---
title: "VPS Server Security: The Essential Steps After You Get Your Server"
description: "**In short**A VPS comes to you open, and its security is your responsibility from the first minute, because attack software starts trying to log in shortly after it goes online. Start by updating the system, then create a non-root user,…"
url: "https://www.hyyat.com/en/knowledgebase/vps-server-security/"
updated: "2026-10-22"
category: Website Security
---

# VPS Server Security: The Essential Steps After You Get Your Server

**In short**A VPS comes to you open, and its security is your responsibility from the first minute, because attack software starts trying to log in shortly after it goes online. Start by updating the system, then create a non-root user, use SSH keys instead of a password, enable a firewall that opens only the ports you need, add a tool that blocks guessing, and keep backups off the server.

![VPS server security: a server, a command terminal, a key and a shield](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-vps-security.webp)

## Before you start

You will need to connect to the server over SSH. Read [connecting to the server via SSH](https://www.hyyat.com/en/knowledgebase/how-to-connect-to-a-server-via-ssh/). The commands here are for AlmaLinux and Rocky Linux, with the Ubuntu equivalents.

## The essential steps

1. **Update the system:** The first command after logging in, then repeat it regularly.
2. **Create a non-root user:** A regular user with sudo rights for daily work.
3. **Use SSH keys:** Create a key on your computer and copy it to the server. A key is far stronger than any password.
4. **Disable password login and direct root login:** In the SSH configuration, after confirming key login works.
5. **Enable a firewall:** Open only the ports you need, such as SSH, 80 and 443. On cPanel servers use CSF. Read [important CSF commands](https://www.hyyat.com/en/knowledgebase/important-csf-firewall-commands-via-ssh/).
6. **Block guessing:** A tool such as Fail2Ban, or CSF with LFD, blocks addresses that repeat failed logins.
7. **Enable automatic security updates:** So system flaws do not stay open.
8. **Back up off the server:** If the server fails or is hacked, a backup on the same server may be lost with it.

```
# Update (AlmaLinux / Rocky)
dnf update -y
# Ubuntu: apt update && apt upgrade -y

# Non-root user
adduser admin1 && usermod -aG wheel admin1
# Ubuntu: usermod -aG sudo admin1

# On your computer: create a key and copy it
ssh-keygen -t ed25519
ssh-copy-id admin1@SERVER_IP

# In /etc/ssh/sshd_config after testing key login:
PermitRootLogin no
PasswordAuthentication no
# then: systemctl restart sshd
```

 **Before disabling password login:** open a second SSH window and confirm key login works. If you get locked out, use the console from the client area.

## After the essentials

- Install only the software you need, and remove what you do not use.
- Watch the logs and firewall alerts.
- If the server hosts WordPress sites, also apply [the steps to protect a site from hacking](https://www.hyyat.com/en/knowledgebase/protect-website-from-hacking/).

## We can secure your server for you

- If you would rather not manage the server yourself, we handle updates, the firewall and monitoring with our [server management service](https://www.hyyat.com/en/server-management/).
- We use **CSF**, **Imunify360** and **CloudLinux** on our servers, and they can be applied to yours.

Learn [what a VPS is and how it differs from shared hosting](https://www.hyyat.com/en/knowledgebase/what-is-vps/).

## Frequently asked questions

   Should I change the SSH port from 22?

It reduces automated attempts in the logs, but it does not replace SSH keys and disabling password login.

   Is VPS security my responsibility?

Yes, on an unmanaged server you are responsible for the system and its security. You can also ask us to manage it.

   I locked myself out of the server. What now?

Use the console from the client area to log in and fix the SSH or firewall settings, or open a ticket.

   **Related guides**

- [How to Connect to a Server via SSH from Windows, Mac and Linux](https://www.hyyat.com/en/knowledgebase/how-to-connect-to-a-server-via-ssh/)
- [Important CSF firewall commands via SSH](https://www.hyyat.com/en/knowledgebase/important-csf-firewall-commands-via-ssh/)
- [What Are DDoS Attacks? Types, Warning Signs and How to Protect Your Website](https://www.hyyat.com/en/knowledgebase/ddos-attacks-protection/)
- [How to Create a Strong Password and Store It Safely: A Password Manager Guide](https://www.hyyat.com/en/knowledgebase/strong-password-password-manager/)

[All website security guides →](https://www.hyyat.com/en/kb/website-protection/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Server Management](https://www.hyyat.com/en/server-management/)[dedicated server](https://www.hyyat.com/en/dedicated-server/)