How to Set Up Hestia for WordPress: The Ultimate 2025 Guide

So, you have a new VPS and a goal: to host one or more WordPress websites efficiently. You need a control panel that is fast, secure, and doesn’t come with a high price tag. Meet Hestia Control Panel — an excellent free and open-source solution that is perfect for the job.

However, this isn’t just another guide on how to run a basic installation script. This is the Cyber-Ranks.com playbook for building a production-ready WordPress server. We’ll guide you from a clean Ubuntu installation to a fully optimized, secure, and automated setup that you can truly rely on.

Let’s begin.

First things first, you need a clean server environment. We strongly recommend using the latest Long-Term Support (LTS) version of Ubuntu, as it provides a stable and predictable foundation.

Once you are ready, connect to your server via SSH and run the official Hestia installation script. The process is interactive and will ask you which components you want. For most WordPress sites, the standard Nginx + Apache2 stack is a great choice.

wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
bash hst-install.sh

After the installation is complete, the script will display your login URL, username, and password.

Therefore, your first and most important security action is to change the default Hestia port. Automated bots constantly scan the default port 8083 to find and attack Hestia panels.

To make this change, edit the main Hestia configuration file:

nano /usr/local/hestia/conf/hestia.conf

Find the PORT line and change it to a random number, for example, 25814.

Ini, TOML

PORT='25814'

Save the file (Ctrl+O, Enter) and exit (Ctrl+X). As a result, you need to restart Hestia for the change to take effect:

systemctl restart hestia

You can now access your panel at https://your-server-ip:25814.

A public-facing login page is always a target. For that reason, we are going to lock it down completely using a custom domain and a powerful free tool from Cloudflare.

First, go to your DNS manager and point a subdomain, like panel.yourdomain.com, to your server’s IP address.

Next, log into your Hestia panel and navigate to Settings -> Configure -> SSL. In the “Hostname” field, enter your new subdomain. Then, check “Enable SSL for this hostname” and select “Use Let’s Encrypt to obtain SSL certificate.” This will encrypt your connection to the panel.

This is our key strategy for panel security. Instead of only relying on a password that can be stolen, we will require identity verification through an email link to even see the login page. This method is dramatically more secure.

From now on, when you visit panel.yourdomain.com, Cloudflare will stop you and ask for your email. You will receive a one-time login link. In short, if a hacker doesn’t have access to your inbox, they can’t get in.

Finally, let’s disable services you likely don’t need for a WordPress server. This makes your server leaner. In addition, it reduces the number of potential attack vectors.

Edit the hestia.conf file one more time:

nano /usr/local/hestia/conf/hestia.conf

Find and disable FTP and email services if you are not planning to use them.

VSFTPD_SYSTEM='no'
DOVECOT_SYSTEM='no'

This is a simple way to harden your server by turning off unused components.

A default server configuration is rarely optimal. Therefore, we will apply a few small tweaks based on our experience with a 2GB RAM server. These changes will make your WordPress sites noticeably faster.

Let’s allocate the right amount of memory to your database. Edit the MySQL configuration file:

nano /etc/mysql/my.cnf

Then, add the following lines under the [mysqld] section. These values are optimized for a server with 2GB of RAM.

innodb_buffer_pool_size = 512M
max_connections = 50
wait_timeout = 300

Next, let’s set a limit for Apache to prevent it from using too much memory.

nano /etc/apache2/apache2.conf

Find the <IfModule mpm_prefork_module> block and set MaxClients (or MaxRequestWorkers in newer versions) to 100.

Lastly, a quick SSH hardening tweak makes brute-force attacks much more difficult.

nano /etc/ssh/sshd_config

Set the maximum number of login attempts to 3.

MaxAuthTries 3

Remember to restart each service after making changes (systemctl restart mysql, systemctl restart apache2, systemctl restart sshd).

Now that your server is secure and optimized, it’s time to install WordPress.

If you use Cloudflare’s proxy (the orange cloud icon), your server logs will show Cloudflare’s IPs instead of your visitors’ real IPs. As a result, security plugins may not function correctly. Here is the fix.

Open hestia.conf one last time:

nano /usr/local/hestia/conf/hestia.conf

Add this line anywhere in the file:

proxy_ext_ip='yes'

This tells Hestia to look for the correct visitor IP address in the headers sent by Cloudflare.

An unmonitored server is a risk. For this reason, we need to ensure the server can send you important alerts and that your data is backed up securely off-site.

By default, servers often struggle to deliver system emails to major providers like Gmail or Outlook. However, you can solve this by using an external SMTP service.

We use Brevo (formerly Sendinblue) because it has a generous free plan. In Hestia, go to Server Settings (the cog icon) -> Configure -> SMTP Relay. Fill in the SMTP details from your email provider. Now, all system notifications will be sent reliably.

Congratulations! You now have more than just a working WordPress server. You have built a secure, optimized, and autonomous system based on modern best practices.

Ultimately, this setup provides the peace of mind you need to focus on your project, knowing that your digital infrastructure is stable and well-protected for years to come.