How to Use Hetzner: The Beginner's Guide (First Project, First Server, the Firewall Rule, and the Billing Gotchas)

CodexFuse Team · 2026-11-01T14:55:29.744Z · 23 min read

How to Use Hetzner: The Beginner's Guide (First Project, First Server, the Firewall Rule, and the Billing Gotchas)

Learning how to use Hetzner is the moment cheap cloud servers stop feeling like a gamble and start feeling like a tool you actually control: for a few euros a month you get a real virtual server with a public IP, a clean web console, an API, and a command-line tool that all manage the same infrastructure. Hetzner Cloud is a German cloud provider whose prices undercut the big clouds so sharply that beginners pick it for the price, then stay because the console is genuinely pleasant to use. This hetzner cloud tutorial runs the complete beginner arc in one sitting: the account and billing setup, two-factor authentication as step zero, your first project, SSH keys before servers, creating your first cloud server, the firewall rule you set before the first SSH login, volumes, snapshots versus backups, resizing, the hcloud CLI, and the billing gotchas that catch every newcomer.

This guide walks the console path first, because the console is where you learn the concepts; the CLI section at the end automates everything you did by hand. If you are still deciding whether a virtual server is the right buy at all, read the VPS hosting guide first — it explains what a VPS is, who manages what, and when cloud servers beat shared hosting. And one thing to know up front, said once: Hetzner Cloud is unmanaged infrastructure. You get root on a fast server; installing software, patching, and locking things down is your job. That is the whole appeal — and the whole responsibility.

How do you use Hetzner?

You use Hetzner by creating an account, turning on two-factor authentication, adding your SSH key, organizing servers into projects, creating a cloud server from an image, attaching a firewall to it, and then managing everything through the web console, the API, or the hcloud CLI. The whole beginner path is ten steps:

1. Create a Hetzner account (payment method comes later, not at signup).
2. Turn on two-factor authentication immediately — before you create anything billable.
3. Create a project to hold your servers (keep dev and production in separate projects).
4. Add your SSH public key to the project under Security.
5. Create your first server: pick a location, an image, a server type, your SSH key, and a name.
6. Create a cloud firewall and attach it to the server before your first SSH login.
7. SSH in, update the OS, and verify the server is reachable only the way you intend.
8. Add a volume for data that must survive the server itself, or enable automatic backups.
9. Learn the hcloud CLI so you can repeat all of this from a terminal.
10. Read the billing section of this guide so the invoice never surprises you.

What is Hetzner Cloud, exactly?

Hetzner Cloud is a public cloud platform from Hetzner Online, a German hosting company, that rents virtual private servers by the hour with a monthly cap — plus volumes, load balancers, firewalls, floating IPs, and object storage, all managed through one web console, one API, and one CLI. The mental model to carry through this whole guide, said once: the console, the API, and the hcloud CLI are three views of the same projects — anything you click in the console you can also do with a command, and everything lives inside a project. What it is not: it is not shared hosting (there is no cPanel here), and it is not a managed platform (nobody patches your server for you). One clarification, said once: Hetzner Cloud is a different product line from the Hetzner Storage Box — this guide covers Cloud only.

Beginners usually arrive at Hetzner for the price — a usable cloud server for the cost of a coffee — and the price is real, though it moved in 2026: Hetzner repriced Cloud twice, on 1 April and 15 June 2026, and entry prices rose sharply (the CX23 went from €3.99 to €5.49). Every price in this guide was checked against Hetzner's official pricing via third-party reads in October 2026, and the verify line is said once here: Hetzner reprices things, so confirm the numbers on hetzner.com before you commit. One more honest note for 2026: Hetzner's status page has carried a "limited availability of cloud instances" notice since June 2026, and the cheapest plans have intermittently shown as unavailable to order — if your preferred type is greyed out, that is why.

How do you create a Hetzner account and secure it?

You create a Hetzner account at hetzner.com with a valid email address, your contact info, and a billing address — no payment method is required at signup itself; adding one is a recommended next step after registration. Account creation is free, and billing starts only when you create resources. Two practical notes from the official docs: avoid signing up over a VPN or with a throwaway email address, because new accounts can face manual verification, and choose your billing currency (EUR or USD) carefully — it cannot be changed afterward without opening a new account.

Two-factor authentication is step zero, not an afterthought — said once. Your Hetzner account can spin up servers in your name in seconds, which makes it a prime target. Right after signup, open the account security settings and enable 2FA via the documented "Mobile Device" method (a TOTP authenticator app with a QR code) and store the recovery key somewhere that is not the server you are about to create. This takes three minutes and is the single highest-value security step in this entire guide. For billing, Hetzner accepts Visa, Mastercard, Amex, and UnionPay credit cards, SEPA direct debit (EUR accounts), bank transfer, and PayPal for manual payments — no Apple Pay, no crypto — and invoices monthly in arrears, due within ten days.

How do Hetzner projects organize your servers?

Hetzner projects are billing and organization containers: every server, volume, firewall, and network you create lives inside exactly one project, and you switch between projects in the console without logging out. The lesson, said once: keep development and production in separate projects from day one — it costs nothing and it is the cheapest insurance against deleting the wrong server at 2 a.m.

You get up to 20 projects per account. Projects also scope people and access: you can invite existing Hetzner customers and outside members by email under Security → Members, with three roles — Owner (one per project, invoiced for every resource in it, the only role that can move servers between projects), Admin (manages members, API tokens, and DNS zones), and Member (creates and manages resources but not DNS zones). API tokens are per-project too, which is another reason the dev/prod split pays off: a token that can only touch your playground project cannot hurt production.

Why must you add an SSH key before creating a server?

You must add your SSH public key to your Hetzner project before creating a server because Hetzner's default images disable password login — the console injects your chosen key into the new server at creation time, and without a key you cannot log in. The keys-before-servers rule, said once: no key, no login, no exceptions on a fresh server. Two sharp edges to know: SSH keys are not shared between projects, so you repeat this per project, and you cannot add a key to an existing server from the console — it must be selected during creation. (If you create a server with no key selected, Hetzner emails root credentials to your main address instead.)

If you do not have an SSH key pair yet, generate one on your own machine — ed25519 is the recommended type:

ssh-keygen -t ed25519 -C "[email protected]"
cat ~/.ssh/id_ed25519.pub

In the Cloud console, open your project, go to Security, then SSH Keys, and paste the public key content (the .pub file — never the private key). Name it something recognizable like "laptop-ed25519". Do this once per project and server creation takes sixty seconds.

How do you create your first Hetzner server?

You create your first Hetzner server in the console by opening your project, clicking Add Server, and choosing a location, an OS image, a server type, your SSH key, and a server name — then the server boots in under a minute. Walk each choice slowly the first time; the defaults are fine, but you should know what each one means.

Location. Pick the datacenter closest to your users, not to you. Hetzner Cloud runs in six locations across four network zones: Falkenstein, Nuremberg, and Helsinki in the EU; Ashburn, Virginia and Hillsboro, Oregon in the US; and Singapore in Asia-Pacific. EU locations keep your data under EU jurisdiction with a German provider, which matters to some buyers. Prices are identical across the EU locations.

Image. An image is the operating system the server boots with, provisioned via cloud-init. For a first server, pick a current LTS release — Ubuntu 26.04 became a rapid-deploy image in October 2026, with 24.04 and 22.04 also available; Fedora 44 is offered too, and Ubuntu 20.04 was retired for new servers in July 2025. Start with a plain OS image rather than a one-click app: you will learn what the console actually does instead of what an installer hides.

Server type. This is the CPU/RAM/disk/traffic bundle and the main price lever. Hetzner sells shared-vCPU types — CX (Intel/AMD, auto-allocated), CPX (AMD EPYC), and CAX (ARM Ampere Altra) — and dedicated-vCPU types (CCX, where one vCPU equals one physical CPU thread, unshared and predictable). The line to remember, said once: shared vCPU means your virtual cores share a physical core with neighbors and are built for bursty, variable workloads — perfect for blogs, bots, and experiments; dedicated vCPU means the core is yours alone — for databases and anything that cannot tolerate noisy neighbors. Prices below are post–15 June 2026 repricing, EU, excluding VAT and the separate IPv4 fee, third-party-checked October 2026:

Networking. At creation you choose the server's public connectivity: no public IPs, one Primary IP (IPv4 or IPv6), or both. The IPv4 line, said once: a public IPv4 address is a separate billed item at €0.50/month — it is no longer bundled with the server — while a public IPv6 address (a full /64) is free. Most beginners take both. Note that a server with no public IPs also gets no cloud firewall, no floating IPs, and no rescue system, so take at least one public IP on your first server.

SSH key and name. Select the SSH key you added, give the server a name you will recognize on an invoice line (like "web-01" or "playground-01"), and create it. This hetzner create server flow takes under a minute once your SSH key is in place, and the console shows the new machine green and running with its public IPs listed. Do not SSH in yet — the firewall section comes first, and that ordering is deliberate.

What is the Hetzner firewall rule every beginner must set?

The rule is: create a Hetzner cloud firewall that allows inbound SSH (port 22), HTTP (80), and HTTPS (443) — SSH locked to your IP, web open to the world — and attach it to your server BEFORE your first SSH login. Said once, because the order matters: a brand-new server with an open SSH port starts collecting login attempts within minutes of booting, and the cloud firewall filters traffic before it ever reaches your server. The firewall is free and stateful (return traffic for allowed connections is automatically permitted).

Understand its default posture: a firewall with zero rules drops all new inbound traffic, and outbound traffic is allowed unless you add outbound rules — at which point outbound flips to implicit deny. In the console, go to Firewalls in your project, create one (name it "web-default"), and add inbound rules. A sensible first ruleset:

Then attach the firewall to your server under the server's Firewalls tab — or attach it by label selector so every future server with that label is protected automatically. Two limits worth knowing: five firewalls per server, and the firewall does not cover traffic inside your private networks. Locking SSH to your own IP is the single biggest reduction in attack noise you can make in five minutes; if your home IP changes often, allow a small range or route SSH through a VPN instead of opening port 22 to the world.

How do you SSH into your server for the first time?

With the firewall attached, SSH in with the user the image defines — root for most Hetzner images — using the key you injected at creation: ssh root@YOUR_SERVER_IP. The first connection asks you to verify the host fingerprint; the console shows the server's fingerprint on its overview page, so compare before typing yes. Then update the OS immediately — apt update && apt upgrade -y on Debian/Ubuntu — because images ship weeks behind on patches.

Two habits from here on: never use root for daily work (create a normal user with sudo once you are in), and never enable password authentication (the injected key is both more convenient and more secure). If you ever lock yourself out with a bad firewall rule, the console's web-based VNC console bypasses the network entirely and lets you fix it — which is also why you should test firewall changes while your current SSH session is still open.

How do Hetzner volumes work?

A Hetzner volume is extra NVMe block storage you attach to a server for data that must outlive the server itself — databases, uploads, anything you would cry about losing if the server vanished tomorrow. Volumes run from 10 GB to 10 TB in 1 GB steps, attach to one server at a time (up to 16 per server), and can be grown while in use with no downtime. They bill per GB per month (about €0.0572/GB in October 2026 reads), and — the part beginners miss — a detached volume keeps billing until you delete it.

Create the volume in your project (Volumes → Create Volume) in the same location as your server — a volume can only attach to a server in its own datacenter — then choose how it is prepared. The attach-and-format lesson, said once: with the AUTOMATIC option Hetzner formats the volume (EXT4 or XFS) and mounts it for you at /mnt/HC_Volume_<id>; with MANUAL, the console shows you the commands and you run them yourself:

mkfs.ext4 /dev/disk/by-id/scsi-0HC_Volume_12345678
mkdir -p /mnt/data
mount /dev/disk/by-id/scsi-0HC_Volume_12345678 /mnt/data
echo "/dev/disk/by-id/scsi-0HC_Volume_12345678 /mnt/data ext4 defaults 0 0" >> /etc/fstab

Two honest limits: server snapshots and backups do not include attached volumes, so a volume is not a backup by itself — copy its data elsewhere too. And because you can detach a volume from a dead server and attach it to a new one in minutes, volumes are the cleanest way to separate "the machine" from "the data".

Snapshots vs backups: what is the difference on Hetzner?

On Hetzner, a snapshot is a manual, on-demand full copy of a server's disk that you keep as long as you want and pay for by size; a backup is an automatic daily copy, kept as the last seven copies, that you enable per server and pay for as a flat percentage of the server price. The price-difference lesson, said once: snapshots bill per GB per month on the compressed size for as long as they exist, while backups bill a flat +20% of the server's price — so a snapshot you forget about costs you every month until you delete it.

The beginner playbook: enable automatic backups on any server you care about (one toggle in the console), and take a manual snapshot right before upgrades or migrations — then delete the snapshot once the change has proven itself. Because hetzner snapshots bill on compressed size rather than the full disk, a snapshot of a mostly-empty 40 GB disk costs far less than 40 GB. Both restore by rebuilding a server from the copy, within the same CPU architecture. And both can be protected with the deletion-protection flag, which is worth turning on for anything production.

How do you resize a Hetzner server?

You resize a Hetzner server from its console page with the Rescale option: CPU and RAM move up and down freely, but the disk can only ever grow — rescaling to a smaller disk is impossible no matter how empty it is. The scale-up path is the whole story for beginners: start on the smallest type that fits, and grow the server when monitoring — not anxiety — says so. If you bought cheap because a comparison told you to, the cheap VPS hosting comparison is the sibling guide that explains what those prices actually buy.

Four resize facts that matter. First, you can keep your current disk size while scaling CPU/RAM up, which preserves your ability to scale back down later — grow the disk only when you mean it. Second, after a disk-growing rescale, the partition does not grow by itself; you expand it via the rescue system. Third, rescaling stays within one CPU architecture (x86 to x86, ARM to ARM). Fourth — the legacy-price trap, said once: rescaling moves an old server onto current pricing even if you scale down, and moving a server to a project with a different currency does the same; rebuilding a server does not. You also cannot change a server's location — snapshot or back it up and recreate it where you want it.

What is the hcloud CLI and why learn it?

The hcloud CLI is Hetzner's official command-line tool that does everything the console does — create servers, manage firewalls, volumes, snapshots, and networks — from your terminal, which makes your setup repeatable and scriptable. If the console taught you the concepts, the CLI is where you stop clicking. Install it from your package manager (brew install hcloud on macOS, or your distro's package), then generate an API token in the console under Security → API Tokens with Read & Write scope — the token is shown exactly once, so save it — and create a context:

hcloud context create my-project
# paste the API token when prompted
hcloud server list
hcloud server create --name web-01 --type cx23 --image ubuntu-24.04 --ssh-key laptop-ed25519 --location nbg1
hcloud firewall add-rule web-default --direction in --protocol tcp --port 22 --source-ips 203.0.113.0/24

The automation lane opens here: put those commands in a script and your second server takes seconds, your tenth takes the same seconds, and your disaster recovery is a script instead of a memory. Guard the API token like a password — anyone holding it can create billable resources in your project. And because tokens are per-project, the dev/prod project split from earlier in this guide is what keeps an automation accident in the playground where it belongs.

What are the Hetzner billing gotchas?

Hetzner bills cloud resources hourly with a monthly cap per resource, invoiced monthly in arrears — and the gotchas are all the things that are not the server price: the IPv4 fee, traffic overage, forgotten snapshots and volumes, and the delete timing. Read this section once and the invoice will never surprise you; consider it hetzner pricing explained in plain language. (Every figure below is from October 2026 pricing reads; hetzner.com is the source of truth if anything has moved.)

Hourly billing with a monthly cap — and hours round up. Each resource bills per hour, but never more than its monthly price, so a server you run for a week costs roughly a quarter of the monthly figure. But usage hours round up: five minutes of a server counts as a full hour. Short experiments are still cheap; just do not expect per-minute math.

Powered-off servers bill in full. Hetzner allocates the resources whether the server is running or not, so a stopped server costs the same as a running one until you delete it. The cheap way to park a server is a snapshot plus deletion — not the power button.

The IPv4 fee. A public IPv4 Primary IP is a separate €0.50/month line item on new servers, and it bills even while unassigned — to stop paying, you must delete the IP itself. IPv6 is free. Most beginners just pay the fifty cents and move on, but now you know why the invoice has two lines.

Traffic overage. Only outgoing traffic is billed; incoming and same-zone internal traffic are free. Each server type includes a monthly allowance — 20 TB per server in the EU, 1–5 TB in the US, 0.5–5 TB in Singapore — and overage runs €1.00/TB in the EU and US but €7.40/TB in Singapore, billed in 100 MB blocks. Hetzner emails you at 75% and 100% of your allowance, but those emails do not cap or stop anything — a misconfigured open proxy or a viral file can burn terabytes while you sleep, so watch the traffic graph in the console. For most blogs and apps the included allowance is effectively unlimited; for media serving, do the math first.

Forgotten resources keep billing. Snapshots, detached volumes, floating IPs, and load balancers all bill until deleted — deleting the server does not delete its snapshots or its detached volumes. The delete line, said once: deletion stops the hourly meter for that resource immediately, but everything you created alongside it and forgot keeps its own meter running. Once a month, open the project and delete what you no longer need.

If you are wondering who patches and monitors all of this for you, the answer is nobody — which is exactly what the managed vs unmanaged VPS guide unpacks, so you choose unmanaged with your eyes open. A server you can afford is only cheap if you can also afford to run it.

Where do you go from your first server?

From a secured first server, the natural next steps are: point a domain at it and terminate HTTPS with a reverse proxy, deploy the app you actually wanted a server for, and set up off-server backups of the data that matters. If that app is n8n, the VPS for n8n guide sizes the server for automation workloads specifically. The pattern from here is always the same: console to learn, CLI to repeat, snapshots before changes, backups for everything you care about — and hetzner for beginners stops feeling like a gamble the moment the second server takes you sixty seconds.

Frequently Asked Questions

Is Hetzner good for beginners?

Yes. The console is one of the cleanest in the industry, the docs are thorough, and the smallest server types cost a few euros a month, which makes mistakes cheap. The tradeoff is that it is fully unmanaged: you are the sysadmin, so pair this guide with basic Linux habits — updates, SSH keys, a firewall — and you will be fine.

Do I need a payment method to sign up for Hetzner?

No. Registration needs only an email address, contact info, and a billing address; adding a payment method is a recommended next step, not a signup requirement. You will need one before creating billable resources, and new accounts can face manual verification, so do not leave signup to the minute you need a server.

How much does the cheapest Hetzner server cost?

The CX23 with 2 vCPU and 4 GB RAM lists at 5.49 euros per month in the EU, excluding VAT, based on October 2026 pricing reads. Budget the separate 0.50 euro monthly IPv4 fee on top if you need a public IPv4 address, which most beginners do, and confirm current prices on hetzner.com before committing.

Can I host a website on Hetzner Cloud?

Yes, and it is the most common beginner use case. Create a server, attach the firewall from this guide, point your domain's DNS at the server IP, and install a web server or reverse proxy. HTTPS certificates are free through Let's Encrypt, and the whole stack runs comfortably on the smallest server types.

What happens if I forget to delete a snapshot or volume?

It keeps billing you every month until you delete it. Snapshots bill per gigabyte on their compressed size and volumes bill per gigabyte, each independent of any server. Check your project monthly and delete what you no longer need. The console lists every billable resource in one place, so the audit takes two minutes.

Sources

• Hetzner Cloud locations — docs.hetzner.com/cloud/general/locations/ — 6 locations, 4 network zones (fsn1, nbg1, hel1, ash, hil, sin), EU price parity, fetched 2026-11-01
• Hetzner Cloud servers FAQ — docs.hetzner.com/cloud/servers/faq/ — shared vs dedicated plans, SSH key behavior, no root password with key, rescale rules, disk never shrinks, same-architecture rescale, fetched 2026-11-01
• Hetzner Cloud billing FAQ — docs.hetzner.com/cloud/billing/faq/ — hourly billing with monthly cap, hours rounded up, powered-off servers billed in full, snapshot/backup billing, legacy-price triggers, IPv4 deletion rule, fetched 2026-11-01
• Hetzner Cloud firewalls FAQ — docs.hetzner.com/cloud/firewalls/faq/ — free stateful firewall, zero-rule inbound deny, outbound implicit-deny behavior, label selectors, 5 per server / 50 per account, 80k connections, fetched 2026-11-01
• Hetzner Cloud volumes FAQ + overview — docs.hetzner.com/cloud/volumes/faq/ — 10 GB to 10 TB, automatic vs manual attach, /mnt/HC_Volume_<id> mount point, live resize up, no volume snapshots, fetched 2026-11-01
• Hetzner account getting started — docs.hetzner.com/general/billing-and-account-management/account-getting-started/ — signup requirements, no payment at signup, VPN/free-email warning, 2FA as recommended step, last change 2026-09-14
• Hetzner payment overview — docs.hetzner.com/general/billing-and-account-management/billing-at-hetzner/payment-overview/ — Visa/Mastercard/Amex/UnionPay, SEPA, bank transfer, PayPal manual-only, no Apple Pay or crypto, invoices due in 10 days, currency fixed at signup, fetched 2026-11-01
• Hetzner Cloud general FAQ — docs.hetzner.com/cloud/general/faq/ — projects (20 per account), Owner/Admin/Member roles, external member invites, fetched 2026-11-01
• hcloud CLI tutorial — community.hetzner.com/tutorials/howto-hcloud-cli/ — install, API token generation, context create, server/volume/firewall commands, crawled 2026-11-01
• Hetzner Cloud changelog — docs.hetzner.cloud/changelog — October 2026: Ubuntu 26.04 + Fedora 44 rapid-deploy images, DNS in console GA, volume API assignee property, private-network cloud-init auto-config
• Hetzner hcnet technical details — docs.hetzner.com/cloud/technical-details/hcnet/ — eBPF network stack opt-in, firewall connection-tracking changes, fetched 2026-11-01
• Hetzner pricing analysis — ployz.dev/blog/hetzner-pricing — October 2026 post-repricing plan prices (CX23 5.49, CAX11 5.99, CPX12 15.49, CPX22 19.49, CCX13 42.99 EUR), IPv4 0.50/mo, snapshots 0.0143/GB, volumes 0.0572/GB, traffic overage 1.00/TB EU-US and 7.40/TB Singapore
• Hetzner Cloud 2026 review — dev.to/rozoomnews/hetzner-cloud-review-2026 — four years of bills explained, June 15 2026 repricing impact, capacity notice since June 2026
• Hetzner vs DigitalOcean 2026 — webhostingguide.net/vps/hetzner-vs-digitalocean/ — updated 2026-10-20, CX/CAX availability gaps, pricing comparison
• SSH key community tutorial — community.hetzner.com/tutorials/add-ssh-key-to-your-hetzner-cloud/ — Security → SSH Keys path, keys not shared between projects, crawled 2026-11-01