Set Up HestiaCP for Multi‑Domain Hosting with Free Auto‑SSL

Running several websites on a single server is a practical way to keep hosting costs low while still delivering a professional online presence. Hestia Control Panel (HestiaCP) makes multi‑domain hosting simple, and its built‑in Let’s Encrypt integration lets you secure each site with a free SSL certificate automatically. This guide walks you through the complete setup: from installing HestiaCP to adding domains and enabling automated HTTPS for each of them.

1. Preparing Your Server for HestiaCP

Before adding domains, make sure HestiaCP is installed and the core services (web server, DNS, mail, etc.) are running. The installation steps differ slightly between Debian/Ubuntu (APT) and AlmaLinux/Rocky/RHEL (DNF). Choose the block that matches your OS.

Debian / Ubuntu (APT)

# Update package lists
sudo apt update

# Install required dependencies
sudo apt install -y wget curl gnupg

# Download and run the official installer
wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
bash hst-install.sh --force

The installer adds the Hestia repository, installs the control panel, and configures the web stack. During the prompts, accept the default services (nginx, apache, php, mysql, bind, exim, dovecot) unless you have a specific reason to change them.

AlmaLinux / Rocky / RHEL (DNF)

# Ensure the system is up‑to‑date
sudo dnf update -y

# Install required utilities
sudo dnf install -y wget curl gnupg2

# Download and run the installer
wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
bash hst-install.sh --force

Follow the same prompts as above. On Windows Server, HestiaCP is not supported; a different stack such as IIS would be required.

2. Adding New Domains in HestiaCP

Once the panel is up, log in at https://YOUR_SERVER_IP:8083 using the admin credentials created during installation. The steps below are performed through the web UI, so no OS‑specific commands are needed.

1. Navigate to Web → Add Web Domain.
2. Enter the domain name (e.g., example.com) and select the appropriate user account.
3. Leave “Template” set to default unless you have a custom Nginx/Apache template.
4. Check the “SSL” and “Let’s Encrypt” boxes.
5. Click Save. Hestia will create the document root (/home/USERNAME/web/example.com/public_html) and, if DNS is enabled, the zone files.

Repeat for each additional domain. Hestia stores each site under its own user directory, keeping files isolated and simplifying permission management.

3. Enabling Automated Let’s Encrypt SSL for Every Domain

HestiaCP can request and renew Let’s Encrypt certificates automatically. Verify a few settings to avoid common pitfalls.

Configure Global Let’s Encrypt Settings

• Go to Server → Settings → Let’s Encrypt.
• Set “Certificate type” to RSA 2048 (the default works for most browsers).
• Enable “Auto‑renew” and leave the default renewal interval (30 days).
• Optionally enable “Staging mode” for testing; remember to disable it before going live.

Domain‑Specific SSL Options

When you added a domain, you already ticked the “SSL” and “Let’s Encrypt” boxes. Hestia will now:

1. Create a temporary HTTP‑01 challenge file in /home/USERNAME/web/example.com/public_html/.well-known/acme-challenge/.
2. Ask Let’s Encrypt to validate the domain via HTTP.
3. Store the issued certificate and private key in /home/USERNAME/conf/web/example.com/.
4. Configure Nginx (or Apache) to serve the site over HTTPS, redirecting HTTP to HTTPS if you enabled that option.

To re‑issue a certificate (e.g., after changing DNS), run the command below with your values.

Manual Renewal Commands (Both OS Families)

# Replace USERNAME and example.com with your values
sudo -u USERNAME /usr/local/hestia/bin/v-rebuild-web-domain USERNAME example.com

This forces Hestia to rebuild the web configuration, which includes re‑requesting the Let’s Encrypt certificate if it is near expiry.

4. Managing DNS Records for Multi‑Domain Environments

Hestia can act as an authoritative DNS server via BIND. If you use Hestia’s DNS, each new domain automatically receives A, MX, and TXT records. Verify that the records point to your server’s public IP.

Adding Custom DNS Entries

1. Open DNS → Edit DNS Zone for the domain.
2. Add or modify records:
   • A – points the root domain (example.com) to your server’s IPv4 address.
   • AAAA – optional IPv6 record.
   • CNAME – for subdomains like www or blog.
   • MX – mail exchange records if you host mail.
3. Save changes. BIND reloads automatically.

If you prefer an external DNS provider (e.g., Cloudflare), copy the generated records from Hestia’s zone view and paste them into your provider’s dashboard. Let’s Encrypt validation still works as long as the A/AAAA records resolve to your server.

5. Fine‑Tuning Security and Performance for Multiple Sites

Running several domains on one server can increase the attack surface. Hestia offers built‑in tools to mitigate risks without adding complexity.

Web Application Firewall (ModSecurity)

• Navigate to Server → Settings → ModSecurity.
• Enable the firewall and select the “OWASP Core Rule Set” preset.
• Apply the changes; Hestia will reload Nginx/Apache with the new rules.

Fail2Ban Protection

Fail2Ban monitors log files for suspicious activity and blocks offending IPs.

# For Debian/Ubuntu
sudo apt install -y fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# For AlmaLinux/Rocky/RHEL
sudo dnf install -y fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Hestia automatically creates jails for SSH and the web panel. Add custom jails for WordPress, Joomla, etc., by editing /etc/fail2ban/jail.local.

Resource Limits per User

To prevent one site from exhausting CPU or RAM, set limits under User → Edit User → Resource Limits. Typical defaults are sufficient for low‑traffic sites, but you can lower the “Max processes” or “Memory limit” for shared‑hosting scenarios.

6. Automating Routine Tasks with Cron

Hestia already creates a few cron jobs for backups and certificate renewal, but you may want additional automation.

Example: Daily Database Dump for All Users

# Create a script file (e.g., /usr/local/sbin/hestia-db-backup.sh)
#!/bin/bash
TIMESTAMP=$(date +%F)
BACKUP_DIR=/home/backup/db
mkdir -p "$BACKUP_DIR"

# Loop through each MySQL database created by Hestia
for DB in $(mysql -e "SHOW DATABASES;" -s --skip-column-names | grep -v -E "information_schema|performance_schema|mysql|sys"); do
    mysqldump "$DB" > "$BACKUP_DIR/${DB}_$TIMESTAMP.sql"
done

# Optional: compress
gzip "$BACKUP_DIR"/*.sql

# Make it executable
sudo chmod +x /usr/local/sbin/hestia-db-backup.sh

# Add to root's crontab (run at 02:00 daily)
0 2 * * * /usr/local/sbin/hestia-db-backup.sh

Adjust paths and retention policies as needed.

Conclusion

HestiaCP provides a clean, web‑based interface for managing multiple domains on a single VPS or dedicated server. By following the steps above—installing the panel, adding domains, enabling Let’s Encrypt, configuring DNS, tightening security, and automating backups—you can deliver reliable, HTTPS‑secured hosting for any number of sites without separate servers or complex manual configurations. The built‑in automation keeps certificates up to date, while the modular design lets you scale resources or add new services as your client base grows.