How to install HestiaCP on a Linux VPS

You install HestiaCP on a Linux VPS by setting a fully qualified hostname, downloading the official hst-install.sh script from the HestiaCP GitHub repository and running it with the web stack you want. The script takes care of nginx, PHP-FPM, MariaDB, mail and the panel itself, and the whole run usually finishes in one pass with no manual package work. This guide covers both common stacks — nginx with PHP-FPM, and nginx with Apache behind it — and ends with a check that the panel answers on port 8083.

HestiaCP is free and open source, but it is not a paid control-panel licence. You download and run it yourself on your VPS, and support for the panel comes from the HestiaCP project.

Before you start

• A Linux VPS running a clean Debian 12 or Ubuntu 22.04/24.04 installation. HestiaCP expects a minimal OS with no other panel, web server or database on it.
• Root access over SSH. See connect to your Linux VPS with SSH if you have not logged in yet.
• A hostname that points at the VPS, for example panel.example.com with an A record set to 203.0.113.10. The installer wants a fully qualified domain name.
• A working email address for the admin account and for Let's Encrypt notices.
• Around 1 GB of RAM or more for a comfortable run. On a smaller VPS, add a swap file first — see add a swap file on a Linux VPS.

Set the hostname and update the server

Set the hostname first. HestiaCP writes it into the panel configuration and uses it for mail and DNS, so changing it later is more work.

hostnamectl set-hostname panel.example.com

Then make sure the hostname resolves locally, so services start without waiting on DNS lookups. Add a line to /etc/hosts:

echo "203.0.113.10 panel.example.com panel" >> /etc/hosts
hostname -f

The last command must print panel.example.com. If it prints just panel or an error, fix /etc/hosts before going further.

Now update the base system:

apt update && apt full-upgrade -y
apt install -y wget curl ca-certificates

Check that no web server or database is present:

apt list --installed 2>/dev/null | grep -E 'apache2|nginx|mariadb-server|mysql-server'

An empty result is what you want. Anything listed means this is not a clean install.

Download the HestiaCP installer

Work from /root and pull the script from the release branch of the official repository:

cd /root
wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
chmod +x hst-install.sh

There are also OS-specific copies in the same folder (hst-install-debian.sh and hst-install-ubuntu.sh). The generic script detects the distribution and calls the right one, so you normally do not need them.

Read the current options before running anything. Flags change between releases, and the help output on your copy is the authoritative list:

bash hst-install.sh -h

Run the HestiaCP install script

The shortest path is the interactive run. It asks about hostname, admin email, the web stack, mail, DNS and the panel port, then confirms before touching the system:

bash hst-install.sh

If you would rather run unattended, pass every answer on the command line. The example below is the nginx + PHP-FPM stack without Apache, with mail enabled and ClamAV and quotas left off:

bash hst-install.sh \
  --hostname panel.example.com \
  --email admin@example.com \
  --nginx yes \
  --apache no \
  --phpfpm yes \
  --multiphp no \
  --vsftpd yes \
  --proftpd no \
  --named yes \
  --mysql yes \
  --postgresql no \
  --exim yes \
  --dovecot yes \
  --sieve yes \
  --clamav no \
  --spamassassin yes \
  --iptables yes \
  --fail2ban yes \
  --quota no \
  --port 8083 \
  --interactive no \
  --force

For the nginx + Apache option — the one to pick when your applications rely on .htaccess files — switch Apache on and keep PHP-FPM enabled:

bash hst-install.sh \
  --hostname panel.example.com \
  --email admin@example.com \
  --nginx yes \
  --apache yes \
  --phpfpm yes \
  --named yes \
  --mysql yes \
  --exim yes \
  --dovecot yes \
  --spamassassin yes \
  --iptables yes \
  --fail2ban yes \
  --port 8083 \
  --interactive no \
  --force

Add --multiphp yes if you want several PHP versions available per domain. Add --clamav yes only on a VPS with enough RAM to hold the virus definitions.

Expect the run to take ten to thirty minutes depending on disk and network speed. You will see package installation, service start-up and, at the end, a summary with the panel URL, the admin username and a generated password. Copy that password somewhere safe before closing the session — the summary is not repeated.

Open the panel port in the firewall

HestiaCP's own firewall is configured by the installer when --iptables yes is used, and port 8083 is opened for you. If you also run UFW on the VPS, allow the panel port there too:

ufw status
ufw allow 8083/tcp

On AlmaLinux or Rocky you would use firewall-cmd --permanent --add-port=8083/tcp && firewall-cmd --reload, but HestiaCP itself is installed on Debian and Ubuntu, so UFW is the usual case. For background on the choices, see UFW vs firewalld vs nftables vs iptables.

Port 8083 is the panel only. If you plan to host mail, check the HestiaCP documentation for the ports it needs, and open only what you actually use.

Log in and finish the setup

Open the panel in a browser:

https://203.0.113.10:8083

Use admin and the password from the installer summary. The certificate is self-signed until you issue a Let's Encrypt one for the panel hostname, so the browser will warn once — accept it and continue.

Inside the panel, complete these three things before you add domains:

1. Open Server settings and confirm the hostname matches panel.example.com.
2. Enable Let's Encrypt for the panel hostname so you stop seeing certificate warnings.
3. Change the admin password if you did not record it, or from SSH run v-change-user-password admin as root.

Check it works

From your own machine, confirm the panel answers:

curl -kI https://203.0.113.10:8083

An HTTP response — typically a 200 or a redirect to the login page — means nginx is serving the panel.

On the server, check the services:

systemctl status hestia --no-pager
systemctl status nginx --no-pager
ss -lntp | grep 8083

The last command should show nginx listening on 8083. Then create a test domain in the panel, upload a small index.php file with phpinfo, and load it over HTTP to confirm PHP-FPM runs. For moving files up, see transfer files to your Linux VPS with SCP and SFTP.

Troubleshooting

• The installer stops with a message that the OS is not supported or not clean — the image still has Apache, nginx, MySQL, MariaDB or another panel installed, or the distribution is not Debian/Ubuntu. Reinstall a clean minimal image from your VPS provider's control panel and start again from the top.
• The browser cannot connect to port 8083 — the port is blocked. Check ss -lntp | grep 8083 on the server first; if nginx is listening, the block is in UFW or in HestiaCP's own firewall rules. Allow 8083/tcp and retry.
• Login page loads but credentials are rejected — the admin password is in the installer summary only. Reset it from SSH with v-change-user-password admin while logged in as root.
• The panel shows a hostname warning — the hostname is not a fully qualified domain name, or the /etc/hosts entry is missing. Fix both, then restart the panel with systemctl restart hestia.
• Install fails partway through an apt step — usually a leftover dpkg lock or a half-configured package from an earlier attempt. A clean OS reinstall is faster and safer than repairing a half-built panel.

Next steps

• Compare panels before you commit — install Plesk on a Linux VPS covers the AlmaLinux and Ubuntu route.
• If you enabled mail in the installer, continue with Postfix and Dovecot basic configuration and set a matching PTR record with your provider.
• Harden the base server — first steps after your Linux VPS is ready covers SSH keys, updates and firewall basics.