add browser_archiving_disabled_enforce = 1 under [General] in config.ini.php so segments cannot trigger it either. Matomo calls checking "weekly, or daily, for any messages which arise during the archiving process" your most important job as an administrator: here, that is archive-errors.log. For "Allowed memory size ... exhausted", raise PHP's memory_limit; Matomo says sites with less data can use 512M or 2G.

3. Geolocation (Set Once, Updates Itself)

Without a database, Matomo guesses the country from the browser language. Under Administration, System, Geolocation, pick DBIP / GeoIP 2 (PHP): Matomo "includes a tool that will download the IP to City Lite database for you" and updates it "every week or every month" through the archiving cron. DB-IP publishes that file monthly under Creative Commons Attribution 4.0 and asks for a link to DB-IP.com on pages that display or use its results. Matomo warns that free databases are less complete and accurate than commercial ones; MaxMind's GeoLite2 City, with a license key, is the alternative.

4. Updates (About Monthly)

Matomo's changelog lists 14 releases from 29 January to 22 October 2026, and 6.0.0 has been a release candidate since 30 October. With the folder owned by www-data, the one-click update replaces the files; back up first. On busy servers Matomo recommends the database step on the command line: sudo -u www-data /usr/bin/php /var/www/matomo/console core:update. Switch on automatic security updates for the system too (patching guide).

5. Backups (Daily, Off the Server)

Matomo recommends a daily full database backup and a daily copy of the Matomo folder "including the config.ini.php file", both kept 30 days on a backup host "geographically distant" from the server, with "10x the size of the uncompressed Matomo database" in storage. Backups are not in our VPS price; a ticket gets you our backup option and its price. Save this as /usr/local/bin/matomo-backup and make it executable:

#!/bin/bash
# Daily Matomo backup: database dump plus the Matomo folder with config.ini.php.
set -euo pipefail
DEST=/var/backups/matomo
DAY=$(date +%F)
mkdir -p "$DEST"
mariadb-dump --extended-insert --no-autocommit --quick --single-transaction matomo | gzip > "$DEST/db-$DAY.sql.gz"
tar czf "$DEST/files-$DAY.tar.gz" --exclude=matomo/tmp -C /var/www matomo
find "$DEST" -type f -mtime +7 -delete

Run it nightly with echo '30 3 * * * root /usr/local/bin/matomo-backup' | sudo tee /etc/cron.d/matomo-backup; on Ubuntu and Debian, root reaches MariaDB through its Unix socket, so no password is stored. The dump options come from Matomo's backup FAQ (our MariaDB backup guide explains them). Keep 7 days on the VPS and 30 off it, for example with restic over SSH. To restore, pipe the dump into an empty database (gunzip < db-DATE.sql.gz | sudo mariadb matomo) and put the folder back; practise it once. Watch the database size, since the disk sets how much raw data you can keep:

sudo mariadb -e "SELECT ROUND(SUM(data_length+index_length)/1024/1024) AS size_mb FROM information_schema.tables WHERE table_schema='matomo';"

6. Privacy and Consent (Per Client)

Matomo masks 2 bytes of each visitor's IP by default. Under Administration, Privacy you can mask more, set "Regularly delete old raw data" (the privacy guide suggests keeping detailed logs "for only 3 to 6 months") and copy the opt-out form into each client's privacy statement. Where consent is required, Matomo cookies may only be set after it is given. Whether it is depends on the client's country. Two official sources, summarised as information, not legal advice:

  • France. Under Article 82 of the Informatique et Libertés law, the CNIL exempts audience measurement from consent when the trackers only measure the site's audience for the publisher, produce anonymous statistics only, are not cross-referenced with other processing or passed to third parties in non-anonymous form, and do not follow people across sites or apps. It also recommends informing visitors, a tracker lifetime such as 13 months that is not extended on new visits, and at most 25 months of data. Based on its self-assessment, Matomo says On-Premise meets these criteria "if properly configured": Administration, Privacy, Compliance, Enforce All Settings masks 3 bytes of the IP, turns off the visits log and visitor profiles, discards campaign parameters and keeps raw data 744 days. You add the opt-out, and the mode "explicitly excludes any marketing-related measurement".
  • Netherlands. The government's business portal, run by RVO: "You do not need your visitors' consent to set cookies if you do not store any sensitive personal data, such as functional cookies and analytical cookies with no or little impact on your visitors' privacy." Visitors must still be told, and the Autoriteit Persoonsgegevens monitors cookie notices.

For one install serving three clients, the CNIL self-assessment that Matomo reproduces includes "No pooling of raw audience measurement data from multiple clients" and "No reuse of data for the provider's own purposes". Keep each client a separate website, and their data out of your own reports.

What It Costs Each Month

Matomo Cloud's pricing page on 15 November 2026, Business plan, billed monthly, excluding tax: €22 for 50,000 hits a month, €38 for 100,000, €75 for 300,000 and €172 for 1 million. A hit is a tracked page view, event, download, outlink, site search or content tracking request. Business covers 30 websites and 30 team members, keeps raw data 24 months, stores it in Frankfurt, and includes "hosting, maintenance, automatic updates, security monitoring, daily backups, and access to all Matomo features", such as 1,500 heatmap page views and 150 session recordings a month.

The self-hosted side excludes VAT too: the VPS-S is €4.99 with 21% VAT, €4.12 without; the VPS-M €8.99, €7.43 without. Off-site backup storage is an example €3 a month; use your own figure.

Hits a monthCloud BusinessSelf-hosted: VPS + example backupDifferenceAt an example €60 an hour
50,000€22.00VPS-S €4.12 + €3.00 = €7.12€14.8815 minutes
100,000€38.00VPS-S €4.12 + €3.00 = €7.12€30.8831 minutes
300,000€75.00VPS-M €7.43 + €3.00 = €10.43€64.5765 minutes

The difference is your monthly time budget (at €60 an hour, each euro buys one minute) for updates, the archive error log, checking that backups reached the other server, and disk use. The one-time setup comes on top: an example 4 hours at €60 is €240, or €20 a month over the first year. At 50,000 hits that makes Cloud cheaper in year one whatever your monthly time; at 100,000 hits about 11 minutes a month remain. From year two the full budget applies.

  • Yearly billing. Cloud's yearly price is ten months' price: €380 at 100,000 hits, which cuts that budget to €24.55 a month.
  • More traffic. At 1 million hits Cloud costs €172 a month. Matomo's tier asks for 250 GB of disk: the VPS-M has the CPU and RAM, and our smallest Standard plan with 250 GB is the VPS-3XL at €39.99 with VAT (€33.05 without).
  • Limits. Cloud Business stops at 30 websites, 30 team members and 24 months of raw data; the self-hosted edition lists unlimited users and hits.

Which One Fits

  • Matomo Cloud under about 100,000 hits in total, when nobody wants to run a server, or when clients want heatmaps without buying plugins.
  • Self-hosted from a few hundred thousand hits, past 30 sites or users, for raw data beyond 24 months on your own server, or when you already run Linux servers and the monthly round takes minutes.

FAQ

Is self-hosted Matomo free for client work?

Yes. The GPL v3 "explicitly affirms your unlimited permission to run the unmodified Program", and the Community edition lists "Unlimited users and hits". You pay for the server, your time and any premium plugins.

How much RAM does Matomo need?

Matomo's minimum is 2 GB of RAM, with 2 CPUs and 50 GB SSD, up to 100,000 tracked page views a month, and 8 GB, with 4 CPUs and 250 GB, up to 1 million.

Can one Matomo install track several client websites?

Yes. A superuser adds each site under Administration, Websites, Manage, and every role except Superuser is tied to a website, so each client can get a View login for their own site.

Do I need the core:archive cron?

Matomo recommends it once a site has "more than a few hundreds visits per day". Run it hourly and turn off archiving from the browser.

Does self-hosted Matomo need a cookie banner?

It depends on the client's country and your settings. France's CNIL exempts audience measurement under strict conditions, which Matomo's Compliance page applies; the Dutch business portal says analytical cookies with little privacy impact need no consent if visitors are told. Elsewhere, check the national regulator.

What should a Matomo backup include?

A daily database dump and the Matomo folder with config/config.ini.php, kept 30 days on a separate, distant backup host.

Sources

All opened on 15 November 2026: