First Steps to Secure a New VPS Server

When a new VPS comes online, automated bots begin scanning it for weaknesses almost immediately. With a VPS, security is largely your responsibility unless you have a managed plan. The steps below cover the essentials for a typical Linux server. If you are not comfortable with the command line, consider managed VPS support.

1. Update the system

Start by installing all available security updates for the operating system and installed packages. Then plan a routine for regular updates, or enable automatic security updates where appropriate.

2. Create a non-root user

Logging in directly as the root user is risky. Create a separate user account with administrator privileges using sudo, and use that account for daily work.

3. Use SSH keys instead of passwords

SSH keys are far more secure than passwords. Generate a key pair on your computer, add the public key to your new user account on the server, and confirm you can log in with it before making further changes.

4. Harden SSH settings

After confirming key-based login works, update your SSH configuration to:

• Disable root login over SSH
• Disable password authentication
• Allow only specific user accounts to log in

Always keep an existing session open while testing changes, so you do not lock yourself out.

5. Configure a firewall

Allow only the network ports your server needs. A typical web server might allow:

• SSH (port 22, or a custom port)
• HTTP (port 80)
• HTTPS (port 443)
• Control panel or email ports only if you use them

Block everything else by default.

6. Protect against brute-force attacks

Install a tool that detects repeated failed login attempts and temporarily blocks the offending IP addresses. This reduces the noise from automated attacks on SSH, email and control panels.

7. Install only what you need

Every service running on your server is a potential target. Remove software you do not need and disable unused services.

8. Secure your websites and applications

• Install SSL certificates so all sites use HTTPS. See SSL certificates explained.
• Keep your CMS, plugins and application dependencies updated.
• Run each website under its own user where possible, so one compromised site cannot easily affect others.
• Use strong, unique database passwords.

9. Set up backups

Configure automatic backups of website files, databases and important configuration. Store copies off the server and test restoring them regularly. Read more about backups and restoration.

10. Monitor your server

• Monitor uptime and receive alerts if the server goes down.
• Watch CPU, memory and disk usage for unusual spikes.
• Review login and security logs periodically.

VPS security checklist

1. System fully updated
2. Non-root admin user created
3. SSH keys configured
4. Root and password SSH login disabled
5. Firewall allowing only required ports
6. Brute-force protection enabled
7. Unused software removed
8. HTTPS enabled on all sites
9. Off-server backups tested
10. Monitoring and alerts active

Final thoughts

Security on a VPS is an ongoing process. Completing these first steps puts your server in a far stronger position. For general website protection, also read our WordPress security guide.