A Beginner's Guide to Securing Your VPS: Best Practices

A new VPS is on the internet within minutes, and bots start trying passwords almost straight away. These steps cover the basics. Do them in this order, and keep a second SSH session open while you change SSH settings so you cannot lock yourself out.

1. Update the system

sudo apt update
sudo apt upgrade -y

Repeat this regularly, or turn on automatic security updates (unattended-upgrades on Debian and Ubuntu).

2. Use a normal user, not root

Create a user with sudo rights and use that for everything:

adduser yourname
usermod -aG sudo yourname

3. Lock down SSH

Set up SSH keys, then edit /etc/ssh/sshd_config:

• PermitRootLogin no
• PasswordAuthentication no (only once your key login works)
• Optionally change the port from 22. It cuts log noise, but it is not real security.

Apply with sudo systemctl restart ssh (the service is called sshd on CentOS-style systems).

4. Turn on a firewall

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

Allow only the ports you actually use. If you moved SSH to another port, allow that port before you enable the firewall.

5. Slow down brute-force attacks

Install Fail2ban to block addresses that keep failing to log in.

6. Secure your apps

• Keep web apps and plugins up to date.
• Remove services and default pages you do not use.
• Use strong, unique passwords, and two-factor authentication where an app offers it.

7. Back up, and watch the server

Keep regular backups somewhere other than the server itself, and test restoring one. Check logs and resource use now and then so you notice anything unusual early (htop and Monit help).