Drupal Hosting — Shared, VPS and Managed Hosting for Drupal Sites

In this tutorial, you'll learn how to choose the right hosting for Drupal by comparing shared hosting, VPS, managed Drupal platforms like Pantheon and Acquia, and how to configure a production-ready Linux server with Nginx and PHP-FPM.

What You'll Learn

• Drupal server requirements for production environments
• Pros and cons of shared hosting for Drupal
• Setting up a VPS with LEMP stack (Nginx, PHP-FPM, MariaDB)
• Managed Drupal hosting platforms: Pantheon, Acquia Cloud, Platform.sh
• Environment-specific configuration via settings.php and services.yml
• Production file permissions and security hardening

Why It Matters

Choosing the wrong hosting is the most common reason Drupal sites perform poorly. A well-configured server handles traffic spikes gracefully, keeps pages loading under two seconds, and provides the security and backup infrastructure your content deserves. The hosting decision directly impacts user experience, SEO rankings, and maintenance costs.

Real-World Use

A mid-sized nonprofit migrating from shared hosting to a $40/month VPS on DigitalOcean reduced page load times from 8 seconds to 1.2 seconds after configuring Nginx FastCGI caching, PHP-FPM with OpCache, and MariaDB with InnoDB tuning. The site's donor conversion rate increased by 35 percent after the migration simply because pages loaded faster.

Learning Path

flowchart LR
  A[Local Installation] --> B[Admin Dashboard]
  B --> C[Hosting]
  C --> D[Content Types]
  D --> E[Fields]
  E --> F[Taxonomy]

Drupal Server Requirements

Before choosing hosting, understand Drupal's server requirements:

Required PHP extensions for Drupal:

php -m | grep -E "pdo|mysql|gd|curl|dom|xml|mbstring|json|openssl|zip|filter"

Shared Hosting

Shared hosting places your site on a server with hundreds of other websites. It is the cheapest option but comes with significant limitations.

Pros

• Low cost ($3-15/month)
• No server management required
• Control panel (cPanel, Plesk) for basic management

Cons

• No control over PHP version or extensions
• Limited PHP memory (often 128 MB, insufficient for Drupal)
• Neighbors' traffic affects your performance
• No server-level caching (Varnish, Nginx FastCGI)
• MySQL resource limits

When to Use

Shared hosting works for Drupal only on very low-traffic development or personal sites. For production, even small business sites quickly exceed shared hosting limits.

VPS Hosting

A Virtual Private Server (VPS) gives you dedicated resources on a shared physical machine. This is the most popular option for production Drupal sites.

Popular VPS providers: DigitalOcean, Linode, Vultr, AWS EC2

Recommended Configuration

LEMP Stack Setup

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install Nginx
sudo apt install nginx -y

# Install PHP 8.3 with required extensions
sudo apt install php8.3-fpm php8.3-mysql php8.3-gd php8.3-curl \
  php8.3-dom php8.3-xml php8.3-mbstring php8.3-json \
  php8.3-openssl php8.3-zip php8.3-opcache -y

# Install MariaDB
sudo apt install mariadb-server mariadb-client -y

PHP Configuration

Edit /etc/php/8.3/fpm/php.ini:

memory_limit = 512M
max_execution_time = 120
upload_max_filesize = 64M
post_max_size = 64M
max_input_vars = 3000
opcache.enable = 1
opcache.memory_consumption = 256
opcache.max_accelerated_files = 40000
opcache.revalidate_freq = 60

Nginx Virtual Host Configuration

Create /etc/nginx/sites-available/example.com:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/web;

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_param DRUPAL_PLATFORM production;
    }

    location / {
        try_files $uri /index.php?$query_string;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        expires max;
        log_not_found off;
    }
}

MariaDB Configuration

Create the database:

CREATE DATABASE drupal CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'drupal'@'localhost' IDENTIFIED BY 'strong-password';
GRANT ALL PRIVILEGES ON drupal.* TO 'drupal'@'localhost';
FLUSH PRIVILEGES;

Install Drupal via Composer

cd /var/www/example.com
composer create-project drupal/recommended-project . --no-interaction

Set File Permissions

sudo chown -R www-data:www-data /var/www/example.com/web/sites/default/files
sudo chmod -R 755 /var/www/example.com/web/sites/default/files

Managed Drupal Hosting

Managed hosting platforms handle server management, caching, backups, and deployments for you.

Pantheon

Pantheon is one of the most popular managed Drupal hosting platforms.

Key features:

• Git-based deployment workflow
• Dev/Test/Live environment workflow
• Built-in Varnish and Redis caching
• Automated backups
• One-click Drupal updates
• New Relic APM integration

Workflow:

git init
git remote add pantheon <pantheon-git-url>
git add .
git commit -m "Initial commit"
git push pantheon master

Acquia Cloud

Acquia, founded by Drupal creator Dries Buytaert, offers enterprise Drupal hosting.

Key features:

• Acquia Site Studio (low-code page Builder)
• Acquia Search (Solr integration)
• Acquia Lift (personalization)
• Shield (security)
• BLT (Build and Launch Tool) for CI/CD

Platform.sh

Platform.sh provides infrastructure-agnostic hosting with containerized environments.

Key features:

• Infrastructure as code (.platform.app.yaml)
• Isolated staging environments per branch
• Automatic TLS certificates
• Configurable services (Redis, Solr, Elasticsearch, Varnish)
• MySQL, PostgreSQL, MariaDB support

Environment Configuration

Use settings.php for environment-specific configuration:

<?php

$databases['default']['default'] = [
  'database' => getenv('DB_NAME') ?: 'drupal',
  'username' => getenv('DB_USER') ?: 'drupal',
  'password' => getenv('DB_PASS') ?: 'password',
  'host' => getenv('DB_HOST') ?: 'localhost',
  'port' => '3306',
  'namespace' => 'Drupal\\Core\\Database\\Driver\\mysql',
  'driver' => 'mysql',
];

$settings['trusted_host_patterns'] = [
  '^example\.com$',
  '^www\.example\.com$',
];

if (getenv('DRUPAL_PLATFORM') === 'production') {
  $settings['cache']['bins']['render'] = 'cache.backend.redis';
  $settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.redis';
  $settings['container_yamls'][] = 'sites/default/production.services.yml';
}

$settings['hash_salt'] = getenv('HASH_SALT') ?: 'change-this-salt';

The services.yml file configures caching and other services:

parameters:
  twig.config:
    debug: false
    cache: true
  renderer.config:
    required_cache_contexts: ['languages:language_interface', 'theme', 'user.permissions']

Trusted Host Patterns

Trusted host patterns prevent HTTP Host header attacks. Always configure them in production:

<?php

$settings['trusted_host_patterns'] = [
  '^example\.com$',
  '^www\.example\.com$',
  '^staging\.example\.com$',
];

Without these configured, Drupal will allow any Host header, making the site vulnerable to cache poisoning attacks.

Production File Permissions

Secure file permissions for production:

# Set site directory ownership
sudo chown -R www-data:www-data web/sites/default

# Restrict settings.php
sudo chmod 440 web/sites/default/settings.php

# Allow write access only where needed
sudo chmod 755 web/sites/default/files
sudo chmod -R 777 web/sites/default/files

# Remove write permissions from core
sudo chmod -R 555 core/

Caching Stack for Production

A production Drupal caching stack typically includes:

• Nginx FastCGI Cache: Caches full HTML pages for anonymous users
• Varnish: HTTP accelerator cache, sits in front of Nginx
• Redis: Backend cache for bins, database query cache
• CDN: Cloudflare, Fastly, or Akamai for edge caching

Common Mistakes

1. Using shared hosting for Drupal production sites: Shared hosting lacks sufficient PHP memory, MySQL resources, and caching capabilities. Drupal will be painfully slow and may crash under moderate traffic.
2. Not configuring trusted host patterns: This is a security vulnerability and the Status Report will warn about it. Always configure trusted_host_patterns in settings.php.
3. Setting file permissions to 777 on all files: This creates a security risk. Only the files directory needs write access. Core, vendor, and configuration files should be read-only.
4. Not using environment variables for database credentials: Hard-coding credentials in settings.php is a security risk, especially when the file is in version control. Use getenv() for all sensitive values.
5. Ignoring PHP OPcache configuration: Without OPcache, Drupal's PHP files are recompiled on every request, dramatically slowing page load times. Configure OPcache with adequate memory and file limits.

Practice Questions

1. What are the minimum PHP extensions required for Drupal, and how would you verify they are installed on a server?
2. Compare shared hosting, VPS, and managed Drupal hosting. Under what circumstances would you choose each one?
3. How do trusted host patterns protect against security attacks, and what happens if they are not configured?
4. Challenge: Create a server provisioning script that installs and configures Nginx, PHP 8.3 with all Drupal-required extensions, MariaDB, and Redis on a fresh Ubuntu 22.04 server. The script should create a Drupal database, configure the virtual host, set up environment variables, and install Drupal via Composer.

FAQ

{{< faq "Can I run Drupal on shared hosting?" "Technically yes, but it is not recommended. Shared hosting typically restricts PHP memory to 128 MB, does not provide server-level caching, and limits {{< ilink "MySQL" >}} connections. Drupal on shared hosting will be slow and unreliable for anything beyond a development sandbox." >}}

Mini Project

Goal: Set up a production-ready Drupal server on a cloud VPS.

1. Create a $20/month VPS on DigitalOcean, Linode, or Vultr with Ubuntu 22.04
2. Install and configure Nginx, PHP 8.3-FPM with required extensions, and MariaDB 8.0
3. Configure PHP with 512 MB memory limit and OPcache
4. Create the Drupal database and user with strong credentials
5. Install Drupal via Composer in /var/www/html
6. Configure an Nginx virtual host with proper rewrite rules
7. Set up settings.php with environment variables and trusted host patterns
8. Configure the files directory with correct ownership and permissions
9. Verify the Status Report has no warnings or errors
10. Document the entire Process as a reusable runbook

What's Next

With a production-ready server configured, learn how to define your content architecture with content types and then use the fields system to add custom fields to those content types.