VPS, dedicated server or cloud: which suits your business?

A company website usually runs fine on shared hosting. A busier online shop or a custom application needs a VPS or a cloud virtual machine, and a steady, heavy workload needs dedicated resources. The other half of the decision is who updates, backs up and monitors the server, because that changes from model to model.

The four models in brief

• Shared hosting: many websites run on one server, and the provider manages the server.
• VPS: your own virtual machine on physical hardware shared with other customers; on an unmanaged plan, the operating system is yours.
• Dedicated server: an entire physical machine just for you, with hardware-level access.
• Cloud: resources you can request and release quickly on demand, with metered usage.

Shared hosting: few worries, little freedom

On shared hosting, many websites run on a single server. The provider generally manages the server and installs the server software and security updates.

Resources are shared. The CloudLinux documentation notes that one site can use up all of a server's CPU, memory and I/O. Where the provider runs CloudLinux, per-account limits (LVE) prevent that.

The website itself usually stays your job: a WordPress site's core, plugins and theme. WordPress installs minor and security releases itself on most sites.

Since version 5.6, major-release auto-updates are on by default for new installs; older installs need them switched on or run by hand. Plugin and theme auto-updates are off by default, so enabling them is up to you.

VPS: your own machine, your own responsibility

A VPS is your own virtual machine on shared physical hardware. DigitalOcean describes its Droplets as Linux-based virtual machines running on virtualized hardware.

With an unmanaged VPS or a cloud virtual machine, this is where responsibility shifts. AWS says that whoever launches an EC2 instance is responsible for the guest operating system, including updates and security patches, for the software they install and for configuring the firewall.

Shared hardware also shows in performance. Hetzner explains that on shared vCPU plans, capacity is distributed among the instances on the same physical server, while dedicated vCPUs deliver continuous, predictable performance.

Dedicated server: everything is yours, including the work

With a dedicated server, an entire physical machine is yours. Hetzner's rented physical servers give you direct hardware-level access, but the provider offers hardware and network support only.

Everything else is on you: updates, firewall, user management and your own backup solution. There is no automatic monitoring either; you set that up with your own tools.

At the same provider, a managed server comes with system updates, daily backups and monitoring handled by the provider. The hardware is dedicated in both cases; the difference lies in who runs it.

Cloud: flexible, but not a single product

NIST defines cloud computing as a model in which configurable computing resources from a shared pool can be provisioned and released on demand, rapidly and with minimal management effort. It suits workloads that fluctuate or need to scale quickly.

Microsoft's responsibility matrix puts the operating system with the customer for virtual machines (IaaS) and with the provider for platform services (PaaS). In every model, the customer is responsible for data, accounts and access.

If you want to run AI models on your own GPUs or in the cloud, see our on-premise vs cloud article.

Which does a business need? Decide by workload

• Company website: little changing content, predictable traffic. Shared hosting is usually enough, provided the host manages the server and backups run regularly.
• Online shop: database, orders, customer data, peaks during campaigns. If shared hosting limits feel tight, the next step is a VPS or a cloud virtual machine.
• Custom application: its own runtime, background jobs, integrations. This usually calls for a VPS, the cloud or a platform service, because shared hosting gives you little control over the software environment.
• Steady, heavy workload: this is where dedicated vCPUs or a dedicated server come in, as long as someone is there to run it.

Who handles updates, backups and monitoring?

• Shared hosting: the server and server software belong to the provider; the website, content and access are yours.
• Unmanaged VPS or cloud virtual machine: hardware and virtualization belong to the provider; the operating system, updates, firewall and application are yours.
• Unmanaged dedicated server: the provider supplies hardware and network; updates, backups and monitoring are yours.
• Managed options and PaaS: the provider runs the operating system. Whether backups and monitoring are included depends on the contract.

Backups: every model needs a decision

The WordPress documentation says most hosts back up the entire server, but requesting a copy takes time, and a speedy recovery is critical. It recommends keeping at least 3-5 recent backups in different locations, for example on the hosting server, in cloud storage and on your own computer.

In one of its ransomware alerts, Hungary's National Cyber Security Institute (NKI) recommends regular online and offline backups, a backup and restore strategy, and a disaster recovery plan.

Microsoft lists infrequent, untested or on-site backups among the typical gaps of systems run in traditional on-premises environments.

Questions to ask before you choose a provider

1. Who installs operating system and application updates, and how often?
2. Where are backups stored, how long are they kept, and has anyone tested a restore?
3. Who monitors the server, and what happens if it goes down?
4. Does the system run on shared or dedicated resources?
5. Who manages user accounts and access?

If you would rather not run the server you choose in house, see our server operations page and tell us what you are running today.

Sources

• Microsoft Learn: Shared responsibility in the cloud
• AWS: Shared Responsibility Model
• DigitalOcean Docs: Droplets
• Hetzner Docs: Cloud Servers FAQ (shared and dedicated vCPU)
• Hetzner Docs: Differences between managed servers and root servers
• CloudLinux OS documentation: Limits (LVE)
• Wikipedia: Shared web hosting service
• WordPress.org: Updating WordPress
• Make WordPress Core: Core major versions auto-updates UI changes in WordPress 5.6 (24 November 2020)
• Make WordPress Core: Controlling plugin and theme auto-updates UI in WordPress 5.5 (15 July 2020)
• WordPress Developer Resources: WordPress Backups
• NBSZ National Cyber Security Institute: alert on the spread of PHOBOS ransomware (29 February 2020, in Hungarian)
• NIST SP 800-145: The NIST Definition of Cloud Computing