DigitalOcean lists a virtual private server at $4.00 a month for 512 MiB of memory and 1 vCPU, and that price buys a slice of a machine somebody else owns and thousands of strangers share. Ask what is a VPS on any hosting site and the answer arrives wrapped in a sales pitch.
Start with the mechanism instead. A hypervisor divides one physical server into separate virtual computers, and each tenant can deploy and run arbitrary software, including operating systems and applications, without controlling the underlying infrastructure. What follows covers how that split works and what “dedicated” really covers. It also covers the prices, the patching, and the cases where the honest answer is to stay put.
Key Takeaways
- DigitalOcean’s published Basic plans span $4.00 a month at 512 MiB of memory to $96.00 at 16 GiB, a ladder that scales with memory rather than with capability.
- A general-purpose plan with 8 GiB of memory and dedicated vCPUs lists at $63.00 a month against $48.00 for the basic plan at the same 8 GiB, which is the visible price of a CPU guarantee.
- A vCPU corresponds to a single hyper-thread on a processor core, and on shared-CPU plans that thread may be shared between multiple other instances, so the 2 vCPUs on an $18.00 plan are two contended threads.
toplabels itsstCPU state as time stolen from this vm by the hypervisor, so readers can measure the gap on the server itself instead of taking that $18.00 claim on trust.- Unix runs 92.0% of websites whose operating system is known and Windows runs 8.2%, per W3Techs figures dated 26 August 2026, so the server you rent will almost certainly be Linux.
- WordPress asks only for PHP 8.3 or greater plus MariaDB 10.11+ or MySQL 8.0+, a baseline that ordinary shared hosting already clears.
- CVE-2025-22225, a VMware ESXi flaw allowing escape of the sandbox, was catalogued on 03/04/2025 with a 03/25/2025 remediation due date, which is what a hypervisor boundary failing in public looks like.
What Is a VPS in Plain Terms
NIST’s cloud computing definition describes the arrangement exactly: provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. A VPS is that model at single-machine scale, one physical server partitioned into independent virtual machines, each running its own operating system.
The word doing the heavy lifting is “private”, and it means something narrower than it sounds. You get a private operating system, a private file system and a private network configuration. You do not get a private machine.
The consumer has control over operating systems, storage and deployed applications, plus possibly limited control of select networking components such as host firewalls, but does not manage or control the underlying cloud infrastructure. That boundary causes nearly every misunderstanding about VPS hosting. It also explains where the tier sits in the web hosting market data: between a shared account and a whole rented box.
Shared hosting hides the machine from you entirely. A dedicated server hands you all of it. A VPS hands you a convincing illusion of the second while charging closer to the first. The illusion holds right up until it does not.
How a Hypervisor Splits One Physical Machine
NIST identifies two forms of full virtualization, and commercial servers use one of them almost exclusively. In bare metal virtualization, also known as native virtualization, the hypervisor runs directly on the underlying hardware without a host operating system, and servers are most often virtualized on computers using bare metal virtualization.
The alternative shape puts a full operating system underneath. In hosted virtualization the hypervisor runs on top of a host operating system, which can be almost any common system such as Windows, Linux or MacOS. Desktop virtualization software on a laptop works this way, which is why a local virtual machine feels different from a rented one.
Once the hypervisor is running, its job is enforcement. It partitions CPU, memory and storage so that each guest operating system can access its own resources but cannot encroach on the other guest operating systems’ resources. Partitioning happens physically, where the hypervisor assigns separate disk partitions, disk drives and network interface cards to each guest, or logically, where multiple guests share the same physical processors and RAM with the hypervisor mediating access.
Almost every VPS plan sold at consumer prices is the logical case. That distinction never appears on a pricing page, and it is the single most useful thing to know before reading one. The guest system on top is nearly always Linux, since Unix accounts for 92.0% of websites whose operating system is known, a split visible in the wider Linux server share across the public web.
Is a VPS a real, physical server?
No. A VPS is a virtual machine running on shared physical hardware. The hypervisor mediates access to the same physical processors and RAM on behalf of several guests at once.
The operating system inside behaves like a real server and accepts real root logins. The hardware underneath is divided, and software enforces the division.
What “Dedicated Resources” Guarantees and What It Does Not
DigitalOcean’s product documentation defines the unit precisely: a vCPU is a unit of processing power corresponding to a single hyper-thread on a processor core, and while RAM, disk storage and network bandwidth are always dedicated, shared-CPU instances get a hyper-thread that may be shared between multiple other instances.
The same documentation states the consequence without hedging. When neighboring instances have high load, an instance could receive fractions of hyper-threads instead of dedicated access to the underlying physical processors, so in practice shared-CPU instances can have access to full hyper-threads but it is not guaranteed.
Hetzner’s plan comparison says the same thing in plainer words. Shared cloud plans are designed for variable usage patterns rather than sustained high workloads, and hardware resources are shared with “neighbors”. Both companies publish this on pages the marketing pages do not link to.
Worth noting: Three of the four resources a VPS advertises really are yours. Memory, disk and bandwidth are allocated and fenced. CPU is the exception on every shared-vCPU plan, and it decides whether a page renders in 200 milliseconds or 2 seconds under load.
You can check this yourself rather than take anyone’s word for it. The Linux manual page for top defines the eighth CPU state field, st, as time stolen from this vm by the hypervisor. Run top across a busy hour and a sustained non-zero %st reading means neighbors on the same host are winning contention you are paying for. No hosting comparison page mentions that number, because it turns a marketing adjective into a testable claim.
VPS Against Shared Hosting, Dedicated Servers and Managed Cloud
AWS draws the responsibility line explicitly for infrastructure-as-a-service: the customer assumes responsibility and management of the guest operating system, including updates and security patches, plus the configuration of the AWS-provided security group firewall. The four hosting tiers differ less in raw capability than in where that line falls.
| Tier | Who controls the OS | Who patches the OS | Cost profile | Sensible when |
|---|---|---|---|---|
| Shared hosting | Provider | Provider | Lowest | Standard site on standard software |
| VPS, managed | You, with support | Shared | Mid | You need root without the sysadmin role |
| VPS, unmanaged | You | You | $4.00 to $96.00 published | You want control and accept the work |
| Dedicated server | You | You | Highest | Hardware isolation is a requirement |
Source: NIST SP 800-145, AWS Shared Responsibility Model, DigitalOcean published pricing, August 2026
Managed cloud platforms sit alongside this ladder rather than above it, trading root access back for someone else handling the runtime. That is a different bargain from the one a VPS offers. Buying patterns across the wider cloud computing adoption figures have pushed many workloads toward it, because operational burden is the expensive part.
The table above compares tiers rather than hosts. Providers inside a tier still differ on support response, network quality and how they define a shared vCPU. Published comparisons such as the Cybernews VPS list work through those provider-level differences.
What a VPS Costs, With Real Numbers
DigitalOcean’s basic tier runs from $4.00 a month at 512 MiB of memory through $6.00 at 1 GiB, $12.00 at 2 GiB, $24.00 at 4 GiB, $48.00 at 8 GiB and $96.00 at 16 GiB, as of August 2026. The ladder tracks memory almost linearly, which makes a plan easy to size and easy to overbuy.
The more revealing number is what a CPU guarantee costs. A CPU-optimized plan, with 4 GiB of memory and dedicated vCPUs, lists at $42.00 a month, and a general-purpose plan, with 8 GiB, lists at $63.00, against a $4.00 floor in the shared-CPU family.
By the numbers: The jump from a $4.00 shared-CPU plan to a $42.00 dedicated-vCPU plan is what a provider charges to convert “usually” into “always” on one resource. Memory and bandwidth cost the same either way. Only the processor share carries the premium.
Managed and Unmanaged VPS Plans Split the Work Differently
AWS states the split in one line: AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest operating system and applications. The plan label decides who gets paged at 3am, and that labor is the cost no pricing page prints.
Shared hosting quietly absorbed that work. A VPS hands it back, along with firewall rules, service hardening, backup verification and the version upgrades a software stack needs.
WordPress still runs on PHP 7.4+ and MySQL 5.5.5+, but those versions have reached official end of life and may expose a site to security vulnerabilities. On an unmanaged VPS nobody but the owner watches that clock. Our cybersecurity coverage keeps finding the same asymmetry: breach costs climb faster than the budgets meant to contain them.
Why it matters: An unmanaged plan at $6.00 a month for 1 GiB of memory carries the same patching obligation as an enterprise fleet. The provider’s duty stops at the hypervisor. Everything above it belongs to whoever pays that invoice, and the invoice is the only part of the transfer most buyers read.
Do you need technical skills to run a VPS?
For an unmanaged plan, yes. The buyer configures the firewall, applies operating system updates and maintains the application stack, since infrastructure-as-a-service requires the customer to perform all of the necessary security configuration and management tasks. Managed plans return part of that work to the provider at a higher monthly price.
The Isolation Boundary Has a Documented Failure Mode
NIST names the failure mode directly: attackers may attempt to break out of a guest operating system to access the hypervisor, other guest operating systems or the underlying host, which is known as escape. Guest isolation is a genuine security control, and it has a documented way of breaking.
The consequence scales badly. If an attacker escapes a guest and gains access to the hypervisor, the attacker might compromise the hypervisor and gain control over all of its guest operating systems, so the hypervisor provides a single point of security failure for all the guest operating systems.
That is not theoretical. CVE-2025-22225 describes an arbitrary write vulnerability in VMware ESXi where a malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including CVE-2025-22225, and the catalog entry carries a date added of 03/04/2025 and a due date of 03/25/2025.
Two honest caveats belong here. That vulnerability trio affects VMware ESXi, and most budget VPS fleets run KVM instead, so the specific identifiers are probably not your hypervisor. What transfers is the class.
The second caveat is harder. Patching the hypervisor is the provider’s job, on the provider’s schedule, with no visibility into either. Isolation helps reduce risk on a VPS, but it does not remove it, and no configuration inside your guest changes that.
Who Actually Needs a VPS
NIST’s infrastructure-as-a-service definition names the clearest trigger: the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. Root access is the reason most people who genuinely need a VPS need one, and shared hosting structurally cannot provide it at any price.
A staging environment, a background worker, a game server or a custom database engine all fall on that side of the line. So does any language runtime your host does not offer. Sustained load comes next.
An undersized instance running at full CPU or memory would suffer from degraded performance or errors, and a site that has genuinely outgrown its shared account shows that pattern in its own metrics long before any sales page tells it to. Predictable performance comes last, and it is what the dedicated-vCPU families charge their premium to deliver.
What is a VPS used for?
Common workloads are web and application hosting for sites needing specific runtime versions, staging environments, game servers and small databases. Self-hosted tools such as mail relays and monitoring agents belong on the list too. Dedicated cloud servers suit high-traffic websites, large databases, gaming servers, machine learning and processing large volumes of data.
Who Does Not Need a VPS
WordPress recommends PHP 8.3 or greater and MariaDB 10.11+ or MySQL 8.0+, and beyond that any server that supports PHP and MySQL will do. That baseline is unremarkable, and shared hosts have cleared it for years. The breadth of the WordPress platform data we track shows how rarely anything more is required.
Buying capacity you cannot use is the common failure. An oversized instance would underuse its resources and cost more, and a $48.00 plan idling below 10% CPU is a worse outcome than the shared account it replaced, because it also came with a sysadmin job attached.
Say your site is a brochure, a blog, a portfolio or a small store on standard software, and nothing about it is broken. A VPS solves a problem you do not have. Growth is not a reason on its own. A specific limit you have actually hit is.
Another group should also stay put: anyone without the time or inclination to patch a server every month. The technical skill is learnable in a weekend, but the ongoing attention is not a weekend project.
An unmaintained VPS is a downgrade: Moving to an unmanaged VPS transfers operating system patching to you. A public server left unpatched for months is more exposed than the shared account it replaced, because nobody else is applying updates to it.
Is a VPS the Same as a VPN?
No, and NIST’s own definitions separate them cleanly. A VPS is rented compute: a provisioned pool of processing, storage and network resources on which the consumer deploys and runs arbitrary software. A VPN is a network service that tunnels traffic through a remote endpoint. One is a computer you administer, the other is a route your packets take.
The confusion has a real root, since a VPS is one of the machines people rent to host a private VPN endpoint. That is a use case rather than an equivalence: the VPN adoption data counts a consumer subscription product, while a VPS is infrastructure you administer yourself.
Can a VPS Be Hacked?
Yes, and AWS assigns that exposure to you: customers are responsible for patching their guest operating system and applications and for configuring the AWS-provided firewall. An out-of-date service or a permissive firewall rule is the common way in, well before anything exotic.
The hypervisor layer carries residual risk no tenant can mitigate, since a single breach of the hypervisor places all the guest operating systems at high risk. Hardening, key-based authentication instead of the reused credentials the password practice data keeps surfacing, and an unattended-upgrades policy all help reduce risk. None makes a public server safe.
Conclusion
The practical answer to what is a VPS is a hypervisor-managed slice of a shared machine that gives you a real operating system and a real root login, and transfers the patching, firewall and backup work shared hosting used to absorb. DigitalOcean lists a 512 MiB plan at $4.00 a month. The guarantee is narrower than the marketing implies, because DigitalOcean’s documentation states that RAM, disk storage and network bandwidth are always dedicated while shared-CPU access to the allocated hyper-thread is not guaranteed. Paying the jump to $42.00 or $63.00 buys that guarantee outright.
The decision reduces to one question that has nothing to do with growth ambition: is there something your current host structurally cannot do? A runtime version, a background process, a root-level configuration, a sustained load your metrics already show. If the answer names something concrete, a VPS is the right tier and the work is a fair price. If it stays vague, stay put, because any server that supports PHP and MySQL will do for most sites on the web.
