In shortA VPS comes to you open, and its security is your responsibility from the first minute, because attack software starts trying to log in shortly after it goes online. Start by updating the system, then create a non-root user, use SSH keys instead of a password, enable a firewall that opens only the ports you need, add a tool that blocks guessing, and keep backups off the server.
Before you start #
You will need to connect to the server over SSH. Read connecting to the server via SSH. The commands here are for AlmaLinux and Rocky Linux, with the Ubuntu equivalents.
The essential steps #
- Update the system: The first command after logging in, then repeat it regularly.
- Create a non-root user: A regular user with sudo rights for daily work.
- Use SSH keys: Create a key on your computer and copy it to the server. A key is far stronger than any password.
- Disable password login and direct root login: In the SSH configuration, after confirming key login works.
- Enable a firewall: Open only the ports you need, such as SSH, 80 and 443. On cPanel servers use CSF. Read important CSF commands.
- Block guessing: A tool such as Fail2Ban, or CSF with LFD, blocks addresses that repeat failed logins.
- Enable automatic security updates: So system flaws do not stay open.
- Back up off the server: If the server fails or is hacked, a backup on the same server may be lost with it.
# Update (AlmaLinux / Rocky) dnf update -y # Ubuntu: apt update && apt upgrade -y # Non-root user adduser admin1 && usermod -aG wheel admin1 # Ubuntu: usermod -aG sudo admin1 # On your computer: create a key and copy it ssh-keygen -t ed25519 ssh-copy-id admin1@SERVER_IP # In /etc/ssh/sshd_config after testing key login: PermitRootLogin no PasswordAuthentication no # then: systemctl restart sshd
Before disabling password login: open a second SSH window and confirm key login works. If you get locked out, use the console from the client area.
After the essentials #
- Install only the software you need, and remove what you do not use.
- Watch the logs and firewall alerts.
- If the server hosts WordPress sites, also apply the steps to protect a site from hacking.
We can secure your server for you #
- If you would rather not manage the server yourself, we handle updates, the firewall and monitoring with our server management service.
- We use CSF, Imunify360 and CloudLinux on our servers, and they can be applied to yours.
Frequently asked questions #
Should I change the SSH port from 22?
It reduces automated attempts in the logs, but it does not replace SSH keys and disabling password login.
Is VPS security my responsibility?
Yes, on an unmanaged server you are responsible for the system and its security. You can also ask us to manage it.
I locked myself out of the server. What now?
Use the console from the client area to log in and fix the SSH or firewall settings, or open a ticket.
