Set Up Your Own Server Host your own files, email and web site

• Web hosting (also called shared hosting). You get an account on a server that the host runs and looks after. A control panel, usually cPanel, lets you add a website, set up email addresses and store files, all from your browser. Updates, server security and hardware are the host's job. It is meant for one person, family or business, and it is usually the least expensive of the three.

• Reseller hosting. A plan for people who host other people's sites. It gives you a bigger allowance and an extra management panel, usually WHM, to create and manage many separate cPanel accounts for your own customers, often under your own brand. It suits web designers and small hosting businesses. It brings extra responsibility: you look after your customers' accounts, their security and their support. It is more than you need to run your own email, files and website.
• VPS hosting (virtual private server). You get your own slice of a server with full administrator access, and usually an empty machine. You install and secure everything yourself: the web server, email, updates, firewall and backups. That takes real technical knowledge, and it never stops being your job. Some hosts offer managed VPS plans that take over part of the work for a higher price.

On ordinary web hosting you do everything through a control panel, a web page where you add email addresses, upload files, install a website, manage the domain's settings and turn on security. Which panel you get depends on the host. Two are by far the most common in shared hosting:

• cPanel. Very widely used, and usually runs on Linux servers. What customers see is cPanel. Behind it, hosts and resellers run a second, administrator side called WHM, which is where accounts are created and servers are managed. As an ordinary hosting customer you will never see WHM. A big practical plus: cPanel hosts usually include a one-click app installer (often Softaculous or Installatron, depending on the host) that sets up a large number of ready-to-use apps, such as WordPress, Joomla, Drupal and Nextcloud, with little or no configuration. The installed app is still yours to update and protect. In our experience, cPanel is the one you are most likely to be offered on lower-cost hosting plans.
• Plesk. The other big one. It runs on both Linux and Windows servers, which matters if you need Windows-only technology for your site. A single product covers both the customer's view and the host's administrator view. In our experience, Plesk is offered more often with leased virtual and dedicated servers than on ordinary shared hosting plans, where cPanel is far more common. Both work well, so choose the host first and the panel second.

Other panels exist, and some hosts build their own. They all do the same core jobs, though the names and screens differ: email accounts, file manager, FTP accounts, databases, security certificates, DNS settings and backups. This guide names the setting, not the screen, so it works with any of them. If you cannot find something, use the panel's search box, which most have, or ask your host.

What sits behind the panel

You do not have to run any of this, but it helps to know it is there. Behind the panel your host operates the web server software, the mail server, DNS, the databases, the firewall and the backup system. Their configuration, and how quickly they are updated, is a big part of what you are paying a host for. It is also why the questions in How to judge any host matter: your host, not you, holds the keys to all of it.

What a domain is and what nameservers do

Two companies are involved. The registrar is where you buy and renew the name. The host is where your website and email live. Nameservers are the link between them: they answer "where is this domain's website, and where does its mail go?" Whoever is listed as the registrant owns the domain, so make sure that is you, under your own login, and not your host, a web designer or a friend.

More: ICANN beginner's guides · Cloudflare: what is DNS? · ICANN lookup (see who is listed for any domain)

Where to get a domain

Registrar and host can be the same company or two. Many hosts let you register the name inside the same account. That is convenient, but their price is often higher than a dedicated registrar's, and a name tied to your host account is harder to walk away from. Keeping them separate means changing hosts never puts the name at risk. I personally use Porkbun. When I started in 1995, Network Solutions was the only place to register a .com, and competition is the reason there is a choice today. Any reputable registrar will do. Prices depend on the ending (.com, .org, .net and so on) and they change, so compare the first-year price and the renewal price.

Some options: Porkbun · Namecheap · Cloudflare Registrar · Gandi · Hover. This is a starting list, not a ranking, and I have not tested them all. Check current prices and terms yourself.

Skip this if a name tied to you is a danger. Someone in a risky situation should get expert help before registering anything in their name. See the scenario guides.

Connect your domain to your host

1. Your host provides the nameservers you will need, before you register or point your domain, so sign up with the host first. They look something like ns1.domain.net and ns2.domain.net, and there may be as many as four. Copy them exactly, in order. They are in the welcome email or the control panel.
2. Log in at the registrar, open the domain's nameserver (or DNS) setting, choose custom nameservers, enter the host's, and save.
3. Wait. It often works within minutes to hours, and can take up to a day or two. Until then, some visitors see the old setup and some the new. DNS Checker shows how far the change has spread around the world.
4. Turn on auto-renew and the registrar's transfer lock, use two-factor authentication on the registrar login, and use a contact email that is not on the domain itself.

Check your work: ICANN lookup shows the nameservers a domain currently uses, and the internet.nl tests flag common mistakes.

More detail: nameservers, who can see your details, expiry and transfers

Two ways to set it up. The simple way is to point the domain at your host's nameservers. The host then creates the records for your website and email automatically. The other way is to keep the nameservers at your registrar (or a service such as Cloudflare) and add the records yourself: an A record pointing at the host for the website, and MX records for mail. It is more flexible, and there is more to get wrong. If you are new to this, use the host's nameservers.

Order matters. Records your host created for you only work once its nameservers are the ones in charge. If you change nameservers, check that your mail and website records came with you.

Registrant details. Registering a domain requires contact details, and by default they can end up in a public record (WHOIS, or its newer form RDAP). Many registrars now hide or redact them, but not all do, and some charge for it. Look for a privacy or redaction setting, and look up your own domain to see what shows. Do not invent fake details to avoid this. Wrong contact details can get a domain suspended. Hiding them through the registrar is the right route.

Expiry. A domain that expires normally goes through a grace period and then a costly redemption period before anyone else can register it. Do not count on that. Auto-renew, plus a reminder in your calendar, is far cheaper.

Moving a domain. To transfer to another registrar you need an authorization (EPP) code from the old one, and the domain must be unlocked. There is normally a waiting period, often 60 days, after registering a domain or changing its registrant details.

Country-code endings (.uk, .ca, .de and others) have their own rules, and some require a local address. Check before you buy; the IANA root zone database links each ending to the organisation that runs it. Screens and setting names differ between registrars, so use the setting names above and your registrar's search box or help pages.

Jurisdiction. Your registrar and the registry that runs your ending answer to the laws of where they operate, just as your host does.

• The renewal price, not just the sign-up price. Introductory offers such as "half price" often apply only to the first term. A plan advertised at a low price for a one-year term may renew at a higher price. The plan page usually shows both, in small print.
• What the plan allows: how many websites, how much storage, how many email accounts, and whether backups are included and how often.
• The billing term. Longer terms usually cost less per month, but you pay more up front and are committed. Check the refund period.
• Subdomains and add-on domains can stretch a small plan. A plan that allows "one website" may limit the number of domains. Most hosts let you add subdomains to your domain, such as files.yourdomain.com or blog.yourdomain.com, and run each as its own separate site, often without counting against the limit. Many hosts also allow a fully separate domain as an add-on domain under the same account. It gets its own website and its own email addresses, which can give you a totally separate identity. Rules and limits differ between plans, so check the plan's terms. Two things to remember: a subdomain is publicly tied to your main domain, so it is not a way to keep sites unconnected, and everything on one account, add-on domains included, shares one login and one set of resources, so protect it well.
• The security certificate and search listings usually carry over. Almost all hosts include the certificate at no extra cost, issued through open providers such as Let's Encrypt, and on most control-panel hosts the automatic HTTPS certificate covers your subdomains too, so each one gets the padlock without extra work. Check that it does on yours. If you list your site with a search engine's webmaster tools, such as Google Search Console, verifying the whole domain normally covers every subdomain under it, so you verify once. That is optional, and it means telling a search company about your site, so decide whether you want that.
• Domain names are separate, and often billed by the year. Some plans include a domain for the first year only.

Email. Many people keep their domain at a registrar and point it at a mail provider instead of using their host's mail. You can change providers without ever changing your address. Providers that support custom domains include Proton Mail (affiliate link), Mailbox.org and Posteo. They give you exact copy-and-paste records to add to your domain. If the provider is unreachable, so is your mail. Do not run your own mail server: mail from a home or small server is often treated as spam, the setup is easy to get subtly wrong, and one mistake can expose everything. Bulk email is a different job. This guide is not a primer on newsletters or mass mailing, but some people will be tempted to send them from their hosting account. Do not send bulk email from your hosting account. Instead, use a dedicated bulk email sending service with a good reputation. On shared hosting you may share one IP address with many other customers, and even if someone else breaks the rules, a blacklisted IP can affect your email too.

Storage. The simplest place to keep files is your own hosting account. Your plan includes disk space, often far more than the small allowance a free cloud account gives you, and the files sit on a server you rent under your own login rather than inside a big company's cloud service. You upload with an FTP program (below) or the control panel's file manager. Two cautions: your host can read anything stored unencrypted, and the space is shared with your website and mail. For anything sensitive, encrypt it before you upload it. Our Encryption article explains how, and the encryption tool does it in your browser. Other options: an end-to-end encrypted provider such as Proton Drive (affiliate link), which cannot read your files at all; Cryptomator, which encrypts on your device before files go to any storage; or self-hosting an app such as Nextcloud on your hosting, which gives you control and also the job of keeping it updated and backed up.

Encrypted archives. Another option is an encrypted zip. 7-Zip can pack a folder into a password-protected archive before you upload it. It saves server space, and it saves something less obvious: many hosts limit the number of inodes (roughly, the number of files and folders) on an account, and every file in a folder uses one. A zipped folder counts as a single file. When you create it, choose AES-256 encryption rather than the old default zip encryption, which is weak, and use a long passphrase. Choosing the .7z format and turning on "encrypt file names" also hides what the files are called. Keep the passphrase in your password manager, because a lost one cannot be recovered.

FTP programs (for uploading to your own hosting): FileZilla (Windows, Mac, Linux), WinSCP (Windows), Cyberduck (Mac, Windows) and CuteFTP (Windows, paid). Download only from the official site, because fake download sites are common. They are in our resources list too.

• What do you log, and for how long? Connection records, access logs, mail logs. A precise answer beats "we take privacy seriously."
• Where is the company, and where are the servers? These are two separate laws. Read the jurisdiction discussion in our VPN/TOR article: it applies to hosts just as much as to VPNs.
• What happens when a court or police asks for data? Will they tell you first, where the law allows? Do they publish how often it happens?
• How do backups and deletion work? Deleted should mean deleted, on a stated schedule.
• How easily can you leave? You should be able to move your domain and your data out, without asking permission.
• How do they get paid? A service that costs real money to run has a business model. Know what it is.

Everything you set up sits behind one login, so protect that before anything else.

• A long, unique password kept in your password manager, and two-factor authentication on the hosting account and the control panel. Most control panels offer it in their security settings.
• The contact email for the account should not be on the domain you host there. If your mail goes down, you still need to receive the message telling you why.
• Turn on auto-renew for the domain and any hosting plan, and lock the domain against transfers if your registrar offers it.
• Turn on backups, and test that you can restore one. Also keep your own copy of anything important. A backup that lives only at your host is not really yours.
• Use a separate login for each person and job where the host allows it, and remove people who no longer need access.
• Keep your text note up to date. Add every setting and change to the notes file you started at the beginning: what you set, where, and when. Login passwords stay in your password manager, and passwords you have to hand to a program, such as a database password or the one your FTP program uses, can go in the note as long as the note is kept inside an encrypted container.

Setting up email on your own domain is the most useful thing you can do here. You create mailboxes such as you@yourdomain.com, and then you choose how you read them. There are three ways, and they differ in where your mail lives.

Make some throwaway aliases. On most servers you can create many alias addresses, so this is a good time to make a few. Use them when you request information or sign up for anything you do not need to keep as part of an account. When one becomes a spam collector, delete that alias and make another. Do not use a throwaway for anything you might need to recover later, such as a bank or your hosting account. See our email alias guide.

Note: emails stored on the server count against your available disk space, along with your website and files. Delete old mail and large attachments now and then, and keep an eye on the limit. Your control panel likely has a provision to clean up old stale mail and delete spam and trash.

POP3: download and keep it yourself

POP3 copies your mail to one device, and by default removes it from the server. Less of your mail sits on the host. But it is really a single-device method: the mail is on that laptop only, and if the laptop dies without a backup, so does the mail. Most mail programs have a "leave a copy on the server" setting, which is the compromise many people choose.

IMAP: leave it on the server and sync

IMAP keeps your mail on the server and shows the same mailbox on your phone, laptop and tablet. It is what most people want. The trade-off is that your entire mailbox sits with the host, so everything in What your host can still see applies fully. Watch your mailbox size limit, too. Old mail piles up.

Webmail: read it in a browser

Control-panel hosts usually provide webmail, a mailbox you open in a web page, with nothing installed. It is handy when you are travelling or on a borrowed computer. Treat it like any web login: never use it on a computer you do not trust, and log out when you finish. Sign-in details typed on a public or shared computer can be captured by software on it.

Which should you choose?

• Most people: IMAP on your devices, plus webmail for emergencies.
• If you want less mail on the host: POP3 on one device you back up carefully, or IMAP with old mail moved to a local folder.
• If you move between computers a lot: webmail, with the cautions above.

The settings that matter

• Use the encrypted connection only. Mail programs should connect with SSL/TLS: usually IMAP on port 993, POP3 on port 995, and outgoing mail on port 465 or 587. Avoid the old unencrypted ports. Check your host's mail settings page for the exact values, because they differ between hosts. A VPN protects your email program as well as your web browsing, so it adds a second layer, especially on public Wi-Fi. It supplements the encrypted mail connection and does not replace it.
• A unique strong password for every mailbox, not shared with anything else.
• Set up SPF, DKIM and DMARC for your domain. They tell other mail systems that mail from your domain is really yours, so your messages are not marked as spam and no one can easily impersonate you. Most hosts set these up automatically when a domain is added to your account, but you can check your domain's DNS zone file (the list of records for the domain, usually found in the control panel) to verify. Control panels often have a deliverability tool that checks it for you. Check the result with the internet.nl email test.
• Be careful with a catch-all address. It makes aliases easy (see our email alias guide), but also collects every piece of spam sent to any name at your domain.
• Deal with the default address. On many hosts, adding a domain also creates a default email address, and on cPanel it is often named after your account username. Anyone who learns that address learns your control panel username, which is half of a login. It is not a big risk on its own, but it is easy to close: set the default address (or a forwarder for it) to reject mail with a message such as "No such user at this address," and use only the mailboxes you create yourself.
• Be careful with forwarding. Forwarding your mail to a less secure place undoes the privacy you set up.

The honest part

Mail on a normal host is not end-to-end encrypted. The connection to the server is encrypted, but the mail is stored readable, and the host and anyone with server access can read it, as can the servers your mail passes through on its way to the recipient. If a message must be private, encrypt it before it leaves your device, for example with PGP. Thunderbird has OpenPGP built in. Our Encryption article explains the basics.

Your hosting plan includes disk space you can use as your own file storage, often far more than a free cloud account offers. The question to ask, as in our Cloud Storage article, is who holds the keys? On your own hosting the host can still read what you store, so encrypt anything sensitive before you upload it (see Encryption and the encryption tool). Programs and providers are listed in Where to get email, storage and FTP programs.

• Moving files to your host is done with FTP, a standard way to transfer files, using a small program on your computer (an FTP client) that shows your files on one side and the server's on the other. Your host gives you the server name, and you create an FTP account in the control panel. Use SFTP or FTPS, never plain FTP. Plain FTP sends your password in the open. Most clients support all three, so pick the secure one. The control panel's file manager works too, and it has one clear advantage: if you upload a zip file that must be unpacked on the server, you can extract it in the file manager, which you cannot do over FTP. Programs are listed in Where to get email, storage and FTP programs. Your host's help pages explain the exact settings.
• Keep private files outside the public web folder. Anything inside the folder your website is served from can be reached by a web address. Put private files elsewhere in your account, and make sure directory listing is off so visitors cannot browse folders.
• If a file must sit inside the web folder, add roadblocks. On most control-panel hosts (Apache or LiteSpeed web servers) a small text file named .htaccess in a folder can switch off the folder listing (Options -Indexes) or block access to everything in it (Require all denied). Putting an empty index.html file in each folder is a second, simpler roadblock: a visitor gets a blank page instead of a list of files. These are speed bumps, not locks. Anyone who knows a file's exact address can still fetch it unless access is denied, so encrypt anything sensitive. Your host's help pages explain .htaccess for your setup.
• Do not assume "unlimited" means unlimited. Shared plans often advertise unlimited storage but are meant for websites and mail, not for bulk file storage, and they have fair-use limits. Read the terms. The limit that usually catches people is the inode limit, the cap on the number of files and folders on the account. In our experience few hosts pay much attention to what you upload, but the account will stop working properly when you reach its inode limit, even with plenty of disk space left. Zipping folders before you upload them (see the encrypted archives note above) counts each archive as one file, and can keep you from running out.
• Consider running a file-sync program such as Nextcloud, which many control-panel hosts can install with a click. It is a program you now have to keep updated, so decide whether you will.
• Encrypt before you upload anything sensitive. A tool such as Cryptomator, or our encryption tool for single files, means the host only ever holds scrambled data. See Cloud Storage for the "who holds the keys" question.
• Keep a second copy somewhere else. A host is one place; things go wrong.

• You may not need a home page at all. If you are only interested in email and storage, you can leave the website empty. Anyone who types your address would just get a "404 not found" error, and at times that is a good thing. Remove any placeholder page your host put there, and make sure the folder listing is off, so visitors see an error and not your files.
• If you do want a page, a simple static one is the safest. A page made of plain files has almost nothing to attack and needs no updates. Site builders such as WordPress and Joomla add a lot of files (which use up your inode limit) and may be overkill for what you need. They also add a login, plugins and a steady stream of security updates, and they offer more ways in for hackers: their source code is public, so attackers can study it for weaknesses and scan the internet for sites running old versions. Choose one on purpose, if you really need to maintain a significant site, and keep it updated.
• Turn on HTTPS. Almost all hosts include an SSL/TLS security certificate at no extra cost, issued and renewed automatically through open providers such as Let's Encrypt. You should not have to buy one, and it encrypts the connection just as well as a paid one. Check that the padlock appears and that plain http redirects to https. If it does not redirect on its own, the redirect can be added to your .htaccess file (on Apache and LiteSpeed hosts), and many control panels also have a switch for it. Back up the file before you edit it.
• Protect the admin login with a unique password and two-factor authentication, and remove any sample pages, demo content and unused accounts that came with the software. Many site builders, such as Joomla, also let you save a passkey unique to your computer, so signing in needs that device and not just a password. Register a second passkey or keep recovery codes, in case you lose the device.
• Do not publish your email address as plain text. Spam programs collect them. Use a contact form or an alias you can switch off. If you must show one, our email address protector makes a snippet that hides it from most spam robots.
• Be careful what your site tells visitors about you. Photos carry hidden data (see our photo metadata stripper), and the domain record may show your details unless your registrar hides them.
• Think about what your site does to visitors. Every tracker, font and video you add from another company sends your visitors' details to that company. A site that respects privacy loads everything from itself.
• Keep everything updated, and back it up.

A virtual server has none of the safety net of a control panel. If you go this way:

• Log in with SSH keys, not passwords, and turn password login off.
• Turn on a firewall and open only the ports you use.
• Turn on automatic security updates, and check regularly that they are working.
• Do not run your own mail server unless you already know why not to. Mail sent from a new server is often treated as spam, and a small mistake can expose everything. Use your host's mail service or a dedicated mail provider.
• Keep backups off the server, and test a restore.

If that list sounds like a lot, a control-panel host is the better choice.

• What is possible: your own domain, email, files and website. A domain plus email is the best start.
• Start with ordinary web hosting. Reseller hosting is for hosting other people, and a VPS needs real technical knowledge.
• Where to get it: a registrar for the domain (separate from your host if you can), and a paid host judged by what it logs, where it is, and how you can leave. Avoid free hosting. Never put on a server something you could not stand to have read.
• High risk: talk to an expert first. A domain in your name is a link to you.
• Setting it up: point the domain at the host's nameservers, then protect the account first: unique password, two-factor authentication, backups, auto-renew.
• Email: IMAP on your devices, plus webmail for emergencies. Use encrypted ports only, and set up SPF, DKIM and DMARC. Mail on a normal host is not end-to-end encrypted, so use PGP for anything truly private.
• Files: SFTP, private files outside the web folder, and encrypt sensitive files before you upload them.
• Home page: static is safest. Use HTTPS, protect the login, and keep your address off the page.