Setting up Hestia Control Panel on AWS EC2 requires configuring your Security Groups, setting static elastic IPs, configuring reverse DNS, and running post-installation security hardening. While Hestia CP is a lightweight, open-source alternative to cPanel, deploying it on AWS infrastructure demands extra care to prevent blocked emails, locked admin panels, and unauthorized access.
In my AWS Hestia CP server management work, I frequently fix EC2 instances that were deployed using default single-click scripts without adequate swap space or properly open port configurations. Below is my full step-by-step technical guide for a clean, secure deployment.
1. AWS EC2 Instance Sizing & Prerequisites
Before running the installation script, you must choose the right EC2 instance specs. Hestia CP is efficient, but running PHP-FPM worker pools, NGINX, MariaDB, and email services simultaneously requires adequate memory reserves.
- Minimum Specs: t3.small (2 vCPU, 2 GB RAM). Do not use t3.micro (1 GB RAM) for production unless you configure swap memory, as MariaDB will crash during peak traffic spikes.
- OS Selection: Choose Ubuntu 22.04 LTS (64-bit x86). While Debian 12 is supported, Ubuntu 22.04 has broader community support for AWS EC2 kernel modules and third-party PHP packages.
- Storage: EBS GP3 volume with at least 20 GB to 40 GB storage. GP3 provides baseline 3,000 IOPS regardless of volume size, ensuring reliable database read/write speeds.
Allocate an Elastic IP
AWS EC2 instances change public IP addresses upon restart by default. To run a stable web host and control panel:
- Navigate to EC2 Console > Network & Security > Elastic IPs.
- Allocate a new Elastic IP address.
- Associate it immediately with your running Ubuntu instance.
2. AWS Security Group (Firewall) Configuration
Unlike traditional web hosting providers, AWS blocks all incoming traffic by default through Security Groups. If you skip this step, you will lose SSH connectivity or fail to access your Hestia CP admin dashboard.
In your EC2 Instance's attached Security Group, create the following Inbound Rules:
- SSH (Port 22): TCP - Restrict to your specific IP address (
/32) for security. - HTTP (Port 80): TCP - Source
0.0.0.0/0(for web traffic & Let's Encrypt validation). - HTTPS (Port 443): TCP - Source
0.0.0.0/0. - Hestia Admin Panel (Port 8083): TCP - Source
0.0.0.0/0(or restrict to your office IP). - SMTP / Mail Ports (Optional): Ports 25, 465, 587 (TCP) if self-hosting email servers. Note: AWS blocks outgoing port 25 by default on new accounts; you must submit an AWS port 25 unblock request or use an external SMTP relay like Amazon SES.
Frequently asked questions
How do I access the Hestia Control Panel after installation?
You can access Hestia CP by navigating to https://your-server-ip:8083 or https://your-hostname.com:8083 in your web browser. Ensure port 8083 is explicitly allowed in your AWS EC2 Security Group inbound rules, or your connection will time out.
Why does AWS EC2 fail to send emails from Hestia CP?
AWS restricts outbound traffic on port 25 by default to prevent spam originating from EC2 instances. To fix this, submit a request to AWS support to lift the port 25 restriction, or configure Hestia CP to route outbound emails through an SMTP relay service like Amazon SES.
Can I run Hestia CP on an AWS EC2 t3.micro instance?
While technically possible, running Hestia CP on a 1 GB RAM t3.micro instance often causes MariaDB or PHP-FPM processes to crash due to out-of-memory errors. If forced to use a micro instance, set up at least a 2 GB swap file during server provisioning.
If you would rather leave AWS provisioning, DNS management, and Hestia CP hardening to an expert, reach out through my AWS and Hestia CP server management service.