Securing a New VPS: The First 10 Things to Do

A new VPS on a public IP address starts receiving automated login attempts within minutes of going live. These ten steps close the most common doors before you deploy your application.

1. Update everything. Apply all operating-system updates and enable automatic security updates.
2. Create a non-root user with sudo rights and stop logging in as root.
3. Use SSH keys and disable password authentication for SSH.
4. Disable direct root login over SSH.
5. Turn on a host firewall (nftables, ufw or firewalld) and allow only the ports you need — typically SSH, HTTP and HTTPS.
6. Restrict SSH to your office or VPN IP addresses where possible.
7. Install brute-force protection such as fail2ban to block repeated failed logins.
8. Configure backups and test a restore — a backup you have never restored is a hope, not a backup.
9. Set up monitoring for CPU, memory, disk, uptime and certificate expiry, with alerts that reach a person.
10. Remove what you do not use — default services, sample pages and unused packages all expand the attack surface.

Then keep it that way

Hardening is not a one-time job. Review users and keys quarterly, keep software current, and watch logs for unusual activity.

Prefer not to manage it yourself? Our managed VPS service includes hardening, patching, backups and 24×7 monitoring. Talk to us.