Moodle VPS vs. Managed Hosting: Understanding the True Cost

Hiring a VPS for Moodle might seem like an obvious solution for those tired of shared hosting, often costing less than $100 per month. However, the monthly fee is only a small part of the total expense. This comparison reveals what a VPS truly provides, what responsibilities fall on your team, the real annual costs of updates, backups, and security, and when each option makes sense for an online learning institution.

TL;DR

• A Moodle VPS provides the machine, network, and root access. Operating system, PHP, database, cron, Moodle updates, backups, and incident response fall to your team.
• Moodle releases a major version every 6 months and a minor version every 2 months. That's at least 8 update windows per year, all of which are the server administrator's responsibility.
• The weekly backup included in a VPS plan is not a Moodle backup. You need consistent database and moodledata backups, stored off-server, with tested restoration.
• With a VPS, the monthly fee rarely exceeds 20% of the annual cost. The rest consists of technical hours and the risk of your LMS going down during exam week.
• A VPS makes sense when you have a sysadmin with dedicated time and on-call availability. Without that, managed Moodle hosting proves more cost-effective annually.

What You Get When You Hire a VPS for Moodle

A VPS (Virtual Private Server) is a slice of a physical server with dedicated CPU, memory, and disk resources. The provider guarantees that the machine powers on, has network connectivity, and power. Beyond that, everything is your responsibility.

Hostinger's plans page, consulted on 10/18/2026, states this explicitly: the client receives root access and is "responsible for their virtual private server." This isn't a flaw with Hostinger; it's the nature of the model. This applies to Hetzner, Contabo, DigitalOcean, or any other provider.

A Moodle VPS only becomes a functional LMS after someone installs and maintains, at a minimum:

• Updated Operating system, with firewall and hardened SSH access.
• Web server (Nginx or Apache) pointing to the correct directory. As of Moodle 5.1, this directory has changed, as you'll see later.
• PHP-FPM in the version required by the Moodle release, with OPcache and mandatory extensions.
• Database (MariaDB, MySQL, or PostgreSQL) at the minimum supported version.
• Redis for sessions and cache, because disk-based defaults are the first bottleneck during exam days.
• Cron job every minute. The official documentation is direct: without cron, "your site will not function correctly."
• moodledata outside the public folder, with correct permissions.
• SSL, automatic certificate renewal, and transactional email that avoids spam filters.
• Backup, monitoring, and alerts.

None of this is difficult for someone who does it daily. The problem is that almost no online learning institution has someone dedicated to these tasks every day.

Who Manages What: Moodle VPS vs. Managed Hosting

The most honest way to compare the two models is to ask who is responsible for each layer when something goes wrong. We've already published a generic matrix for managed hosting vs. VPS. Here's the Moodle-specific version:

Layer	Unmanaged VPS	Managed Moodle Hosting
Hardware, network, power	Provider	Provider
OS, patches, firewall	Your Team	Vendor
PHP, database, Redis, Nginx	Your Team	Vendor
Cron and scheduled tasks	Your Team	Vendor
Minor Moodle updates (every 2 months)	Your Team	Vendor
Major updates and plugins (every 6 months)	Your Team	Vendor, with your approval
Database and moodledata backup	Your Team	Vendor
Restoration testing	Your team (rarely happens)	Vendor, with contractual periodicity
Monitoring and alerts	Your Team	Vendor
After-hours incidents	Whoever answers the phone	Contractual SLA
Content, courses, enrollments	Your Team	Your Team

Notice the last line. Managed hosting doesn't remove the academic work from the institution: coordination, tutoring, and administration remain your responsibility. It removes the infrastructure work, which is precisely not the institution's core business.

Your VPS's SLA Doesn't Protect Your LMS

VPS providers advertise 99.9% or 99.99% availability. This figure measures whether the virtual machine is powered on. If PHP-FPM exhausts processes when a quiz opens, the VPS is "online," but the student sees a 502 error. For the provider, no incident occurred.

The Moodle Release Calendar Becomes Your VPS Workload

This is the most often overlooked point for those migrating to a Moodle VPS, thinking "it's just a simple install." Moodle has a fixed calendar, published on its official releases page:

• Major versions every 6 months, in April and October.
• Minor versions every 2 months, in February, April, June, August, October, and December. These bring security fixes.
• Out-of-cycle releases for emergency fixes.

Status of each version on 10/18/2026, according to the same page:

Version	Release Date	End of General Support	End of Security Support
4.5 LTS	10/07/2024	10/06/2025	10/04/2027
5.0	04/14/2025	04/20/2026	10/05/2026 (ended)
5.1	10/06/2025	10/05/2026	04/19/2027
5.2	04/20/2026	04/19/2027	10/04/2027
5.3 LTS	10/05/2026	10/04/2027	10/01/2029

Anyone still running 5.0 is currently without any security patches. We detail the exit strategies in our post about the end of Moodle 5.1 support.

Minor Updates: Routine, But Not Automatic

On a Moodle VPS, each minor version update means: downloading the code, preserving config.php and plugins, putting the site into maintenance mode, running the upgrade via command line, clearing caches, and verifying nothing broke. In my operation, this takes one to two hours per environment when everything goes smoothly. That's at least six times a year.

Major Updates: Where the VPS Costs Add Up

A major version is a different story. Here are three real-world examples from 2025-2026 that often come as a surprise to those administering their own VPS:

1. The public folder changed in Moodle 5.1. According to the upgrade documentation, as of 5.1, only the /public folder should be web-accessible, and the server's document root must point to it. Without this adjustment in Nginx or Apache, the upgrade won't proceed. Plugins installed via Git also need to be relocated.
2. PHP minimum version increases. Moodle 5.2 began requiring PHP 8.3. Those who set up their VPS on Ubuntu 22.04 have PHP 8.1 in the standard repositories and will need an external repository or a full operating system upgrade. Ubuntu 24.04 already includes 8.3.
3. PHP itself reaches end-of-life. According to the official PHP table, PHP 8.2 loses security support on 12/31/2026. A VPS stuck on 8.2 will enter 2027 with an unpatched interpreter.

Each major upgrade requires a staging environment, third-party plugin testing, and a maintenance window outside of class hours. For an LMS with a custom theme and half a dozen plugins, I estimate 8 to 16 hours of technical work per major version.

True Backup for a Moodle VPS

Most VPS plans include some form of backup. Hostinger's, for example, is weekly. This seems sufficient until the first difficult question arises: if the server becomes corrupted on a Friday, is the institution willing to lose six days of submissions, grades, and forum messages?

The Moodle backup documentation lists three things to protect: the database, the moodledata folder, and the code (including plugins and customizations). The database and moodledata change constantly and require frequent copies. The database dump must be consistent, using options like --single-transaction, to avoid capturing "half-baked" data.

What a Moodle VPS Backup Needs to Include

• Database and moodledata from the same moment. Restoring a Tuesday database with Sunday files leads to tasks pointing to non-existent files.
• Off-VPS copy. A snapshot on the same provider doesn't protect against account lockout, billing errors, or datacenter incidents.
• Retention. Accidental course deletion is often discovered days later. A single copy, overwritten nightly, won't solve this.
• Tested restoration. A backup that has never been restored is just a hypothesis. It's also the first item to disappear from the routine of someone administering a VPS alone.

When the Provider's Backup is Sufficient

For test environments, pilot courses with few students, or an LMS that can revert a week without significant impact, the provider's snapshot might suffice. However, for an institution with graded exams and certifications, it's not enough.

Security: What Lands in the Inbox of a Moodle VPS Administrator

Moodle is mature software with an active security team. This also means that vulnerabilities are found, published, and patched year-round. For example, on 04/29/2026, CERT-FR, the French government's incident response center, published alert CERTFR-2026-AVI-0508, detailing seven Moodle vulnerabilities, including remote code execution and SQL injection. Patches were released in versions 4.5.11, 5.0.7, and 5.1.4.

For those with managed hosting, this alert is the vendor's responsibility. For those with a Moodle VPS, it poses a question: who in the institution read this alert, and how quickly was the patch applied?

Minimum Security Requirements for a VPS

• Subscribe to Moodle security announcements and apply minor versions without delay.
• Update OS, PHP, and database with the same discipline.
• Block SSH password login, use key-based authentication, and limit attempts (fail2ban or equivalent).
• Place a WAF in front of the LMS and limit requests on login routes.
• Review unmaintained third-party plugins: they are the most common entry point I find in inherited environments.
• Remember US state privacy laws (e.g., CCPA): the LMS often stores personal data, grades, and data of minors. A breach due to an outdated server is a security incident with a duty to report. We address this topic in Moodle and US Privacy Laws.

True Cost of a Moodle VPS Over 12 Months

Let's look at the numbers. First, the monthly fee. Hostinger prices on 10/18/2026, excluding card taxes and based on long-term contracts:

Plan	vCPU / RAM / NVMe	Promotional Price	Renewal Price
KVM 1	1 / 4 GB / 50 GB	$29.99/month	$59.99/month
KVM 2	2 / 8 GB / 100 GB	$43.99/month	$77.99/month
KVM 4	4 / 16 GB / 200 GB	$59.99/month	$149.99/month
KVM 8	8 / 32 GB / 400 GB	$119.99/month	$259.99/month

Two observations. The KVM 4 renewal costs 2.5 times the introductory price; calculate with the renewal price, not the promotional one. Also, VPS pricing isn't stable: Germany-based Hetzner adjusted its portfolio in April 2026 and again in June, with some tiers more than doubling.

For an LMS with a few hundred peak concurrent students, a reasonable Moodle VPS starts in the range of 4 vCPU and 16 GB. This amounts to something between $720 and $1,800 per year for the machine alone. How to size for your actual peak is covered in our guide on concurrent Moodle users and load testing.

The Part That Doesn't Appear on the Bill

Now, let's consider the labor hours. The estimate below is from my operation, not a market average. Adjust for your reality:

Task	Frequency	Hours/year (estimate)
Minor Moodle versions	6 per year	6 to 12
Major version, with staging	1 to 2 per year	8 to 32
OS, PHP, and database patches	monthly	12
Backup restoration testing	quarterly	8
Monitoring, alerts, and minor incidents	continuous	24 to 36
Total		58 to 100 hours

Hypothetical example: if the technical hour you pay costs $75, that amounts to between $4,350 and $7,500 per year. Even in the optimistic scenario, the machine is less than 20% of the total cost. And this calculation doesn't even include the most expensive part: the LMS being down the day before an exam, with administrators responding to students one by one.

When Each Option Makes Sense for Your Institution

Neither model is right for everyone. The criterion I use with clients is simple: who will wake up at 3 AM when the LMS goes down?

A Moodle VPS Makes Sense When

• The institution has an in-house Linux sysadmin, with dedicated time for the LMS and vacation coverage.
• There is real on-call support during critical periods: admissions, exam week, semester start.
• The LMS is internal or low-criticality: optional corporate training, test environment, pilot program.
• IT policy requires full server control, for example, for integrations with internal systems that only run on the institution's network.

A Moodle VPS Does Not Make Sense When

• IT is a one-person team also managing network, printers, and email.
• Moodle generates revenue: paid courses, online graduate programs, time-sensitive certifications.
• No one knows when the last restoration test was performed.
• The VPS was set up by a freelancer who is no longer available, and no one is sure of the root password.

Signs It's Time to Move Beyond Your VPS

Your LMS is two or more minor versions behind. PHP is nearing end-of-life support. The disk filled up without warning. The administration learns the site is down via student WhatsApp messages. If two of these appear together, the decision has already been made by the facts.

Common Pitfalls in Inherited Moodle VPS Setups

Many of the environments we take over come from a VPS that worked well in its first year. The recurring problems include:

1. Cron running every 15 minutes (or not at all). Notifications are delayed, course completion isn't calculated, and emails are sent in batches.
2. moodledata inside the public folder. Student files accessible via direct URL.
3. Backup that only copies the database. Upon restoration, courses appear without any files.
4. Disk-based sessions. During peak times, the LMS logs students out in the middle of a quiz.
5. Disk full due to logs and trash. Moodle stops writing, and no one receives an alert.
6. Abandoned plugins blocking upgrades. The institution gets stuck on an unsupported version because a plugin lacks a compatible version.

If your institution has already decided to move, the technical roadmap is available in how to migrate Moodle from one server to another without losing data.

How Agathas Web Solves This

Agathas Web's managed Moodle hosting exists to take the infrastructure burden off the institution without removing its control over the LMS. In practice, what's included:

• Moodle-optimized stack: PHP 8.3 with OPcache, PHP-FPM with dedicated pool, Nginx, MariaDB 10.11+, Redis for sessions and cache, and isolated cron jobs on their own worker. No cPanel and no sharing CPU with WordPress sites.
• Daily backup with binlog every 15 minutes, encrypted offsite copy, and monthly tested restoration.
• Moodle updates within 90 days of release, always passing through staging for approval, with a maintenance window coordinated with your administration.
• Security: Cloudflare WAF, fail2ban, rate limiting on critical routes, and operating system hardening.
• Monitoring with Grafana, Prometheus, Sentry, and external UptimeRobot, with alerts sent to the technical team's WhatsApp.
• Contractual SLA: 99.9% availability and response within 15 minutes for critical incidents.

How Our Engagement Process Works

1. Diagnosis: We assess your Moodle version, plugins, moodledata size, and peak concurrent users.
2. Proposal: The plan is sized for your actual peak usage, not just the average.
3. Assisted migration: Within 5 business days, including staging environment approval and written sign-off before the go-live.
4. Go-live outside of class hours, with the old environment preserved for 30 days for rollback capability.

Should your institution ever wish to leave, we provide a complete backup. I am Moodle Academy certified and have administered Moodle since 2008, but Agathas Web is independent: we are not a Moodle Partner, and our commitment is in the contract, not a badge. To request a diagnosis, contact our team via the Moodle hosting page.

Conclusion: A Moodle VPS is Cheap; Administering It Is Not

The choice between a Moodle VPS and managed hosting isn't about the machine's price. It's about who takes on 8 update windows per year, the backup that needs to be restored within hours, and the security alert that arrives on a Friday night.

If your institution has a sysadmin and on-call support, a VPS provides control and real savings. If not, the low monthly fee hides an annual cost several times greater and a risk that falls on the administration during the worst week of the semester.

The next practical step: list who, today, executes each line in this post's responsibility table. If several remain blank, it's worth exploring Agathas Web's managed Moodle hosting and requesting an environment diagnosis.