3 min readVPS
An unmanaged VPS is cheap for what it gives you. You get root, real resources, and a bill smaller than a couple of coffees. For a developer who enjoys servers, it is the right answer, and we sell one for exactly that person.
The problem is that most people who buy one are not that person. They bought a server because shared hosting ran out of room, and nobody mentioned that the advertised price covers the hardware and nothing else.
What the price actually covers
Your provider keeps the host running, the network up, and the hypervisor patched. That is where their responsibility ends. Everything above the virtualization layer is yours: the operating system, the web server, PHP, the database, the mail stack, the firewall, the TLS certificates, the backups, and every security update for all of it.
None of that is hard, exactly. It is just never finished.
The server does not care that it is Sunday. Neither does the exploit.
The three-year version
Say you spend two hours setting the server up, then an hour a month keeping it patched and watching logs. That is 38 hours over three years, and it assumes nothing goes wrong.
Something goes wrong. A kernel update breaks a module, or a certificate renewal fails quietly and you find out from a customer, or you get an email from your provider about outbound spam because a contact form got abused. Each of those is an evening, minimum, usually at the worst possible time.
Put your own hourly rate against 38 hours plus a couple of bad evenings. For most people running a business, that number is larger than the difference between an unmanaged box and a managed one, and it is paid in the currency you have least of.
Three signs you have outgrown it
- You have stopped applying updates. You did not decide against them; you just stopped. This is the most common one and the most dangerous, because the server keeps working normally until someone uses a hole you did not patch.
- You are the single point of failure. If you were unreachable for a week, could anyone else log in and fix something? For a lot of small businesses the answer is no.
- You are making infrastructure decisions you cannot evaluate. Copying a hardening guide you found and hoping it was written by someone competent is not a security posture.
None of these mean you did anything wrong. They mean the job grew past the time you have for it.
Where we stand
Our KVM VPS plans come both ways, on identical hardware. Self-managed gives you root and stays out of your way. Fully managed adds $30 a month and puts our engineers on the provisioning, the security baseline, the patching, and the ticket at eleven at night.
Thirty dollars is roughly twenty minutes of most people's billable time. If running your own server costs you more than twenty minutes a month, which it does for most people, the managed version is the cheaper product.
If you are not sure which side of that line you fall on, ask us. We will tell you, including when the answer is that you are doing fine as you are.