Your site has run on shared hosting for a while, and now it struggles: pages crawl at busy moments, visitors sometimes get a 508 or 503 error, or you need something the panel doesn't offer, such as Redis or a bot that runs all day. A VPS looks like the obvious next step, and often it is, but it also hands you every job the host used to do. Here is what shared hosting takes care of, how to check whether its limits are really your problem, what changes on a VPS and what the move costs you in time.
Quick answer: Shared hosting gives you a panel, mailboxes, PHP and certificates, all run by the host, inside limits on CPU, memory, processes and simultaneous PHP requests. A VPS gives you root access to your own virtual machine and makes you the administrator of updates, PHP, certificates, backups, mail and the firewall. Move when the limits are the bottleneck: faults or 508 errors in your panel's resource usage at normal traffic with caching on, or software the host can't install. If uncached pages make the site slow, fix that first, because a VPS runs the same code. In between: keep the site and mail on shared hosting and put only the extra service on a small VPS, or run an open source panel such as HestiaCP on a VPS.
What Shared Hosting Does for You
On shared hosting, many accounts share one server, and the host runs everything below your files: the operating system, the web server, PHP, the database server, mail and a control panel such as cPanel, DirectAdmin or Plesk. In cPanel, for example, you get:
- A PHP version per site. The MultiPHP Manager lets you "manage the PHP version or pool option of any virtual host", choosing from the versions the host installed.
- Certificates. AutoSSL "automatically installs domain-validated SSL certificates" for your domains, with Let's Encrypt as the default provider.
- Mail. Mailboxes on your own domain, created in the panel and read in the browser through webmail (Email Accounts).
- Apps, if the host allows them. The Application Manager runs Node.js, Python and Ruby apps through Phusion Passenger once the host has switched it on, and the host decides which Node.js version is installed.
The trade-off is limits. On servers with CloudLinux OS, the kernel holds every account to limits that the host sets:
| Limit | What it caps | What happens at the limit |
|---|---|---|
| SPEED | CPU, as a share of one core | The site responds slower |
| PMEM | Physical memory | Usually 500 and 503 errors |
| EP (entry processes) | Simultaneous requests to PHP and other dynamic scripts, plus SSH sessions and cron jobs | Error 508 (Resource Limit Reached) |
| NPROC | Processes and threads | 500 or 503 errors |
| IO and IOPS | Disk throughput and disk operations per second | Disk work slows down or pauses until the second is over |
| Inodes | Number of files and folders | At the hard limit, nothing new can be written to disk |
Hosts add their own caps on top: monthly traffic, the number of mailboxes and databases, and on cPanel servers the number of emails each domain may send per hour (send limits).
Signs You Have Outgrown Shared Hosting
If your host runs CloudLinux, look in your panel for CPU and concurrent connection usage: CloudLinux's Resource Usage plugin for cPanel, Plesk and DirectAdmin. It lists each resource with its usage, its limit and its faults, the number of times you hit that limit (LVE Manager docs). These signs say the package, not the site, is the problem:
- Faults on ordinary days. A spike during a sale is a reason to watch. Faults at normal traffic, day after day, mean the package is too small.
- 508, 503 or 500 errors at busy moments, which match the EP, PMEM and NPROC rows above.
- Software the host doesn't offer: a PHP version or extension it hasn't installed, Redis or Memcached for an object cache, Docker, or a process that runs all the time, such as a bot, a queue worker or a websocket server.
Two problems look similar but need other fixes:
- A slow site without faults. Then the time goes into your site, not into the limits. WordPress's caching guide calls caching "the fastest way to improve performance": a page cache serves your pages as static files, "reducing the processing load on the server". On a VPS, an uncached page costs the same work as before.
- Hitting the hourly email limit. Sending from your own VPS means meeting Gmail's sender requirements yourself: SPF or DKIM, valid forward and reverse DNS (PTR) records, TLS and a spam rate below 0.3%. Send newsletters and shop mail through an email delivery service instead, from either kind of hosting.
Measure before you decide. Run this in a terminal on your own Linux or macOS computer, once at a quiet hour and once at a busy one:
for i in 1 2 3 4 5; do
curl -s -o /dev/null -w '%{response_code} first byte %{time_starttransfer}s total %{time_total}s\n' https://example.com/
done
time_starttransfer is the time until the first byte of the answer, which includes "the time the server needed to calculate the result" (curl's write-out variables). Slow at every hour points to the site itself; fast at night and slow at peaks, together with faults, points to the limits. Keep the numbers to compare with a new server later.
What Changes on a VPS
A VPS is a virtual machine with its own operating system and root access (our beginner's guide to VPS hosting explains the basics). Two things change straight away.
You pick the stack. Web server, PHP, database, Redis, Node.js and Docker are yours to install with apt. Your distribution sets the defaults: the php package installs PHP 8.3 on Ubuntu 24.04 and PHP 8.2 on Debian 12, while WordPress recommends "PHP version 8.3 or greater". Each PHP branch gets two years of full support and then two years of security fixes only (supported versions), so planning PHP upgrades is now your job.
You set the limits. There is no EP limit any more, but PHP still has a cap: PHP-FPM's pm.max_children "sets the limit on the number of simultaneous requests that will be served" (PHP manual). Once PHP-FPM is installed, check the pool settings and search the current and rotated logs:
grep '^pm' /etc/php/*/fpm/pool.d/www.conf
sudo zgrep max_children /var/log/php*-fpm.log*
The stock pool on Ubuntu 24.04 and Debian 12 has pm = dynamic and pm.max_children = 5: five PHP requests at a time. When all five are busy, PHP-FPM logs [pool www] server reached pm.max_children setting (5), consider raising it to /var/log/php8.3-fpm.log (php8.2-fpm.log on Debian 12). Raise the value only as far as your RAM allows, since every child is a PHP process with its own memory.
What You Take Over
Everything the host did below your files is now yours. On Ubuntu 24.04 and Debian 12, start here.
Security updates. On Ubuntu Server, unattended-upgrades "is installed by default" and applies security updates automatically (Ubuntu docs). On Debian the package may be missing or switched off (Debian wiki). These commands install it if needed, switch it on and test it on both; answer yes when it asks about automatic updates:
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades
sudo unattended-upgrade -v --dry-run
It doesn't reboot on its own: Unattended-Upgrade::Automatic-Reboot defaults to "false", so a new kernel waits for a reboot you plan.
Certificates. Most Certbot installs renew through "a scheduled task which runs certbot renew periodically" (Certbot guide). Check that the timer exists and that a renewal would work:
systemctl list-timers | grep certbot
sudo certbot renew --dry-run
If the first command prints nothing, look for certbot renew in /etc/crontab and /etc/cron.*/ instead. Our nginx and Let's Encrypt guide sets up the first certificate.
The release itself. Ubuntu 24.04 LTS gets standard security maintenance until May 2029 (release cycle). Debian 12 is now in Long Term Support, which ends on 30 June 2028 (Debian announcement). Before your release's end date, you upgrade it or move to a new server.
Backups, access and mail. Backups and restore tests are yours (off-site backups with restic), and so are SSH access and the firewall (SSH hardening). Mail needs a mail server you run or a mail service (running a mail server on a VPS).
The Cost of Your Time
| Job | Shared hosting | VPS |
|---|---|---|
| OS and security updates | The host | You: unattended-upgrades plus planned reboots |
| PHP, web server, database | The host; you pick a PHP version in the panel | You install, tune and upgrade them |
| Certificates | AutoSSL or a panel button | Certbot, plus a renewal check |
| Mailboxes | In the panel | A mail server you run, or a mail service |
| Backups | The host's, if your package has them, or your own from the panel | You, restore tests included |
| Release upgrades | The host | You, inside the support window |
| A failure at 3 a.m. | The host's job | Yours |
Most of the time goes into the first setup, the checks you have to remember and the evening something breaks. Before you compare prices, estimate the hours a month this list will take, put a value on them and add that to the VPS side.
A Middle Route
- A bigger shared package, if your faults come from one resource and the next package raises that limit. Ask your host for the limits of each package.
- Split the jobs. Keep the site and mail on shared hosting and put only what doesn't fit, such as a bot, an API or a worker, on a small VPS under a subdomain like app.example.com. A new A record for that name changes nothing for the site or for mail.
- A panel on a VPS. Hestia Control Panel, open source under GPLv3, gives you Apache and NGINX with several PHP versions, mail with webmail, MariaDB, MySQL or PostgreSQL, Let's Encrypt and a firewall with fail2ban (README). It runs on Debian 12 and Ubuntu 24.04, must go on a fresh install, and needs at least 1 GB of RAM without SpamAssassin and ClamAV, with 4 GB recommended. DirectAdmin and cPanel also run on a VPS with a paid licence (DirectAdmin, cPanel). A panel gives you the buttons back; updating and repairing the server is still your job.
- A managed VPS, where the provider looks after the server. Ask what that covers: only the operating system, or also the web stack, backups and your apps.
Which One Fits
- Stay on shared hosting if your site is PHP and MySQL, such as WordPress, faults stay at zero with caching on, you want mail on your own domain without running a mail server, and nobody wants to look after a Linux server.
- Move to a VPS if faults or 508 errors keep coming at normal traffic with caching on, you need software or long-running processes the host can't offer, or you want several sites and apps on one server you control.
- Split if the site is fine and only one extra service doesn't fit.
We sell both, so pick on fit. Our web hosting is the panel route, with DirectAdmin, mailboxes and a free SSL certificate. Our VPS plans are KVM virtual machines with full root access, dedicated RAM and shared vCores that you manage yourself; if you want help running the server, ask support about the scope before you order. Our migration guide covers the move itself, and our hosting types overview covers dedicated and cloud hosting.
FAQ
Is a VPS faster than shared hosting? Not automatically. A VPS removes the per-account limits, but a stock PHP-FPM pool still serves five PHP requests at a time, and an uncached page takes the same work as before. Run the curl loop above before and after the move and compare.
Can my email stay where it is when the site moves to a VPS? Yes. Mail goes to the host names in your MX records: when MX records exist, mail servers "MUST NOT utilize any address RRs associated with that name unless they are located using the MX RRs" (RFC 5321). If your MX record names the bare domain, mail would follow the website's A record to the VPS, so first point MX at a host name that keeps resolving to the mail server, such as the server name your host gives you. Check your SPF record too.
Do I need a control panel on a VPS? No. You can install nginx or Apache, PHP-FPM and a database over SSH and run them from config files. If you want mailboxes and several sites in one interface, install a panel such as HestiaCP first, on the fresh server.
Who makes the backups on a VPS? You do, unless your provider sells them. On a Space-Node VPS, backups are not included in the plan price, but you can arrange them through a support ticket. Keep at least one copy off the server as well.
How much Linux do I need to know? Enough to log in over SSH, install and update packages with apt, manage services with systemctl, read logs with journalctl and edit config files. If that sounds like work you don't want, stay on shared hosting or pick a managed VPS.
Sources
All opened on 30 October 2026:
- CloudLinux: Limits, LVE Manager and the Resource Usage plugin
- cPanel: MultiPHP Manager, Manage AutoSSL, Email Accounts, Application Manager, How to Set Email Send Limits, Pricing
- DirectAdmin pricing
- WordPress: Requirements, Cache
- PHP: Supported versions, FPM configuration, php-src www.conf.in (8.3, 8.2) and fpm_process_ctl.c (8.3, 8.2)
- Ubuntu 24.04 packages: php, php8.3-fpm file list, php8.3 packaging: prepare-fpm-pools.mk, 0012-fpm-config.patch, php-fpm.logrotate
- Debian 12 packages: php, php8.2 prepare-fpm-pools.mk
- Ubuntu: Automatic updates, Release cycle, unattended-upgrade(8), zgrep(1)
- Debian: Periodic updates with unattended-upgrades (wiki), Security support for Bookworm handed over to the LTS team
- Certbot user guide
- curl: write-out variables, man page
- Google: Email sender guidelines
- IETF: RFC 5321, Simple Mail Transfer Protocol
- Hestia Control Panel: Getting started, README