The most useful number you can get is from your own stack: put your actual app on the box and hit it with k6 or wrk using a realistic mix of pages, and watch memory rather than CPU. On 2 GB the failure mode is almost always RAM: too many PHP-FPM/worker processes plus a database on default buffers, then swap thrashing and the OOM killer, long before the single core is the limit. What buys the most headroom on boxes this size: cap the worker count (pm.max_children or the equivalent) to what actually fits in RAM size the DB buffer pool deliberately instead of leaving defaults zram for bursts serve anything static or cacheable straight from nginx so it never touches the app And rate-limit or block the obvious scrapers. As someone said above, bot traffic is often the real load.