Short answer: Securing a VPS comes down to a short list: log in with SSH keys and disable password and root logins, run a firewall that opens only the ports you need, install security updates automatically, add brute-force protection, take backups and keep software minimal.
VPS security explained
Most attacks on a new server are automated: bots scan for SSH, RDP and admin panels with weak passwords within minutes of the IP going online. The steps below stop nearly all of them.
After that, monitor the server (disk, memory, failed logins), keep application software and plugins updated, and test restoring a backup at least once.
Step by step
- Create a normal user with sudo and log in with an SSH key; set PermitRootLogin no and PasswordAuthentication no in sshd_config.
- Enable a firewall (ufw, firewalld or the provider's cloud firewall) and allow only SSH, HTTP and HTTPS or what your service needs.
- Turn on automatic security updates (unattended-upgrades on Debian and Ubuntu, dnf-automatic on RHEL-based systems).
- Install fail2ban or similar to block repeated failed logins.
- On Windows, restrict RDP port 3389 to your IP or a VPN and enable account lockout.
- Schedule backups or snapshots and keep a copy at another provider.
- Remove software you do not use and bind databases and admin panels to localhost or a private network.
See it in the data
Frequently asked questions
Is a VPS secure by default?
The provider secures the hardware and network; the operating system and software are your responsibility on an unmanaged VPS.