# SiteWatch hosting options

SiteWatch needs two things for the WordPress connector: an HTTPS URL that the WordPress server can reach, and a SiteWatch host that stays online when checks or connector heartbeats are due. A VPS is one way to meet those requirements; it is not a product requirement.

## Fresh price and architecture comparison — October 26, 2026, 16:04 UTC

Prices below are official U.S. list prices where available; usage assumes 730 hours/month. Taxes, backups, egress, snapshots, support, and any regional differences can change the bill. Availability can change between page checks and checkout.

| Option | Current estimate and availability | Fit for this SiteWatch build |
|---|---|---|
| **OVHcloud VPS 2027 VPS-1** | User-provided configurator screenshot showed **No commitment** and **available now** in US-East Vint Hill: 2 vCores, 4 GiB RAM, 40 GiB NVMe, daily backup, unlimited traffic at 500 Mbps, and **$5.35/month before tax**. The VPS-1 card showed $4.54/month for a 12-month commitment. Month-to-month service auto-renews unless canceled. | **Best low-cost one-month pilot candidate:** materially cheaper than the known-price DigitalOcean plan. 40 GiB leaves less room for images, vulnerability databases, logs and backups; keep it to the pilot workload, measure disk use, and keep independent off-host recovery. Standard region has monitoring and other features absent in Local Zones. See the [OVHcloud setup guide](OVHCLOUD_VPS_SETUP.md). |
| **OVHcloud VPS 2027 VPS-2** | The public plan card shows a starting rate of $8.50/month, but the user-provided screenshot only confirms the VPS-1 in the order summary. VPS-2 availability and final location/term price are unconfirmed. | Select it in the configurator and verify the US-East location and one-month total before considering it. |
| **DigitalOcean Basic Droplet, 4 GiB** | $24/month cap; 2 vCPU, 80 GiB SSD and 4,000 GiB transfer included. Per-second billing has a 60-second minimum. Public IPv4 is included in bundled plans. | **Known-price fallback:** simplest predictable bill with disk and transfer bundled. It is unmanaged, so OS patching, database/recovery, firewall and monitoring remain our responsibility. |
| **Google Compute Engine e2-small** | About $16.68/month: e2-small at $0.016752855/hour (about $12.23) + 20 GiB standard disk (about $0.80) + in-use external IPv4 at $0.005/hour (about $3.65). E2-small exposes 2 vCPUs but has only 0.5 fractional CPU and 2 GiB RAM. Internet egress, snapshots, logging, and tax are extra. | **Lowest-priced Google experiment**, not yet a capacity-qualified production host. For 4 GiB, e2-medium compute alone is about $24.46/month; with the same disk and IPv4 assumptions the estimate is about $28.91 before egress and snapshots. Google is genuinely usage-metered, but the VM and attached disk/IP costs continue according to their own billing rules. |
| **Hetzner U.S. CPX11** | June 2026 price schedule: $20.49/month before IPv4; add about $0.60/month for IPv4. The live product page currently marks the 2 GiB CPX11 unavailable. | Not orderable in the checked catalog, and 2 GiB is a small test size. Do not choose it until checkout confirms availability and full pricing. |
| **Hetzner U.S. CPX21** | 4 GiB, $37.49/month before IPv4 and roughly $0.60/month IPv4; the live catalog currently marks it unavailable. | More expensive than the DigitalOcean 4 GiB pilot in the current U.S. price list, with no availability advantage. |
| **Hetzner EU CX23** | 2 vCPU, 4 GiB, 40 GB NVMe, $6.49/month before IPv4 and VAT; the cost-optimized catalog currently marks it unavailable. A primary IPv4 adds about $0.60/month. | Cheapest advertised 4 GiB option if it returns to stock, but in Europe, shared-cost-optimized CPU, and 40 GB disk. Check region/data residency, customer latency, available stock, and tax before considering it. |
| **Google Cloud Run** | Request-based service compute has a free allowance and usage pricing; a continuously running worker pool has separate charges. | Not a drop-in host: its service containers scale to zero and have disposable local storage. SiteWatch currently relies on a long-running scheduler and persistent local SQLite. It becomes a candidate after database, scheduled-work and recovery state move to supported durable services and costs are measured across all components. |

**Decision:** use OVHcloud VPS-1 for the one-month pilot if 40 GiB disk is acceptable: the supplied U.S. configurator screenshot showed No commitment at $5.35/month before tax and US-East Vint Hill availability. Its $4.54/month card price is for a 12-month commitment and should not be selected for a one-month test. VPS-2 availability and exact checkout price remain unconfirmed. If VPS-1 disk or capacity proves inadequate, DigitalOcean's 4 GiB Basic Droplet is the known-price fallback at $24/month, with 80 GiB disk. OVH says joining its Partner Program is required to resell VPS hosting; SiteWatch does not need that program merely to rent a server. The OVH VPS-1 was shown active with Ubuntu 26.04 in the Manager at 22:29 UTC on October 26, 2026; the current provider state has not been rechecked because the browser session is signed out. First login, hardening, deployment, and public HTTPS remain incomplete.

Sources: [OVHcloud U.S. VPS plans](https://us.ovhcloud.com/vps/), [live U.S. VPS configurator](https://us.ovhcloud.com/vps/configurator/?brick=VPS%2BModel%2B1&planCode=vps-2027-model1&processor=+&storage=40__SSD__NVMe&vcore=2__vCore&pricing=default), [OVHcloud U.S. billing and cancellation terms](https://support.us.ovhcloud.com/hc/en-us/articles/360002306224-Overview-of-Billing-with-OVHcloud-US), [VPS order requirements](https://support.us.ovhcloud.com/hc/en-us/articles/39499067423379-How-to-order-a-VPS), [OVHcloud VPS reseller program](https://www.ovhcloud.com/en-gb/vps/vps-reseller/), [DigitalOcean Droplet prices and billing](https://www.digitalocean.com/pricing/droplets); [Google E2 machine prices](https://cloud.google.com/products/compute/pricing/general-purpose?hl=en), [E2 sizes](https://docs.cloud.google.com/compute/docs/general-purpose-machines), [disk prices](https://cloud.google.com/compute/disks-image-pricing), and [external IPv4 prices](https://cloud.google.com/vpc/pricing); [Hetzner June 2026 price schedule](https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/), [current U.S. plan availability](https://www.hetzner.com/cloud/regular-performance/), [EU cost-optimized availability](https://www.hetzner.com/cloud/cost-optimized/), and [IPv4 prices](https://docs.hetzner.com/cloud/servers/primary-ips/overview/); [Cloud Run pricing](https://cloud.google.com/run/pricing), [scale-to-zero behavior](https://docs.cloud.google.com/run/docs/overview/what-is-cloud-run), and [Hetzner hourly billing](https://docs.hetzner.com/cloud/billing/faq/).

## Provider price and backup recheck — October 26, 2026, 07:53 UTC

The current low-cost U.S. pilot recommendation remains DigitalOcean, but the new official price check changes how Hetzner should be compared. DigitalOcean lists Basic Droplets at **$12/month for 1 vCPU / 2 GiB**, **$18 for 2 vCPU / 2 GiB**, and **$24 for 2 vCPU / 4 GiB**, with disk and transfer included. Its current pricing page says Droplets are billed per second with a 60-second minimum and a monthly cap. The $12 size is a one-site connectivity experiment; use $24 for the first SiteWatch workload test, then measure before adding apps or customers.

Google Compute Engine e2-small remains about **$16.68/month** for 730 hours plus a 20 GiB standard disk and an in-use IPv4 in the default U.S. pricing estimate; outbound transfer, snapshots, tax, and region changes can raise it. Google’s Always Free e2-micro has only 1 GiB RAM and 1 GiB/month of North American egress, so it is not a capacity-qualified production choice.

Hetzner’s current June 2026 U.S. price schedule lists the 2 GiB CPX11 at **$20.49/month before IPv4 and tax**, while its live catalog marks that plan unavailable. Its inexpensive EU CX23 is listed at $6.49/month before IPv4 and VAT, and its live catalog also marks that plan unavailable. Avoid relying on the old sub-$10 estimates until a suitable plan is actually orderable. Hetzner’s automatic server backups cost an additional 20% of the server price and retain up to seven daily copies, replacing the oldest; manual snapshots are retained until an operator deletes them. These are whole-disk recovery points and can retain customer data after a workspace deletion, so hosting-provider backup rotation alone does not satisfy SiteWatch’s deletion policy.

**Recommendation:** keep DigitalOcean as the easiest priced U.S. pilot path and budget $24/month for the first realistic SiteWatch test. Google is the pay-as-you-go alternative if its console/IAM tools are preferred. Check provider capacity and checkout totals before provisioning; these are not SiteWatch performance commitments, and no provider has been created. See the [official DigitalOcean plans](https://www.digitalocean.com/pricing/droplets), [Google VM prices](https://cloud.google.com/products/compute/pricing/general-purpose?hl=en), [Google disk prices](https://cloud.google.com/compute/disks-image-pricing), [Google IPv4 prices](https://cloud.google.com/vpc/pricing), [Google Free Tier limits](https://docs.cloud.google.com/free/docs/free-cloud-features), [Hetzner June 2026 price schedule](https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/), [Hetzner live U.S. plans](https://www.hetzner.com/cloud/regular-performance/), [Hetzner EU cost-optimized availability](https://www.hetzner.com/cloud/cost-optimized/), and [Hetzner backup behavior and cost](https://docs.hetzner.com/cloud/servers/backups-snapshots/overview/).

## Earlier provider comparison — October 26, 2026, 06:51 UTC

This snapshot predates the fresh 16:04 UTC comparison above. Its prices and provider recommendation are historical; use the top section for the current choice. The connectivity and deployment-path notes below remain relevant.

| Path | Cost and reachability | Best use |
|---|---|---|
| Current PC + Tailscale Serve | No extra host cost, but private to your tailnet; Hostinger cannot reach it unless that server joins your tailnet. | Owner-only development and private access. |
| Cloudflare Quick Tunnel | No fixed VPS bill; creates a temporary public HTTPS URL while the PC and tunnel stay on. Publicly reachable and dependent on Cloudflare. | A short plugin-heartbeat test after owner MFA is enabled; never treat the random URL as permanent. |
| DigitalOcean Basic Droplet, 2 GiB | **$12/month maximum**; billed per second with a 60-second minimum. Includes 1 vCPU, 50 GiB SSD, and 2,000 GiB transfer. It keeps billing while powered off; destroy it to stop compute charges. | Lowest-cost checked, easy month-to-month **single-site pilot**. SiteWatch has not been capacity-tested on this size. |
| DigitalOcean Basic Droplet, 4 GiB | **$24/month maximum**; billed per second with a 60-second minimum. Includes 2 vCPUs, 80 GiB SSD, and 4,000 GiB transfer. It keeps billing while powered off. | Better starting size for SiteWatch plus a couple of small applications in separate containers; still requires workload testing. |
| Google Compute Engine e2-micro | Always Free covers one non-preemptible VM's monthly hours in `us-west1`, `us-central1`, or `us-east1`, plus up to 30 GB-months standard disk and 1 GB North America egress. Billing account required; overages and other resources are charged. The 1 GiB VM is a constrained pilot and its suitability for SiteWatch is unproven. | Cheapest always-on experiment; run the real SiteWatch workload and cost checks before relying on it. |
| Google Compute Engine e2-small | Usage-metered. Current estimate is about **$16.68/month** for continuous use with a 20 GiB disk and IPv4, before regional price differences, tax, backups and egress. The monitor must stay on, so hourly billing still approaches a full month. | Google Cloud alternative for a low-volume one-site pilot; it costs more than DigitalOcean's bundled 2 GiB plans under these assumptions. |
| Hetzner Cloud | The live catalog marks CPX02 (1 GiB), CPX12 (2 GiB), CPX22 (4 GiB), and U.S. CPX11/CPX21 unavailable. The page showed CPX22 at €19.99/month in EU and CPX21 at €32.49/month in its U.S. display, before VAT; listed pricing includes IPv4. Billing continues while a server exists, even when powered off. | Recheck stock at provisioning time; no suitable low-cost U.S. plan was orderable during this check. |

For a permanent connector URL, use a hostname you control, such as `monitor.skyza.net`, after adding its DNS record to the selected host's public IP. Before exposing SiteWatch, keep public signup disabled, enable owner MFA, confirm the owner key is strong, verify HTTPS and `/healthz` externally, and test the WordPress heartbeat. Deployments can use `/livez` for process liveness (HTTP 200 while the process is responding) and `/readyz` for database plus scheduler readiness (HTTP 503 if cron progress is stale). Use `/readyz` for a deployment/load-balancer readiness probe and keep an external monitor on the public HTTPS `/healthz` or `/readyz` URL so a dead VPS can be detected from outside itself. The Google estimates are pilot-cost estimates, not SiteWatch capacity guarantees. As rechecked October 26, 2026, Google's e2-small rate is $0.016752855/hour; with a 20 GiB standard disk at $0.0000548/GiB-hour and in-use IPv4 at $0.005/hour, 730 hours totals about $16.68 before tax, snapshots, egress, and backups. Google also lists an Always Free e2-micro allowance, but its 1 GiB memory and limited 1 GiB monthly egress make it an experiment only; Free Tier limits can change and excess usage is billed. Hetzner's live catalog marked CPX02, CPX12, and cost-optimized entry plans unavailable during this check; its billing FAQ confirms hourly billing is capped monthly and continues for powered-off servers until deletion. Sources: [Google VM rates](https://cloud.google.com/products/compute/pricing/general-purpose?hl=en), [Google Free Tier limits](https://docs.cloud.google.com/free/docs/free-cloud-features), [Google disk rates](https://cloud.google.com/compute/disks-image-pricing), [Google external IPv4 rates](https://cloud.google.com/vpc/pricing), [Hetzner live cost-optimized availability](https://www.hetzner.com/cloud/cost-optimized/), [Hetzner live regular-performance availability](https://www.hetzner.com/cloud/regular-performance/), and [Hetzner hourly billing FAQ](https://docs.hetzner.com/cloud/billing/faq/).

**Earlier provider recommendation (06:51 UTC; superseded by the 16:04 UTC comparison above):** DigitalOcean was the lowest-priced checked U.S. path at that time. None of those plans was capacity-qualified, and no provider or public route had been provisioned. Sources: [DigitalOcean Droplet prices and billing](https://www.digitalocean.com/pricing/droplets), [DigitalOcean powered-off billing](https://docs.digitalocean.com/reference/doctl/reference/compute/droplet-action/power-off/), and [current Hetzner plan catalog](https://www.hetzner.com/cloud/regular-performance/).

**Earlier availability recheck (October 26, 2026, 05:03 UTC):** Google still lists the e2-micro Free Tier VM and new-customer trial credits; those credits do not establish a permanent zero-cost production host, and the micro's published memory/egress limits remain too constrained to qualify SiteWatch without a real workload test. Hetzner's pages marked the CPX02, CPX12, and cost-optimized CX23/CAX11 entry plans unavailable. Its regular-performance family is described for small web applications, but the entry sizes were also unavailable at check time. Hourly billing reduces cost only when a VM is deleted partway through a month; an existing powered-off VM continues billing. This was an earlier comparison; use the 06:51 UTC recheck above for the current provider recommendation. [Google Free Tier](https://cloud.google.com/free), [Hetzner regular-performance plans](https://www.hetzner.com/cloud/regular-performance/), [Hetzner cost-optimized plans](https://www.hetzner.com/cloud/cost-optimized/), [Hetzner billing FAQ](https://docs.hetzner.com/cloud/billing/faq/).

## Use the current PC as a temporary host

The Windows PC already runs SiteWatch. Its existing Tailscale Serve address is private to the tailnet, so Hostinger cannot send connector reports to it. A public tunnel can publish the local dashboard through HTTPS without buying a VPS. Tailscale Funnel is the closest fit to the current setup: it provides a public HTTPS endpoint to a local service, but the tailnet owner must enable Funnel and SiteWatch's host PC must remain awake, online, and signed in. Funnel makes the endpoint public; use the current SiteWatch authentication and enroll owner MFA before exposing the dashboard. This depends on Tailscale's public relay and is best treated as a temporary or small-use setup, not independent infrastructure.

The dashboard is currently configured to bind to `127.0.0.1:4310`, which is suitable for a local tunnel origin. Do not change it to listen on every network interface just to make a tunnel work. Before giving WordPress a public URL, verify the tunnel URL from outside the tailnet, verify `/healthz`, verify the owner login and MFA, and send a plugin heartbeat. The Tailscale Serve URL and Funnel URL are different: a Serve URL remains private.

On Windows, after confirming owner MFA is enabled in SiteWatch and you accept that the URL will be public, open PowerShell and run the Tailscale CLI command below. The first command may require Funnel to be enabled in the tailnet policy. It should print the public HTTPS address when successful. Verify from a device with Tailscale turned off before entering that URL in the WordPress plugin:

```powershell
tailscale funnel --bg --https=443 http://127.0.0.1:4310
tailscale funnel status
Invoke-WebRequest https://YOUR-DEVICE.YOUR-TAILNET.ts.net/healthz
```

Use the exact `https://...ts.net` hostname reported by Tailscale in the plugin. To stop publishing this dashboard, use the matching `off` command:

```powershell
tailscale funnel --https=443 http://127.0.0.1:4310 off
```

The current read-only check shows the existing `alpha-group-1.tailad276c.ts.net` dashboard routes as **tailnet only** for ports 443 and 8443. Funnel has not been started; no public route has been added.

### Temporary public test without a VPS or custom domain

Cloudflare Quick Tunnels can provide a random `https://*.trycloudflare.com` URL for a local service without a Cloudflare account or domain. This is useful for confirming that the Skyza plugin can reach SiteWatch before choosing permanent hosting. It is a public endpoint: anyone who learns the random URL can reach the SiteWatch login and API routes, so first confirm the owner key is strong, owner MFA works, and public signup is disabled. The plugin still needs its own Site ID and connector token. Do not put the temporary URL into a production setup: it changes when restarted, has no uptime guarantee, and is intended for testing. Cloudflare also documents a 200 in-flight request limit and no Server-Sent Events support for Quick Tunnels.

After installing `cloudflared` using [Cloudflare's official installation instructions](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/), run this in PowerShell while SiteWatch is listening on `127.0.0.1:4310`:

```powershell
cloudflared tunnel --url http://127.0.0.1:4310
```

Copy the HTTPS URL printed by the command into the WordPress plugin's dashboard URL field. Keep this terminal open, select **Send heartbeat now** in the plugin, and confirm it reports HTTP 202 and a recent connector heartbeat appears in SiteWatch. Stop the tunnel with Ctrl+C as soon as the test is complete. If the command fails because `cloudflared` is not found, install it first and open a new PowerShell window. This validates connector reachability only; it is not an always-on monitoring deployment. See Cloudflare's [Quick Tunnel documentation](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) for current limits and behavior.

## Can SiteWatch use an existing Hostinger web or cloud plan?

Hostinger currently supports Node.js web apps on Business/Unlimited and Cloud plans; ordinary PHP-only shared hosting cannot run SiteWatch's Node server. Its [current Node.js limits](https://www.hostinger.com/support/hostinger-node-js-limits-for-web-and-cloud-plans/) say web/cloud plans do not support inbound WebSockets, Docker, custom listening ports, Redis, or Python services. They also do not support always-running background workers. Each Node website uses a managed long-running process, and plan resources are shared. Hostinger documents a 120-second request limit and plan-specific app/process limits, so the exact account tier matters.

SiteWatch has a cron mode for hosts that stop timers: it disables the five-second interval, exposes a POST-only scheduler route protected by a 32-byte random bearer token, and clamps scheduled HTTP polling to one minute. Hostinger's [Node.js cron guide](https://www.hostinger.com/support/how-to-run-cron-jobs-for-node-js-websites-at-hostinger/) says Node cron commands run in UTC, do not inherit app environment variables unless loaded from the configured environment file, and stop after 30 minutes. Its documented cron command length is limited to 255 characters and cannot contain `%`; keep the command short and use the app's environment-file path.

This is a plausible low-cost pilot path if an existing plan includes Node.js hosting. SiteWatch reads the hosting-provided `PORT` (default 4310 for local use) and rejects values outside the decimal TCP port range 1–65535 with a clear startup error. Before choosing this path, confirm on the exact plan that Node 24 is available, the SQLite `DATA_DIR` can live in private persistent storage outside redeployable release folders, the app can bind to the provider-assigned port, the public HTTPS route accepts the cron trigger, and scheduled jobs can run once per minute without exceeding resource caps. SiteWatch now refuses to start if its data directory is inside Hostinger's replaceable `hbuilds/current` release, instead of creating a database and owner key that may disappear at redeploy. Then test restart/redeploy persistence, a completed scheduled scan, owner login/MFA, backup restore, and a fresh WordPress heartbeat. If any condition fails, use a VPS or another host with persistent storage and a reliable scheduler. These checks have not yet been run on a Hostinger account.

Add these values to the Node app's server environment:

```dotenv
PUBLIC_URL=https://monitor.example.com
SITEWATCH_SCHEDULER_MODE=cron
SITEWATCH_SCHEDULER_TOKEN=<43-character-base64url-secret>
SITEWATCH_CHECK_CONCURRENCY=4
DATA_DIR=<private-persistent-directory-outside-the-deployment-release>
```

`SITEWATCH_CHECK_CONCURRENCY` is optional and accepts 1–64 simultaneous routine website checks; the default is four. Increase it only after running the [scheduler benchmark](CAPACITY_BASELINE.md) on the chosen host with realistic site counts and response times. Scan and API-check workers have separate limits, so this setting alone does not establish total capacity.

Generate a secret with Node.js 20.6 or newer:

```sh
node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"
```

In Hostinger's Node.js **Cron Jobs** page, use its Node.js 24 executable and the environment file for the Node app. Replace the user, domain, and paths with the values shown in that account, then schedule this command once per minute (UTC):

```text
/opt/alt/alt-nodejs24/root/bin/node --env-file=/home/USER/domains/monitor.example.com/hbuilds/config/.env /home/USER/domains/monitor.example.com/hbuilds/current/nodejs/scripts/run-cron-scheduler.mjs
```

The trigger sends the bearer token in an HTTPS Authorization header, not the URL. The dashboard returns only whether the pass was accepted or coalesced with a current pass. Check Hostinger's cron output and confirm completed monitoring scans, durable state after redeployment, and a fresh WordPress heartbeat. Cron mode guarantees a one-minute minimum for scheduled website checks; the normal interval mode retains its configured 5-second scheduler tick. [Hostinger's Node.js app setup](https://www.hostinger.com/support/how-to-deploy-a-nodejs-website-in-hostinger/) describes supported app deployment, but the exact plan, assigned port, `DATA_DIR` persistence, resources and real HTTPS route still need acceptance testing.

## Run SiteWatch on an always-on host you control

A VPS gives a stable public address and runs independently of the home PC and home internet. It adds hosting cost and server maintenance. Use [the Hostinger VPS deployment guide](HOSTINGER_VPS_SETUP.md) if choosing that path. A different cloud VM or a dedicated always-on computer can work too, if it supports the deployment requirements and has a reachable HTTPS endpoint.

### Co-hosting SiteWatch with other apps

One VPS can run SiteWatch and other small applications as separate containers. Give each app its own private data volume, environment secrets, non-root container and measured resource limits. Put one shared HTTPS reverse proxy in front of them and route distinct hostnames (for example, `monitor.example.com` and `app.example.com`) to private container ports. Do not publish multiple apps directly on host ports 80/443. SiteWatch's bundled Caddy imports extra site blocks from `caddy-sites/` and joins two networks: a private backend shared only with SiteWatch, and a stable `sitewatch-proxy` edge network for companion web containers. SiteWatch keeps a separate outbound network for checks/provider calls. Companion apps on the shared edge can still communicate with each other; use separate networks and attach Caddy to each when stronger peer isolation is needed. See [the companion-app instructions](../caddy-sites/README.md). This supports proxy routing but does not include ready-made Compose bundles or resource sizing for other apps.

Co-hosting saves separate-server cost but couples the apps' uptime and resource use. A failure, upgrade, full disk or memory spike on the VPS can affect every app. The 4 GiB DigitalOcean option below is a low-volume, single-SiteWatch pilot size; it has not been measured with other software or production scans. The lower-cost Google e2-small estimate has only 2 GiB and is a pilot candidate, not a proven co-host size. Decide the VPS size after listing the other apps and measuring the combined workload. Keep off-host backups, and monitor SiteWatch from another host so a VPS outage cannot silence its own alerts. Docker is not installed on the current development PC, so the companion proxy configuration still needs a real Docker build and HTTPS acceptance test.

For a one-site pilot, DigitalOcean now lists Basic Droplets at **$12/month for 1 vCPU / 2 GiB** (50 GiB SSD, 2,000 GiB transfer), **$18/month for 2 vCPU / 2 GiB** (60 GiB, 3,000 GiB), and **$24/month for 2 vCPU / 4 GiB** (80 GiB, 4,000 GiB). Bundled plans bill per second with a 60-second minimum and a monthly cap. The $12 plan is the lowest-cost candidate, but its single vCPU and 2 GiB have not been tested with SiteWatch; benchmark and monitor memory before relying on it. The $18 tier is the closer comparison to Google's 2-shared-vCPU / 2-GiB e2-small. The $24 tier is a more reasonable starting point if co-hosting other apps, but is not measured for that workload. Backups add cost. Public deployment also requires the independently installed Grype scanner; the helper blocks high/critical findings, and the candidate Caddy image remains unbuilt and unscanned. Follow the [DigitalOcean deployment guide](DIGITALOCEAN_VPS_SETUP.md) and confirm checkout pricing before ordering; see the official [Droplet price list](https://www.digitalocean.com/pricing/droplets) and [production setup](https://docs.digitalocean.com/products/droplets/getting-started/recommended-droplet-setup/).

For a lower advertised rate, **Hostinger KVM 2** is another self-managed pilot option: 2 vCPU, 8 GB RAM, and 100 GB NVMe. The current page displays $8.79/month on a two-year term paid upfront (about $210.96 before tax), renewing at $14.99/month; KVM 1 is $6.49/month on a two-year term (about $155.76 before tax), renewing at $11.99/month. The hPanel offers guided deployment help, but the VPS owner still manages the operating system and application. Confirm the total, term, renewal rate, taxes and add-ons in your account before ordering. This is a lower effective rate with a larger upfront commitment than DigitalOcean's monthly billing. [Hostinger plans](https://www.hostinger.com/vps-hosting), [managed versus self-managed hosting](https://www.hostinger.com/support/8311982-what-is-managed-hosting-in-hostinger/).

### Pay-as-you-go options (rechecked October 26, 2026)

**Hetzner's posted EU entry prices are attractive, but the live catalog currently marks the checked entry plans unavailable.** Its June 2026 price table lists EU CX23 at **$6.49/month before IPv4 and tax** (2 vCPU / 4 GiB / 40 GB NVMe), or CAX11 at $6.99 (2 Ampere ARM vCPU / 4 GiB / 40 GB). Add $0.60/month for a primary IPv4. The current catalog marks both EU examples unavailable. In the U.S. price schedule, CPX11 is **$20.49/month before IPv4 and tax** (2 vCPU / 2 GiB); the current regional catalog also marks that entry plan unavailable. Hourly billing is capped at the monthly rate; a powered-off Hetzner server continues billing until deleted. Its documentation says cloud servers are customer-managed, including maintenance and security; usage-cost emails are alerts, not a spending cap. Recheck actual console availability before choosing it; no suitable currently orderable plan was visible in this review. [Hetzner's June 2026 price schedule](https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/), [current cost-optimized catalog and availability](https://www.hetzner.com/cloud/cost-optimized/), [U.S. general-purpose catalog](https://www.hetzner.com/cloud/regular-performance/), [billing rules and cost alerts](https://docs.hetzner.com/cloud/billing/faq/), [server-management responsibility](https://docs.hetzner.com/general/security-and-identify/technical-and-organizational-measures/), and [IPv4 rates](https://docs.hetzner.com/general/infrastructure-and-availability/ipv4-pricing/).

**Google Compute Engine remains the hourly-metered alternative if Google Cloud is preferred; it is not the lowest-priced checked U.S. option.** The official price table lists the shared-core e2-small (2 GiB) at $0.016752855/hour, about **$12.23 for 730 running hours**. Adding a 20 GiB standard persistent disk at the published $0.0000548/GiB-hour rate (~$0.80/month) and an in-use standard-VM IPv4 at $0.005/hour (~$3.65/month) gives a rough total of **$16.68/month before tax, backups and outbound traffic**. Google bills VM compute by the second after a one-minute minimum, but a 24/7 monitor accrues nearly a full month of compute; stopping the VM saves compute while taking SiteWatch offline. A stopped VM's disk and external IP may continue to incur charges. This is below DigitalOcean's $18/month 2-vCPU / 2-GiB bundle before variable egress, but above its $12/month 1-vCPU / 2-GiB entry plan. Google's 4 GiB e2-medium is about $24.46/month for compute, or roughly **$28.91 with the same disk and IPv4**, before other charges; DigitalOcean's 4 GiB plan is $24/month with disk and transfer included. Google's advantage is cloud-account flexibility and granular VM billing, not a lower 24/7 bill here. Regional rates, egress, backups, snapshots and taxes can increase totals. The always-free e2-micro has only 1 GiB RAM and a 1 GiB monthly outbound-transfer allowance, so it is not a qualified always-on host. [Google VM rates](https://cloud.google.com/products/compute/pricing/general-purpose?hl=en), [disk rates](https://cloud.google.com/compute/disks-image-pricing), [external IPv4 rates](https://cloud.google.com/vpc/pricing), [billing granularity and uptime](https://cloud.google.com/products/compute/pricing?authuser=2), [stopped VM charges](https://docs.cloud.google.com/compute/docs/instances/stop-start-instance), and [Free Tier limits](https://docs.cloud.google.com/free/docs/free-cloud-features?hl=en).

**Google Cloud Run now documents a long-lived singleton instance, but it is currently a Preview product and needs a SiteWatch storage change.** It provides a directly addressable URL and continuous container process, with individual start/stop/restart controls; Google says an instance can run uninterrupted for up to seven days. The instance has no persistent disk, and stopping or updating it deletes unpersisted files. Cloud Run's general service guidance also expects stateless apps that can run multiple instances, which does not match SiteWatch's current single-process SQLite deployment. This makes Cloud Run a plausible future pay-as-you-go target only after durable state moves to a supported external database and scheduled work is safe under its lifecycle. As a cost anchor, Google's published shared-core Cloud SQL `db-f1-micro` rate is $0.0105/hour (about $7.67 for 730 hours in the displayed default pricing region), before storage, backups, networking or egress; Google says this shared-core tier has no Cloud SQL SLA and regional rates vary. That database cost is separate from Cloud Run's free compute allowance. Cloud SQL, networking, image storage, logging and egress must be included in an estimate; the Cloud Run compute price alone is not a hosting total. For the current build, a small VM remains the simpler pilot. [Cloud Run instance lifecycle and Preview status](https://docs.cloud.google.com/run/docs/overview/what-is-cloud-run), [instance storage behavior](https://docs.cloud.google.com/run/docs/instances/create-and-manage-instances), [Cloud Run service fit criteria](https://docs.cloud.google.com/run/docs/fit-for-run), [Cloud Run billing](https://cloud.google.com/run/pricing), [Cloud SQL pricing and shared-core SLA note](https://cloud.google.com/sql/pricing).

This release uses a long-running Node process, an internal scheduler, and persistent SQLite data, so a small VM remains the straightforward fit. Scale-to-zero/serverless hosting would require moving scheduled work and persistent state to separate managed services and must be costed and tested as a product change; it is not a drop-in cheaper host.

## Which option fits now?

For a **one-month U.S. pilot**, the supplied OVHcloud configurator screenshot shows VPS-1 available in US-East Vint Hill at **$5.35/month before tax** with No commitment selected; it shows the VPS-1's $4.54/month as the 12-month committed rate. The no-commit month auto-renews unless canceled. This makes VPS-1 the least-cost current option, with the limitation of only 40 GiB disk. Choose it only for one-site testing, monitor free disk space, and keep a separate tested backup. VPS-2 needs a fresh stock and one-month checkout check. DigitalOcean's 4 GiB plan is the fallback at a known $24 monthly cap and 80 GiB disk. Do not commit to a year to get the reduced price for a pilot. Hostinger's low monthly equivalent requires upfront term payment and renews higher, so compare the exact term cost after SiteWatch passes the pilot. All options are self-managed; benchmark memory, disk growth, backup restore, connector heartbeat, and scan workload before inviting customers. Public launch still requires DNS/HTTPS, a successful final container scan, and the Skyza heartbeat test. The existing private Tailscale Serve setup cannot receive Skyza's WordPress heartbeat from Hostinger. See the [OVHcloud deployment guide](OVHCLOUD_VPS_SETUP.md), [DigitalOcean deployment guide](DIGITALOCEAN_VPS_SETUP.md), and [Google Compute Engine guide](GOOGLE_COMPUTE_ENGINE_SETUP.md). The OVH VPS-1 has already been purchased and was shown active at 22:29 UTC on October 26, 2026; do not order another provider for the pilot without a current capacity-based reason. The Manager sign-in was not available for a fresh state check, so recheck the server and first-login status before deployment.

## Evidence and remaining setup

The local SiteWatch service has passed its `/healthz` check. No public tunnel has been configured or tested for this dashboard, and Skyza has not sent a connector heartbeat. Do not enter a guessed URL in WordPress. The OVH VPS-1 has been ordered; first SSH login and deployment remain unverified. Public HTTPS is not configured. Complete secure server access, then verify HTTPS and a real heartbeat before treating the connector as connected.

References: [Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel) and [Tailscale Serve](https://tailscale.com/docs/features/tailscale-serve) explain the public versus tailnet-only paths. [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/concepts/routing/) is another public-tunnel option that maps a public hostname to a local service, and introduces a Cloudflare dependency.