Many web projects start on shared hosting, and for a lot of them that is the right place to stay. It is cheap, the provider maintains the server, and a control panel handles email, SSL certificates and backups. Problems start when a project needs something shared hosting was never designed to provide.
This guide is for developers and agencies deciding whether a project should move to a virtual private server (VPS), what to look for in one, and how to choose where the server sits.
What shared hosting is good at
Shared hosting puts many customer accounts on one server, where they share its CPU, memory and disk. Providers enforce per-account usage limits, often through tools such as CloudLinux, so one busy site cannot take over the machine. The provider runs the operating system, the web server and the database server. You upload files and manage the rest through a panel such as cPanel or DirectAdmin.
That model works well for:
- Brochure sites, portfolios and small business sites
- WordPress sites with moderate traffic and a caching plugin
- Simple PHP applications backed by MySQL or MariaDB
- Projects where nobody on the team wants to maintain a server
If a site fits that list and performs well, moving it to a VPS adds maintenance work without adding much value.
Signs a project has outgrown shared hosting
- It needs a process that keeps running. Shared hosting is built around request-driven PHP. A Node.js, Python or Go application server, a queue worker or a WebSocket service usually needs a VPS. Some hosts offer Node.js or Python apps through an application manager, but with tight memory limits and little control.
- It needs software the host will not install. Redis, a specific PHP extension, a newer database version, a search engine such as Meilisearch, or anything shipped as a Docker container.
- It keeps hitting resource limits. Errors such as “508 Resource Limit Is Reached” on CloudLinux-based hosts, slow admin pages at busy times, or a warning email about CPU usage are typical signs the account is reaching its ceiling.
- Neighbors affect you. Accounts on a shared server usually send mail from the same IP address, so one spammer can hurt everyone’s deliverability. A VPS normally comes with its own IP address.
- It needs server-level control. Some clients with data protection obligations need control over logging, retention and who has administrative access, which a shared plan cannot give you.
Fixes to try before moving
Not every slow site needs a new server. If the problem is resource limits on a request-driven PHP or WordPress site, these often solve it for less money and no extra maintenance:
- Turn on full-page caching. A caching plugin, or server-level caching such as LiteSpeed Cache where the host supports it, means most page views are served without running PHP or touching the database.
- Find slow database queries. On WordPress, a plugin such as Query Monitor shows which queries and plugins are expensive. Missing indexes and bloated options tables are common culprits.
- Offload static files. Serve images, scripts and stylesheets through a CDN, and compress and resize images before upload.
- Block abusive bots. Aggressive crawlers and scrapers can consume more of an account’s limits than real visitors.
- Move to a higher shared tier. A larger shared plan raises the limits while the provider still handles the server.
If the problem is a missing capability, such as a long-running process or Docker, no amount of optimization will help. That is when a VPS becomes the right move.
What changes on a VPS
A VPS is a virtual machine with its own operating system, its own allocation of CPU, RAM and storage, and root access. You choose the distribution, the web server, the runtime versions and everything else in the stack.
The trade-off is responsibility. On an unmanaged VPS, nobody patches the operating system, configures the firewall or checks the backups unless you do.
VPS specs that matter for a web app
Pricing pages focus on vCPU and RAM counts. These are the details that decide whether a server suits a web workload.
Virtualization type
KVM gives each VPS its own kernel, so Docker, WireGuard and other kernel-dependent tools work as they would on a physical server. Container-based VPS products (OpenVZ or LXC) share the host’s kernel, which can make Docker, some networking features or custom kernel modules unavailable unless the host enables them. If the project will run containers, confirm the virtualization type before buying.
RAM
RAM is usually the first limit a web application hits. As rough starting points:
- 1 to 2 GB: a single small application, or WordPress with page caching
- 4 GB: an application server plus PostgreSQL or MySQL plus Redis on the same machine
- 8 GB or more: search engines such as Elasticsearch or OpenSearch, or several containerized services
Measure real usage after launch and resize. Many providers allow upgrades without rebuilding the server.
CPU
vCPUs on most VPS plans are shared with other tenants on the same host. Check CPU steal time (the “st” value in top) under load. Consistently high steal time can indicate contention with other virtual machines on the host, which leaves your application waiting for CPU. For typical PHP and Node.js workloads, a few fast cores matter more than many slow ones.
Storage
NVMe storage can improve performance for I/O-heavy applications, especially databases handling many concurrent queries, though real results depend on how the provider’s storage is built and how heavily it is shared. Size the disk for the operating system, the application, the database, logs and any local backup copies. Logs grow faster than most people expect, so set up rotation from day one.
Bandwidth
Read the bandwidth terms, not the headline. “Unmetered” usually means transfer is not counted, but speed is capped by the port and a fair-use policy applies. Metered plans include a fixed monthly allowance with extra charges or throttling beyond it. Treat “unlimited” with caution: in hosting, it is a marketing term rather than a technical one.
Email and networking
Many providers block outbound port 25 on new VPS accounts to prevent spam. Opening it often takes a support request, if it is allowed at all. If the application sends mail directly, it also needs a reverse DNS (PTR) record that matches the mail hostname. Most projects are better off sending through a transactional email service and avoiding both issues.
Managed or unmanaged
Managed VPS plans cost more because the provider handles operating system updates, security patches and often monitoring. Unmanaged plans are cheaper and give full control, but the baseline work is yours:
- SSH key authentication only, with password login disabled
- A firewall that denies everything except the ports the application needs
- Automatic security updates, such as unattended-upgrades on Debian and Ubuntu
- Backups stored off the server, and restored at least once to prove they work
- Basic monitoring for disk space, memory and uptime
For agencies and outsourcing teams, the bigger question is ownership. If you build a client project on a VPS, agree in writing who patches it after handover. Servers nobody owns are how outdated software ends up running in production for years.
Where the server sits: latency and legal exposure
Latency
Light in optical fiber covers roughly 200,000 km per second, which works out to about 1 ms of round-trip time per 100 km before routing overhead. A server in Europe serving European users will respond faster than one across the Atlantic. A CDN helps with static files, but dynamic pages and API calls still travel to the origin server.
Jurisdiction
Server location affects which local laws apply to the data and which legal procedures authorities can use to obtain it. It is not the only factor: the provider’s own jurisdiction, corporate structure and control over the data matter too. Under the US CLOUD Act, providers subject to US jurisdiction can be required to disclose data in their possession, custody or control, even when it is stored in Europe.
For European projects, Finland and Switzerland are two common choices that sit on opposite sides of the EU border:
| Factor | Finland | Switzerland |
|---|---|---|
| EU member | Yes | No |
| Main data protection law | GDPR | Revised Federal Act on Data Protection (FADP), in force since September 2023 |
| Moving EU personal data there | Free movement within the EU | EU adequacy decision in place since 2000, reaffirmed in January 2024 |
| EU e-Evidence Regulation (criminal proceedings) | Applies since 18 August 2026 | Not directly bound as a non-EU country |
| Typical fit | EU-focused projects with Nordic and Baltic users | Projects that want data outside the EU, within an EU-recognized framework |
In criminal proceedings, the e-Evidence Regulation lets a judicial authority in one EU member state order a provider in another to produce electronic evidence directly, generally within 10 days or 8 hours in emergencies. That does not make Switzerland a way to put data out of reach. A Swiss provider that offers services in the EU may still need an EU legal representative, and Swiss authorities cooperate with foreign investigations through their own procedures. The practical difference is which process applies and how quickly it moves.
Providers that run servers in both countries make the location a choice at order time rather than a reason to change providers. Packetra, for example, offers KVM-based VPS hosting in Switzerland as well as in Finland, so the same stack can be deployed on either side of the EU border.
A quick decision checklist
| Situation | Best fit |
|---|---|
| PHP or WordPress site, moderate traffic, no custom services | Shared hosting |
| Slow site on shared hosting, but no missing capabilities | Caching and optimization first, then a higher shared tier |
| Node.js, Python or Go app server, or background workers | VPS |
| Needs Docker, Redis or a search engine | KVM VPS |
| Still hitting resource limits on the largest shared plan | VPS |
| Nobody available to maintain a server | Shared hosting or managed VPS |
| Client requires data stored in a specific country | Shared hosting or VPS with a verified data location |
Shared hosting is a sensible default, and plenty of sites never need to leave it. Move when a project needs a process, a service or a level of control that shared hosting cannot offer, or outgrows the largest shared plan. Then choose the VPS on virtualization type, real memory needs, bandwidth terms and location, and decide who maintains it before the first deploy rather than after the first incident.
- SQLite cheat sheet - October 29, 2026
- Shared Hosting or VPS? A Practical Guide for Web Projects in 2026 - October 29, 2026
- Best Procore Alternatives: A Side-by-Side Comparison of Cost, Data Sharing and AI - October 28, 2026
