Managed hosting or a VPS: when each makes sense for a small business

Hosting is one of the few startup costs where the cheapest option is cheaper by a factor of five. A basic virtual private server, or VPS, costs about as much as a sandwich each month. Managed hosting for the same site costs several times more. The gap is real, and so is what fills it. On a VPS, everything that keeps the server healthy becomes your job.

This guide explains what that job involves, so you can decide whether the savings are worth it for your business. It's written from the point of view of someone who runs servers for a living and still doesn't run one for everything.

The kinds of hosting, from most managed to least

"Managed" isn't a single thing. It's a line that moves depending on the product, and these are the main stops along it, with entry prices from each company's own pricing page.

Kinsta's cheapest plan is $35 a month, or $350 a year billed annually, for one WordPress site with 14 days of backups, a CDN, free malware removal and round-the-clock support.^⁠[3] Cloudways listed its smallest DigitalOcean server at $11 a month, with free SSL, free migration, around-the-clock support and a server firewall, and was offering 30% off the first three months when we checked.^⁠[2] DigitalOcean's App Platform hosts up to three static sites free and runs a small app container from $5 a month.^⁠[4] A basic Droplet costs $4 a month with 512MB of memory, or $6 with 1GB.^⁠[1]

What managed hosting does for you

Managed hosting sells you an outcome. You get a site that stays up, stays patched and can be restored when something goes wrong. The host takes care of the operating system, the web server, the PHP or Node version, the database, the firewall, the backups and the certificates, and has someone to call when a plugin update breaks the site at night.

Plans differ in the details, so read the list before you buy. The things worth checking are how long backups are kept and whether you can restore one yourself, whether staging copies of the site are included, whether malware cleanup costs extra, and how many sites and visits the price covers.

What you take on with a VPS

DigitalOcean is direct about where its job ends. Under its shared responsibility model, it secures the physical hardware and the virtualization underneath a Droplet. Everything from the operating system up, including patches, configuration, access and your data, is yours.^⁠[5] That's the deal with every unmanaged VPS, whichever company sells it.

Here's what that covers in practice.

Operating system updates

Ubuntu, the most common choice for a VPS, gives each long-term support release five years of standard security updates. Ubuntu 22.04 reaches the end of that in May 2027, and 24.04 in May 2029.^⁠[6] A server still running 22.04 next summer stops getting routine security fixes unless you move it to a newer release or pay for extended coverage.

Ubuntu Server installs security updates automatically through the unattended-upgrades package. By default it doesn't reboot the server afterward, though.^⁠[7] Kernel fixes and some library updates don't take effect until a restart, so someone still has to schedule reboots and check that everything comes back up.

The software your site runs on

The operating system is only the bottom layer. A WordPress site also depends on a PHP version, and each PHP branch gets two years of active support and then two of security fixes only. PHP 8.2's security support ends on December 31, 2026, and 8.0 and 8.1 are already unsupported.^⁠[8] Moving to a newer version means testing your theme and plugins against it first. A managed host plans that move and usually warns you before it happens. On a VPS, nobody warns you.

The same applies to the database, the web server, and any language runtime your application uses. Each has its own release schedule, and keeping track of them is part of the job.

Security and access

A fresh VPS is on the public internet from the moment it boots, and automated scanners start probing it soon after. The baseline is to log in with SSH keys instead of passwords, turn off root login, and allow only the ports the site needs. DigitalOcean's cloud firewalls are free and block traffic before it reaches the Droplet.^⁠[10] Many teams add a tool that bans addresses after repeated failed logins.

None of this is difficult. The risk is that it's easy to skip on the first day and forget about afterward.

Backups you've actually restored

DigitalOcean's Droplet backups cost 20% of the Droplet's price for weekly backups, or 30% for daily ones. Snapshots you take by hand cost $0.06 per GB a month.^⁠[1] On a $6 Droplet, daily backups add $1.80.

Whole-server backups are a good start, not a full plan. A database should also be dumped on its own schedule and copied somewhere outside the same account. The step most people skip is restoring a backup to a fresh server to check that it works. A backup you've never restored is a hope, not a backup.

Certificates

HTTPS certificates from Let's Encrypt are free and renew automatically, and they're about to renew a lot more often. Let's Encrypt's default certificates drop from 90 days to 64 days on February 10, 2027, and to 45 days on February 16, 2028.^⁠[9] Most renewal tools handle that without changes, but Let's Encrypt asks everyone to check that their automation copes with shorter lifetimes. A renewal job that quietly fails now has less time before visitors see a browser warning.

Monitoring

Someone has to notice when the site goes down, the disk fills up, or memory runs out at 2 a.m. That means an uptime check from outside the server, alerts on disk and memory, and logs you can read after something goes wrong. A managed host watches its servers for you. On a VPS, nobody knows about a problem until you do, or until a customer tells you.

What each one really costs

Put the invoice and the work side by side for one small business site.

The VPS saves somewhere between $3 and $27 a month for this one site. Whether that's a saving depends on whose time pays for the upkeep. For a founder who bills clients or sells, an hour a month spent on server chores costs more than the difference. For a technical founder who'd be doing similar work anyway, it may cost almost nothing.

When managed hosting is enough

Managed hosting is the better default for most small businesses. It fits when any of these are true.

• The site is WordPress or another standard PHP application.
• Nobody on the team wants to be paged when the server has a problem.
• The site makes money, so an outage or a hacked plugin costs more than the hosting does.
• You'd rather spend the time on customers than on server upkeep.

If you aren't sure whether you need a VPS, you probably don't.

When a VPS earns its upkeep

A VPS starts to make sense when you need something a managed host won't give you, or when you have the skills to run it cheaply.

• Custom software. Background workers, queues, scheduled jobs, a language runtime the host doesn't support, or your own database configuration.
• Several projects on one server. A few small apps or internal tools can share one larger server instead of paying for managed hosting for each.
• Someone who knows how. A technical cofounder or engineer who already runs servers will handle the upkeep in less time than it takes to learn a hosting dashboard.
• Steady, higher traffic. At larger sizes, a raw server costs far less than managed plans priced per site or per visit.

Even then, set it up as if you'll forget about it. Turn on automatic security updates, schedule reboots, keep backups outside the account and set up alerts before the site goes live.

The middle ground

Two options sit between the extremes and suit a lot of small businesses.

Managed cloud hosts such as Cloudways put a management layer on top of a cloud server from DigitalOcean or another provider. You choose the server size, and they take care of the stack, the updates and the backups. It's the closest thing to a VPS without the upkeep, and our comparison of Cloudways, DigitalOcean and Kinsta measures price and speed for one site on each.

Platforms such as DigitalOcean's App Platform go further. You hand over code or a container, and the platform builds and runs it, handling the operating system underneath.^⁠[4] For a static marketing site or a small web app, that removes most of the server work at a VPS-like price.

Questions to settle before you choose

Answer these honestly and the choice usually makes itself.

• What software does the site run, and does a managed host support it?
• Who fixes it if it breaks at night, and how quickly does it need fixing?
• How much is an hour of that person's time worth?
• Have you ever restored a backup of this site, and could you do it today?

Hosting is one line in a new company's tool budget. The startup tech stack shows the rest, and the startup website checklist covers what the site itself needs before launch.