Securing your VPS is the very first priority after setting up a new server. An unsecured VPS is like a house with the front door open: it is only a matter of time before someone comes in. In this extensive checklist we go through all the essential steps to thoroughly tackle securing your VPS after installation. From SSH hardening to firewall configuration, from automatic updates to intrusion detection, everything is covered.

Why you should secure your VPS right after installation?

The risks of an unsecured VPS

• Brute-force attacks - thousands of login attempts per day on SSH
• Malware installation - your server is abused for cryptocurrency mining or spam
• Data theft - sensitive data is stolen and possibly published
• Launching DDoS attacks - your server becomes part of a botnet
• Ransomware - your files are encrypted and a ransom is demanded

Step 1: Securing SSH - the most important step in securing your VPS

Setting up SSH key authentication

Replace password authentication with SSH keys. SSH keys are cryptographic key pairs that are virtually impossible to crack via brute-force. Generate an SSH key pair on your local computer and copy the public key to your VPS. Test the connection with the key before you disable password authentication.

Disabling password authentication

After you have verified that SSH key login works, you disable password authentication in the SSH configuration. Change the following settings in /etc/ssh/sshd_config:

• PasswordAuthentication no - disables password login
• PubkeyAuthentication yes - activates key-based authentication
• PermitRootLogin no - prevents direct root login
• MaxAuthTries 3 - limits the number of login attempts

Changing the SSH port

The default SSH port 22 is the first target of automated scans. By changing the SSH port to a random high number (e.g. 2222 or 49152) you drastically reduce the number of brute-force attempts. This is not a security measure in itself (security through obscurity), but it does considerably reduce the noise in your logs.

Step 2: Configuring a firewall

Setting up UFW (Uncomplicated Firewall)

UFW is the most user-friendly firewall for Ubuntu/Debian servers. It offers a simple interface on top of iptables. By default you block all incoming connections and only allow specific ports that you need.

Essential firewall rules

Port	Service	Action	Explanation
22 (or custom)	SSH	Allow	Only from trusted IPs if possible
80	HTTP	Allow	Web traffic (redirect to HTTPS)
443	HTTPS	Allow	Encrypted web traffic
All others	-	Deny	Block everything by default

Only add ports that you actually need. Every open port is a potential attack surface. Use SSL certificates for encrypted connections on port 443.

Step 3: Installing Fail2ban

How Fail2ban works

Fail2ban reads the log files of services such as SSH, Apache and Nginx. When it detects a pattern that indicates an attack (for example 5 failed SSH logins within 10 minutes), it automatically adds a firewall rule that blocks the attacking IP address for a set period.

Recommended Fail2ban configuration

• SSH jail - block after 3 failed attempts for 1 hour
• Apache/Nginx jail - block on repeated 404 requests or suspicious URL patterns
• Recidive jail - block repeat offenders for longer periods (up to 1 week)
• Email notifications - receive a message on every block

Step 4: Automatic security updates

Setting up unattended-upgrades

On Ubuntu/Debian you use the unattended-upgrades package. This automatically installs security updates without manual intervention. Configure it so that only security updates are installed automatically, not all updates, to safeguard stability.

Configuring automatic reboot

Some updates require a restart of the server. You can configure automatic reboots to take place at a quiet moment, for example at 04:00 at night. Do make sure your applications start automatically after a reboot.

Step 5: User management and permissions

Creating a sudo user

Create a separate user with sudo rights for daily server management. This user can temporarily obtain root rights via the sudo command, but works with limited rights by default. This limits the damage if the account is compromised.

Securing the root account

• Disable direct root login via SSH
• Set a very strong password for the root account
• Consider disabling the root account entirely if you do not need it
• Log all sudo actions for audit purposes

Step 6: File permissions and integrity

Important file permissions

File/Folder	Permission	Owner	Reason
/etc/ssh/sshd_config	600	root	Protect SSH configuration
/etc/shadow	600	root	Protect password hashes
Home directories	700	user	Privacy per user
Web root	755	www-data	Web server can read but not write
Configuration files	644	root	Readable but not writable

File integrity monitoring

Install a tool such as AIDE (Advanced Intrusion Detection Environment) that creates a database of all system files and warns you when files are modified unexpectedly. This is a powerful way to detect intrusions early.

Step 7: Network hardening

Adjusting kernel parameters

• SYN flood protection - activate SYN cookies against SYN flood attacks
• IP spoofing protection - enable reverse path filtering
• Disabling ICMP redirects - prevent route manipulation
• Disabling source routing - block source-routed packets
• Disabling IPv6 - if you do not use it, disable it

Disabling unnecessary services

Every running service is a potential attack surface. Inventory which services are active and disable everything you do not need. Common services that often run unnecessarily are Avahi (mDNS), CUPS (printing), NFS and RPC-related services.

Step 8: Monitoring and logging

Configuring logging

• Centralize logs with rsyslog or journald
• Configure log rotation to manage disk space
• Consider external log storage so that logs are preserved in the event of a hack
• Monitor auth.log for suspicious login attempts

Monitoring tools

Install monitoring software to watch the health and security of your server. Popular options are Netdata (free, real-time monitoring), Zabbix (extensive, for multiple servers) and Prometheus with Grafana (for advanced metrics and dashboards). Also take a look at our guide on website monitoring for more information.

Step 9: Backup strategy

Backup best practices for VPS

• Make automatic backups daily
• Store backups off-site (not on the same VPS)
• Test the restore process regularly
• Keep multiple generations of backups
• Encrypt backups with a strong password

Read our guide on making a website backup for extensive instructions on setting up a robust backup strategy.

VPS security checklist: complete overview

1. Set up SSH key authentication and disable password login
2. Change the SSH port and disable root login
3. Configure the firewall (UFW) with minimal open ports
4. Install and configure Fail2ban
5. Activate automatic security updates
6. Create a sudo user, disable root login
7. Check and tighten file permissions
8. Install file integrity monitoring (AIDE)
9. Harden kernel parameters
10. Disable unnecessary services
11. Configure logging and monitoring
12. Implement and test a backup strategy
13. Install SSL certificates for all web services
14. Schedule regular security audits

Securing your VPS is not a one-time task but an ongoing process. Schedule a monthly security review in which you check all the above points and update your configuration based on new threats. With this extensive checklist you have a solid basis for a secure VPS on which you can host your websites and applications with confidence. Also take a look at our comparison of managed vs unmanaged VPS hosting if you consider outsourcing the security management.

Securing your VPS: advanced firewall configuration

UFW versus iptables

UFW (Uncomplicated Firewall) is the most accessible firewall for Linux beginners, while iptables offers more control for advanced users. For most VPS administrators UFW is the best choice because of the simple syntax.

Feature	UFW	iptables	nftables
Ease of use	Very simple	Complex	Medium
Flexibility	Basic	Full	Full
IPv6 support	Automatic	Configure separately	Built-in
Logging	Simple	Detailed	Detailed
Recommended for	Beginners/medium	Advanced	New/advanced

Start by blocking all incoming traffic and then only allow the necessary ports. The minimal set of ports for a web server is: SSH (22 or a custom port number), HTTP (80) and HTTPS (443). Do not allow access to database ports (3306 for MySQL, 5432 for PostgreSQL) from the public internet.

Intrusion detection and prevention on your VPS

Fail2Ban is the most used intrusion prevention tool for Linux servers. It analyzes log files for failed login attempts and automatically blocks IP addresses that show suspicious behavior. Configure Fail2Ban for:

• SSH - Block IP addresses after 3-5 failed login attempts for at least 30 minutes
• Web server - Detect and block scanners that look for vulnerabilities
• FTP - If you use FTP (better: use SFTP via SSH)
• CMS login pages - Protect WordPress wp-login.php or other admin pages

Also consider installing a host-based intrusion detection system (HIDS) such as OSSEC or Wazuh. These tools monitor file changes, detect rootkits and warn of suspicious system activity. Combine this with server monitoring tools for a complete overview of the health and security of your VPS.

Securing your VPS: user management and access control

1. Disable root login via SSH - Use a regular user with sudo rights and disable direct root login in sshd_config.
2. Create individual accounts - Give each administrator their own account instead of a shared administrator account. This makes audit trails possible.
3. Use SSH keys - Disable password authentication and use exclusively SSH keys for secure access.
4. Limit sudo rights - Give users only the specific sudo commands they need via the sudoers file.
5. Implement 2FA for SSH - Add two-factor authentication to SSH for an extra security layer via the Google Authenticator PAM module.

Automatic updates and patch management for your VPS

On Ubuntu and Debian you can set up unattended-upgrades for automatic security updates. This installs patches for the operating system without manual intervention. For application updates (such as Docker images or CMS versions) a more controlled process is needed.

• OS patches - Automatically via unattended-upgrades or yum-cron
• Web server updates - Test first on a staging environment before you update Nginx or Apache
• Database updates - Always make a backup before you update database software
• Application updates - Plan monthly update cycles for your CMS, frameworks and plugins

Monitor available updates with Linux commands for VPS management. The command apt list --upgradable shows available updates on Debian-based systems. Keep a changelog of all updates you carry out, so that you can roll back quickly in case of problems. Combine all this with a website firewall for optimal protection of your server and the websites running on it.

Securing your VPS: kernel hardening and system security

With sysctl settings you can adjust various kernel parameters for better security. Protect against IP spoofing by enabling reverse path filtering. Prevent ICMP redirect attacks by disabling the acceptance of redirects. Enable SYN cookie protection against SYN flood attacks, a common form of denial-of-service. Limit the information the kernel reveals by enabling kernel.dmesg_restrict, so that only root users can read kernel log messages.

AppArmor and SELinux offer mandatory access control (MAC), a complement to the standard Linux file permissions. These systems limit what programs may do, even if they run as root. AppArmor is available by default on Ubuntu and easier to configure, while SELinux (default on CentOS and RHEL) offers more granular control but has a steeper learning curve.

Securing your VPS: logging and audit trail

Configure auditd for extensive system auditing. This records all relevant system events: file access, user actions, network connections and process calls. Centralize your logs with rsyslog or journald to an external log server or cloud service. This prevents an attacker from wiping local logs to hide their tracks. Set up log rotation to prevent log files from filling your disk, but keep logs for at least 90 days for forensic investigation. Monitor your logs actively with tools such as Logwatch that send a daily summary, or with advanced SIEM systems that recognize real-time patterns and warn of suspicious activity. A good logging strategy in combination with the measures mentioned earlier makes your VPS resistant to most attacks and enables you to respond quickly when something does go wrong.

Securing your VPS: backup strategy and disaster recovery

Implement the 3-2-1 backup rule: keep three copies of your data on two different media types, of which one copy is at an external location. Automate daily backups of your databases and weekly backups of all files. Store backups encrypted with AES-256 encryption and keep the encryption key separate from the backups themselves.

Test your backups monthly by carrying out a full restore on a test environment. A backup that cannot be restored is worthless. Document the restore procedure step by step so that even a colleague who is not involved in server management daily can carry out a restore in emergencies. Define your Recovery Time Objective (how quickly must the system be running again) and Recovery Point Objective (how much data may you lose at most) and align your backup frequency with this. For business-critical websites an RPO of at most one hour and an RTO of at most four hours is a common guideline.

Securing your VPS: summary and priority list