{"id":18975,"date":"2026-10-22T17:00:12","date_gmt":"2026-10-22T14:00:12","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/vps-server-security\/"},"modified":"2026-10-22T17:00:16","modified_gmt":"2026-10-22T14:00:16","password":"","slug":"vps-server-security","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/vps-server-security\/","title":{"rendered":"VPS Server Security: The Essential Steps After You Get Your Server"},"content":{"rendered":"<div class=\"hkb\" dir=\"ltr\">\n<div class=\"hkb-tldr\"><b>In short<\/b>A VPS comes to you open, and its security is your responsibility from the first minute, because attack software starts trying to log in shortly after it goes online. Start by updating the system, then create a non-root user, use SSH keys instead of a password, enable a firewall that opens only the ports you need, add a tool that blocks guessing, and keep backups off the server.<\/div>\n<figure class=\"hkb-fig\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/hkb-vps-security.webp\" alt=\"VPS server security: a server, a command terminal, a key and a shield\" width=\"1200\" height=\"630\" loading=\"lazy\" \/><\/figure>\n<h2>Before you start<\/h2>\n<p>You will need to connect to the server over SSH. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/how-to-connect-to-a-server-via-ssh\/\">connecting to the server via SSH<\/a>. The commands here are for AlmaLinux and Rocky Linux, with the Ubuntu equivalents.<\/p>\n<h2>The essential steps<\/h2>\n<ol class=\"hkb-steps\">\n<li><b>Update the system:<\/b> The first command after logging in, then repeat it regularly.<\/li>\n<li><b>Create a non-root user:<\/b> A regular user with sudo rights for daily work.<\/li>\n<li><b>Use SSH keys:<\/b> Create a key on your computer and copy it to the server. A key is far stronger than any password.<\/li>\n<li><b>Disable password login and direct root login:<\/b> In the SSH configuration, after confirming key login works.<\/li>\n<li><b>Enable a firewall:<\/b> Open only the ports you need, such as SSH, 80 and 443. On cPanel servers use CSF. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/important-csf-firewall-commands-via-ssh\/\">important CSF commands<\/a>.<\/li>\n<li><b>Block guessing:<\/b> A tool such as Fail2Ban, or CSF with LFD, blocks addresses that repeat failed logins.<\/li>\n<li><b>Enable automatic security updates:<\/b> So system flaws do not stay open.<\/li>\n<li><b>Back up off the server:<\/b> If the server fails or is hacked, a backup on the same server may be lost with it.<\/li>\n<\/ol>\n<pre class=\"hkb-code\"># Update (AlmaLinux \/ Rocky)\ndnf update -y\n# Ubuntu: apt update &amp;&amp; apt upgrade -y\n\n# Non-root user\nadduser admin1 &amp;&amp; usermod -aG wheel admin1\n# Ubuntu: usermod -aG sudo admin1\n\n# On your computer: create a key and copy it\nssh-keygen -t ed25519\nssh-copy-id admin1@SERVER_IP\n\n# In \/etc\/ssh\/sshd_config after testing key login:\nPermitRootLogin no\nPasswordAuthentication no\n# then: systemctl restart sshd<\/pre>\n<div class=\"hkb-note w\"><b>Before disabling password login:<\/b> open a second SSH window and confirm key login works. If you get locked out, use the console from the client area.<\/div>\n<h2>After the essentials<\/h2>\n<ul class=\"hkb-list\">\n<li>Install only the software you need, and remove what you do not use.<\/li>\n<li>Watch the logs and firewall alerts.<\/li>\n<li>If the server hosts WordPress sites, also apply <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/protect-website-from-hacking\/\">the steps to protect a site from hacking<\/a>.<\/li>\n<\/ul>\n<div class=\"hkb-hh\">\n<h2>We can secure your server for you<\/h2>\n<ul>\n<li>If you would rather not manage the server yourself, we handle updates, the firewall and monitoring with our <a href=\"https:\/\/www.hyyat.com\/en\/server-management\/\">server management service<\/a>.<\/li>\n<li>We use <strong>CSF<\/strong>, <strong>Imunify360<\/strong> and <strong>CloudLinux<\/strong> on our servers, and they can be applied to yours.<\/li>\n<\/ul>\n<p style=\"margin:10px 0 0\">Learn <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/what-is-vps\/\">what a VPS is and how it differs from shared hosting<\/a>.<\/p>\n<\/div>\n<h2>Frequently asked questions<\/h2>\n<div class=\"hkb-faq\">\n<details>\n<summary>Should I change the SSH port from 22?<\/summary>\n<p>It reduces automated attempts in the logs, but it does not replace SSH keys and disabling password login.<\/p>\n<\/details>\n<details>\n<summary>Is VPS security my responsibility?<\/summary>\n<p>Yes, on an unmanaged server you are responsible for the system and its security. You can also ask us to manage it.<\/p>\n<\/details>\n<details>\n<summary>I locked myself out of the server. What now?<\/summary>\n<p>Use the console from the client area to log in and fix the SSH or firewall settings, or open a ticket.<\/p>\n<\/details>\n<\/div>\n<div class=\"hkb-rel\"><b>Related guides<\/b><\/p>\n<ul>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/how-to-connect-to-a-server-via-ssh\/\">How to Connect to a Server via SSH from Windows, Mac and Linux<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/important-csf-firewall-commands-via-ssh\/\">Important CSF firewall commands via SSH<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/ddos-attacks-protection\/\">What Are DDoS Attacks? Types, Warning Signs and How to Protect Your Website<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/strong-password-password-manager\/\">How to Create a Strong Password and Store It Safely: A Password Manager Guide<\/a><\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/\">All website security guides \u2192<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>In shortA VPS comes to you open, and its security is your responsibility from the first minute, because attack software starts trying to log in shortly after it goes online. Start by updating the system, then create a non-root user, use SSH keys instead of a password, enable a firewall that opens only the ports [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"doc_category":[2744],"doc_tag":[],"class_list":["post-18975","docs","type-docs","status-publish","hentry","doc_category-website-protection"],"year_month":"2026-10","word_count":552,"total_views":0,"reactions":{"happy":0,"normal":0,"sad":0},"author_info":{"name":"ahmed fathy","author_nicename":"ahmed-fathy","author_url":"https:\/\/www.hyyat.com\/en\/author\/ahmed-fathy\/"},"doc_category_info":[{"term_name":"Website Security","term_url":"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/"}],"doc_tag_info":[],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18975","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/comments?post=18975"}],"version-history":[{"count":0,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18975\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/media?parent=18975"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_category?post=18975"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_tag?post=18975"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}