How to choose a VPS: 7 criteria to check before you pay

Buying a VPS is a lot like buying a used car: the listings all look alike, but the real difference is under the hood. There are dozens of sellers, prices ranging from a few tens of thousands to several hundred thousand Toman (the everyday unit of Iran's currency; 1 Toman = 10 rials), and words like NVMe and KVM in everyone's ads, though not always truthfully. This guide on how to choose a VPS walks through 7 criteria that let you tell a solid service from an oversold one before you pay, plus the commands that check the seller's claims after delivery.

How to choose a VPS, step zero: is a VPS even right for you?

Before comparing sellers, make sure you have picked the right product in the first place. There are three options on the table: shared hosting, a virtual private server (VPS) and a dedicated server. Here are the differences at a glance:

If all you have is a simple blog, shared hosting is enough. But as soon as you need root access, a service of your own running permanently or a custom configuration, a VPS is the sweet spot between cost and freedom.

Two questions settle it: do you need something the hosting panel doesn't offer, such as a specific PHP or Node version, an always-on service, an unusual port or Docker? And have you outgrown the resource limits of shared hosting? We list the precise signs of that tipping point in our comparison of shared hosting and a VPS.

Criteria 1 and 2: size RAM and CPU to your real load, and accept only NVMe disks

RAM and CPU

The biggest mistake when buying a VPS is choosing by gut feeling. A few reference figures that work as a starting point:

• 1 GB RAM / 1 core: a Telegram bot, a lightweight API, a static site on Nginx;
• 2 GB RAM / 2 cores: WordPress with moderate traffic, a Node or Python app;
• 4 GB RAM and up: a WooCommerce store, a serious MySQL/PostgreSQL database, several Docker containers side by side.

The key point: start small. Upgrading RAM and cores on cloud services takes a few clicks, but the money you pay for months of unused resources never comes back. Once you are up and running, check real usage with htop and free -m and decide based on data.

free -m

               total        used        free      shared  buff/cache   available
Mem:            1966         742         180          31        1043        1071
Swap:            511          16         495

The column to read is available, not free: Linux lends unused RAM to the disk cache and takes it back at any moment. But an available figure that keeps hovering near zero, together with growing swap use, means you have run short, and once RAM runs out, the kernel kills the heaviest process, which is usually your database.

Disk: forget SATA

In 2026 there is no justification for a non-NVMe disk on a VPS. The random-read speed of NVMe is several times that of an ordinary SSD, and that is exactly what your database and WordPress need every second. If a seller doesn't state the disk type clearly, that alone is a big question mark. Don't underestimate disk size either: the operating system and logs gradually fill the space, and a full disk is one of the most common reasons a database suddenly stops working; 25 to 40 GB is a sensible start for most projects.

What a web server actually feels is not megabytes per second; it is the number of small random operations per second (IOPS) and how stable the latency is, and that is precisely where NVMe pulls ahead of SATA.

Bandwidth and traffic

Instead of the advertising phrase "unlimited traffic", look for numbers: how many terabytes a month? What is the port speed? How is overage charged? "Unlimited" almost always means a limit that isn't written into the contract, one you discover on your site's busiest day. For a medium-sized site, a few hundred gigabytes a month is enough; a download or streaming service needs more serious arithmetic.

Ask three more precise questions: is incoming traffic counted too, or only outgoing? Is traffic inside Iran billed separately from international traffic? When you hit the cap, is the port throttled, or does the extra cost land on your bill? We cover how to measure your real usage in our VPS bandwidth guide.

Criterion 3: virtualization type — buy KVM, not a container

There are two main families: full virtualization such as KVM, and container-based virtualization such as OpenVZ or LXC. With KVM, your server has its own independent kernel, which means you can install Docker, load kernel modules, set up WireGuard and boot any Linux distribution you like. In the container model, every customer rides on the host's kernel: it costs less, but it comes with technical limits, and it is also easier for the seller to oversell.

There is another practical difference: with KVM, the RAM you bought really is yours, while in the container model "guaranteed RAM" and "burstable RAM" are two different numbers, and at busy hours you only get the first one. If you plan to run Docker, Kubernetes or anything beyond a simple website, make KVM the first condition when you buy a VPS. Once the server is delivered, you can verify the seller's claim with one command:

systemd-detect-virt
# output kvm means full virtualization
# output openvz or lxc means a container

According to the command's official manual page, the --vm switch only accepts hardware virtualization and --container only shared-kernel technologies; so if systemd-detect-virt --vm returns a non-zero exit code, what you bought is not KVM. Get a second confirmation as well:

lscpu | grep -iE 'hypervisor|virtualization'

Hypervisor vendor:   KVM
Virtualization type: full

The line Virtualization type: full is what you are looking for. A third test is even simpler: update the kernel and reboot the server; if uname -r doesn't show the new version, you are not the owner of your kernel.

Criterion 4: datacenter location — measure ping from your users, not from yourself

The golden rule is simple: the server should be close to your users. If the audience of your site or app is inside Iran, a VPS in Iran delivers a ping of 5 to 30 ms; the same service from a European datacenter is usually above 100 ms, and worse at the busy hours of Iran's international internet link. For an online store or an app where every tenth of a second of delay affects conversion, that difference is real and measurable. Conversely, if your users are outside the country or your service needs a foreign IP address, a server abroad makes more sense. One more practical point: if your project depends on foreign APIs, call that same API from a test server before you make the final decision, to be sure it is reachable.

Before deciding, measure ping from several places: your home connection, mobile internet and, if possible, another city. Most sellers publish a "test IP"; if they don't, ask for one:

ping -c 10 203.0.113.10

--- 203.0.113.10 ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 9013ms
rtt min/avg/max/mdev = 12.204/13.881/18.402/1.703 ms

Read three numbers, not one: avg tells you the average quality, but mdev, the jitter, is what users actually feel, and any packet loss above zero on a route inside Iran is reason enough on its own to walk away from that seller. If you see a bad number, use mtr -rwc 20 203.0.113.10 to find out at which hop the loss happens.

If your choice leads you outside Iran, our guide to buying a VPS outside Iran covers choosing a datacenter and how to pay.

Criteria 5 and 6: billing model and backups — the things you only find out on the day something breaks

Hourly or monthly?

Hourly billing is your best tool for testing a seller: instead of paying for a full month and hoping the promises hold, you create a server for a few thousand Toman, actually measure the disk and network speed, and delete it if you are not satisfied, with no penalty and no refund request. If the server passes the test, you simply keep it and carry on working; there is no second migration. At Mehran Host this same model is available, with a prepaid wallet in Iranian currency and a datacenter inside Iran; we cover the hourly model in full in What is an hourly cloud server?

A financial point that holds for every cloud service: a powered-off server usually still costs money, because its RAM, disk and IP address remain reserved for you. What stops the charge is deleting the server, not powering it off.

Backups and snapshots

Ask whether automatic backups are part of the service or an add-on. Can you take a manual snapshot before big changes? How often do backups run? A server without backups simply hasn't lost its data yet. Even if the seller keeps backups, keep a separate copy of your own.

That is the 3-2-1 rule: three copies, on two different types of media, with one of them off-site. And a backup that has never been restored is not a backup; once a month, pull one file out of the latest copy. The script and its schedule are in our Linux server backup guide.

Quality of support

Before you buy, send a real technical ticket, for example "Can I install my own operating system from an ISO?", and see how many hours the reply takes and how good it is. An irrelevant, copy-pasted answer during the sales stage, when the seller has the strongest incentive to look good, tells you what the day of an outage will look like. Count the contact channels too: ticket, phone, messenger. The more ways to reach them and the faster the replies, the calmer the night of an incident will be.

Check two features as well: a web console, which is the only way in on the day a firewall rule goes wrong, and OS reinstall.

Criterion 7: overselling red flags — a strange price always has a reason

Overselling means a seller sells one physical server to so many customers that the hardware would fall short if they all used their resources at the same time.

Let's be clear: there is nothing wrong with looking for a cheap VPS. The problem starts when the price is below even what the hardware costs. Signs of a seller who oversells:

• A price that defies the market: RAM and NVMe have global prices; a service priced at a third of the market rate has been made cheap at the expense of your quality;
• Vague wording: "up to 4 GB RAM" or "shared cores" instead of a guaranteed number;
• No SLA: a seller who won't commit to an uptime percentage in writing has a reason for not doing so;
• A site with no identity: no eNamad trust seal (Iran's official registration badge for online businesses), no address, no track record and no direct way to get in touch;
• Hidden terms: the terms of service and refund policy are either missing or so vague that any interpretation is possible;
• High steal time: once the server is delivered, measure the virtualization overhead yourself.

vmstat 2 5

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 357892  97460 379068    0    1    22    17  412  598  4  1 95  0  0
 0  0      0 357940  97460 379073    0    0     0     0  387  521  3  1 96  0  0

The st column is steal time, and its definition in the official vmstat manual is a single phrase: "time stolen from a virtual machine". In other words, your virtual CPU was ready to run, but the host didn't give it a turn. Near zero is normal; a sustained figure above 10 means a host that has been sold beyond its capacity. Repeat this test during the busy evening hours, because that is when overselling shows itself.

What to test in the first hour after delivery

The hourly model is only worth something if you actually use it. These three tests check the claims made on the product page:

1) Disk: random IOPS, not copy speed

Measuring a disk by copying a large file is misleading, because the operating system's cache makes the number look good. The right tool is fio (install it with apt install fio or dnf install fio):

fio --name=randread --filename=/root/fiotest --size=1G \
    --ioengine=libaio --direct=1 --rw=randread --bs=4k \
    --iodepth=32 --runtime=30 --time_based --group_reporting

read: IOPS=41.2k, BW=161MiB/s (169MB/s)(4832MiB/30001msec)
  clat (usec): min=61, max=4102, avg=773.18, stdev=140.55

rm -f /root/fiotest

The --direct=1 switch bypasses the cache and makes the number real. IOPS depends on how busy the host is at that moment, so there is no magic number; the right approach is comparison. Run the same command on two sellers and look at the latency stdev as well: a large spread means a noisy neighbor.

2) Network: the real port speed

Measure the "1 Gbps port" claim with iperf3, not by downloading from a website that may itself be the bottleneck:

iperf3 -c 203.0.113.10 -p 5201 -t 20

[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-20.00  sec  2.20 GBytes   943 Mbits/sec   14   sender
[  5]   0.00-20.05  sec  2.19 GBytes   940 Mbits/sec        receiver

The Retr column counts TCP retransmissions; a large number means an error-prone path, even when the speed looks good.

3) Stability and billing

Bring up your own project and leave it running for a few hours, then run uptime and vmstat again: a server that is great in the first minute and slow three hours later never shows up in any comparison table. Read the itemized bill for those same 24 hours too, so that the side costs (IP addresses, traffic, backups) become actual numbers.

Symptoms after purchase and the root cause of each

Most regrets about a VPS purchase start a few weeks later, with one of these symptoms:

What to do first after buying a VPS

A new server is not a secure server: automated scanners come knocking on port 22 within minutes of a new IP address going live. The recommended order:

1. Connect over SSH for the first time and change the root password immediately; the full walkthrough is in our guide to connecting to a server over SSH;
2. Create a non-root user with sudo rights and move your public key to it;
3. Disable password logins and direct root login in sshd_config, after testing that key-based login works;
4. Fully update all packages and set up a firewall with a "deny everything except what is needed" policy;
5. Set up automatic backups and test a restore once, then install your project's main service.

Every step, with its commands and config files, is in our 10 essential steps for Linux server security. If you are new to this, practice these steps on a disposable hourly server: breaking a server like that and building it again is the cheapest training course there is.

Buying a VPS from Mehran Host: what we have and what we don't

Our cloud service is exactly what we recommended above: KVM on NVMe disks, in a datacenter inside Iran, with hourly billing deducted from a prepaid wallet in Iranian currency. In the "Buy a server" section of the panel you choose the location, the operating system and the amount of RAM, CPU and disk, and the hourly rate updates live as you choose; the server is usually delivered in under a minute, and its IP address and root password are on the "My servers" page, which is also where the web console and OS reinstall (which wipes the entire disk) are available.

A few things we will say plainly, because it is better to know them before you buy: a powered-off server still costs money, because its resources stay reserved, and only deleting it stops the charges; if your wallet balance runs out, the server is suspended, and it comes back once you top up again; a backup service can be enabled on any server, but it costs extra; and creating a server requires verifying a mobile number.

Two more things come with it: DNS management at no extra charge, with A, AAAA, CNAME, MX, TXT, NS, SRV and CAA records and a minimum TTL of 60 seconds; and, next to every A record, a CDN switch that serves static content from edge nodes in Iran and Europe (the first 1 TB of CDN traffic is free, and after that each gigabyte costs 1,000 Toman). Our international servers are hosted in Hetzner datacenters and are paid for in Iranian currency; for needs beyond the server builder's limits, "Enterprise solutions" has a separate path.

Buying a VPS is only scary when you have to pay a month in advance for a decision you haven't tested yet. The hourly model removes that risk: create an account, top up your wallet and, before committing to anything, run the three tests above on your first server.

Frequently asked questions

What VPS specs do I need?

A sensible starting point for a bot, a lightweight API or a static site is 1 GB of RAM and one core; for WordPress with moderate traffic or a Node or Python app, 2 GB and two cores; and for a WooCommerce store or several Docker containers, 4 GB of RAM or more. Take at least 25 to 40 GB of NVMe disk so that logs don't run out of space. Start small and upgrade based on your real usage.

What is the difference between KVM and OpenVZ when choosing a VPS?

With KVM, each server has its own independent kernel, so you can install Docker, load kernel modules and boot any Linux distribution, and the RAM you bought is really reserved for you. With OpenVZ and LXC, every customer rides on the host's kernel; it is cheaper but technically limited, and "guaranteed RAM" is not the same as "burstable RAM". For anything beyond a simple website, KVM is the right choice.

How can I tell if a seller has oversold the server?

Measure the virtualization overhead: in the output of the vmstat command, the st column is steal time, the percentage of time your virtual CPU was ready but the host didn't give it a turn. Near zero is normal, and a figure that stays above 10 is a sign of an oversold host. Repeat the test during the busy evening hours, and measure the variation in disk latency with the fio tool as well.

Is a VPS in Iran or abroad the better choice?

The deciding factor is where your users are, not where you are. If your audience is inside Iran, a domestic server gives a ping several times lower, stays more stable when international connectivity is disrupted, and domestic traffic is usually billed more cheaply. If your users are outside the country or you need an international IP address, a server abroad makes more sense. For an audience in both places, put the origin near most of your users and serve static content from edge nodes.

Is an hourly or a monthly VPS more cost-effective?

The hourly model wins when you need a server for testing, a short-term project or a temporary load: you pay for a few hours, measure the disk, network and stability, and delete it without penalty. For a server that stays on for months, the difference comes down to pricing and flexibility. Keep one thing in mind: a powered-off server usually still costs money, because its resources stay reserved, and only deleting the server stops the charges.