How to Host Strapi Headless CMS on Hostinger VPS in 2026

As modern web development transitions toward decoupled headless architectures, developers increasingly prefer separating backend content management from frontend user experiences. By serving content via REST and GraphQL APIs, a single backend can power mobile apps, Next.js web applications, and smart kiosks simultaneously. The leading open-source headless CMS in 2026 is Strapi.

Strapi is a 100% JavaScript/TypeScript open-source headless CMS that gives engineering teams complete control over their content modeling, role-based access permissions, and database architecture. When deployed on a high-speed Hostinger KVM VPS with a dedicated PostgreSQL database, Strapi provides enterprise-grade API performance without paying thousands of dollars for proprietary SaaS headless platforms like Contentful or Sanity. You can launch your VPS instance with an exclusive discount via the Hostinger VPS Partner Portal (Use Code ADODISCOUNT20).

1. Proprietary SaaS CMS vs Self-Hosted Strapi on Hostinger

Comparing commercial enterprise headless platforms against self-hosted Strapi demonstrates substantial architectural and economic benefits:

2. Step-by-Step Strapi Deployment with PostgreSQL

Follow this step-by-step production configuration to deploy Strapi on Ubuntu Linux:

# Step 1: Install PostgreSQL Database Server
sudo apt update && sudo apt upgrade -y
sudo apt install -y postgresql postgresql-contrib

# Step 2: Create Strapi Database and User
sudo -u postgres psql
CREATE DATABASE strapi_prod;
CREATE USER strapiuser WITH ENCRYPTED PASSWORD 'SecureDatabasePassword123!';
GRANT ALL PRIVILEGES ON DATABASE strapi_prod TO strapiuser;
\q

# Step 3: Install Node.js 20 LTS and Create Strapi Project
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs git nginx
npx create-strapi-app@latest /var/www/strapi --quickstart --no-run

3. Process Daemon Management with PM2

Create a production server startup file server.js inside your Strapi directory:

// /var/www/strapi/server.js
const strapi = require('@strapi/strapi');
strapi().start();

Launch Strapi with PM2 to ensure persistent execution:

4. Nginx Reverse Proxy & Free SSL Configuration

Expose your Strapi admin panel and API endpoints over api.yourdomain.com on port 1337:

server {
    listen 80;
    server_name api.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:1337;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
    }
}

Link the site with sudo ln -s /etc/nginx/sites-available/strapi /etc/nginx/sites-enabled/, reload Nginx, and issue your SSL certificate with sudo certbot --nginx -d api.yourdomain.com.

5. Role-Based Access Control (RBAC) & API Token Security in Strapi

Securing an enterprise headless CMS requires granular permission management to ensure public API consumers cannot access draft records or sensitive backend data models:

• Granular Public Role Permissions: In Strapi Admin, navigate to Settings > Users & Permissions Plugin > Roles > Public. Explicitly restrict anonymous access strictly to safe read-only endpoints (e.g. find and findOne for published articles), while keeping create, update, and delete actions completely blocked.
• Scoped API Tokens for Frontend Applications: For frontend Next.js or mobile applications, generate dedicated read-only API tokens under Settings > API Tokens. Strapi issues cryptographic Bearer tokens that can be passed in HTTP Authorization headers without exposing master administrator credentials.
• CORS & Security Middleware Configuration: In config/middlewares.js, configure strict Cross-Origin Resource Sharing (CORS) rules to only allow API requests originating from your verified production frontend domains (e.g. https://yourbrand.com).

6. Offloading Media Assets to AWS S3 or Cloudinary Provider

While Hostinger KVM VPS plans provide fast NVMe storage, offloading user-uploaded media files (high-resolution hero images, PDFs, video assets) to external cloud storage preserves server disk space and speeds up asset delivery:

• Install the official Strapi cloud storage provider plugin: npm install @strapi/provider-upload-aws-s3 or @strapi/provider-upload-cloudinary.
• In config/plugins.js, configure provider credentials, bucket names, and public CDN base URLs.
• When editors upload media in the Strapi Content Manager, assets stream directly to cloud object storage while generating responsive thumbnails automatically.

7. Database Connection Pooling & Performance Tuning

Under high concurrent API query traffic, unoptimized PostgreSQL database connections can exhaust server file descriptors and increase latency:

• Knex.js Connection Pool Tuning: In config/database.js, configure Knex connection pooling with min: 2 and max: 20 connections. This allows Strapi to reuse existing database connections rather than opening and tearing down TCP connections on every REST request.
• PostgreSQL Memory Allocation: Modify /etc/postgresql/15/main/postgresql.conf to allocate 25% of your Hostinger VPS RAM to shared_buffers and set effective_cache_size to 50% of available memory for sub-10ms query execution.

8. Connecting Strapi to Next.js / Flutter via GraphQL & Webhooks

The true power of headless architecture is the seamless omnichannel distribution of content across multiple digital touchpoints:

• Automated Frontend Cache Invalidation: Configure webhooks in Strapi Admin (Settings > Webhooks). Whenever an editor publishes or updates an article, Strapi dispatches a POST request to your Next.js on-demand revalidation endpoint (e.g. /api/revalidate?secret=TOKEN), updating the live website instantaneously.
• Single Backend for Multiple Apps: The exact same Strapi REST and GraphQL endpoints power your public web portal, your native iOS/Android mobile apps, and customer-facing email newsletters without duplicate content entry.

9. Strapi Production Environment Configuration (.env & Database Secrets)

When moving Strapi from local development to production on your Hostinger KVM VPS, configuring cryptographic secrets correctly is essential:

# /var/www/strapi/.env.production
HOST=0.0.0.0
PORT=1337
APP_KEYS=generate_random_key_1,generate_random_key_2
API_TOKEN_SALT=generate_random_salt_value
ADMIN_JWT_SECRET=generate_random_admin_secret
TRANSFER_TOKEN_SALT=generate_random_transfer_salt
DATABASE_CLIENT=postgres
DATABASE_HOST=127.0.0.1
DATABASE_PORT=5432
DATABASE_NAME=strapi_prod
DATABASE_USERNAME=strapiuser
DATABASE_PASSWORD=YourSecureDatabasePassword123!
DATABASE_SSL=false

Generate secure random strings using openssl rand -base64 32 on your server terminal to prevent cryptographic replay vulnerabilities.

10. Building Custom Controllers & Lifecycle Hooks in Strapi

Strapi’s open-source architecture allows developers to extend core API endpoints with custom business logic and automated lifecycle hooks:

• Automated Slug Generation: In your content-type lifecycle files (e.g. src/api/article/content-types/article/lifecycles.js), implement a beforeCreate hook that converts article titles into URL-friendly sanitized slugs automatically before database insertion.
• Webhook Triggering on Publication: Implement an afterUpdate lifecycle hook that dispatches an automated notification to your Next.js frontend or mobile app push notification service whenever an article changes status to published.
• Custom Controller Filtering: Override standard REST find controllers to inject custom business metrics, view counts, or dynamic calculated fields before returning JSON payloads to client applications.

11. Headless Architecture Comparison: Strapi vs Sanity vs Contentful

Evaluating headless CMS options for production applications involves balancing developer flexibility, vendor lock-in, and operational costs:

12. Automated PostgreSQL Daily Backups & Disaster Recovery

Because Strapi stores all content types, author records, and relational data inside PostgreSQL, maintaining disciplined database backup automation is essential. On your Hostinger KVM VPS, configure an automated daily cron job that dumps the database securely to an isolated backup directory:

• Daily Automated Database Dumps: Execute pg_dump -U strapiuser -d strapi_prod | gzip > /backup/strapi_backup.sql.gz via nightly cron job.
• Rotating Local Snapshots: Store at least 14 days of rotating snapshots locally on your Hostinger NVMe storage.
• Cloud Offloading via Rclone: Sync database dumps to secure external cloud object storage (AWS S3 or Backblaze B2) to guarantee complete business continuity in the event of server disaster.

Frequently Asked Questions