How to Secure a New VPS: The First Ten Steps

1. Update everything

Run your distribution's updater first (apt update && apt upgrade or dnf upgrade). Reboot if the kernel was updated.

2. Create a non-root user

Create an unprivileged user, give it sudo, and use it for daily work. Running everything as root turns every mistake into a disaster.

3. Use SSH keys

Generate an SSH key on your computer, copy the public key to the server and log in with it. Keys cannot be guessed the way passwords can.

4. Turn off password login and root login

Once key login works, set PasswordAuthentication no and PermitRootLogin no in the SSH config and restart SSH. Keep a second session open while you test so you cannot lock yourself out.

5. Enable a firewall

Allow only the ports you use (SSH, and 80/443 for a website) and deny the rest. You can manage rules from the panel firewall presets or with ufw on the server.

6. Install fail2ban

fail2ban watches logs and blocks IPs that repeatedly fail to log in, which cuts the noise from automated attacks.

7. Turn on automatic security updates

Enable unattended security updates so critical fixes are applied without you remembering. Still reboot for kernel updates on a schedule.

8. Run services with least privilege

Run each service as its own user, bind databases to localhost, and never expose a database port to the internet unless you must.

9. Take a snapshot and enable backups

Take a snapshot once the server is configured, and keep backups enabled. A snapshot lets you roll back a bad change in a click; a backup protects you if the server is lost.

10. Monitor and review

Watch CPU, memory and disk in the panel, review login logs now and then, and remove software you no longer use.

Start with a virtual server and manage console, snapshots, backups and the firewall from one panel.

Security is not one big step. It is ten small ones done once, before anyone is looking.