Securing a VPS involves updating your operating system, using SSH keys instead of passwords, changing the default SSH port, enabling a firewall, installing Fail2Ban, disabling root login, using strong passwords, enabling automatic security updates, monitoring logs, and performing regular backups to protect against cyber threats.

How to Secure a VPS Server: The Complete Guide

A Virtual Private Server (VPS) gives you full control over your hosting environment—but with that control comes responsibility.

Unlike shared hosting, where the hosting provider manages much of the server security, a Virtual Private Server (VPS) gives you complete control over your hosting environment, including operating system updates, security configurations, applications, and user accounts.

Whether you’re hosting:

• WordPress websites
• Business applications
• APIs
• SaaS platforms
• E-commerce stores
• Game servers
• Development environments

A properly secured VPS dramatically reduces the risk of hacking, malware infections, ransomware, brute-force attacks, privilege escalation, and data loss.

In this guide, you’ll learn the most effective VPS security practices used by professional system administrators.

Why VPS Security Matters

Every internet-connected server, including a managed or unmanaged VPS, is continuously scanned by automated bots searching for security vulnerabilities and exposed services.

Common attacks include:

• SSH brute-force attacks
• Credential stuffing
• Malware installation
• DDoS attacks
• Web application exploits
• Privilege escalation
• Crypto miners
• Ransomware

A single weak password or outdated package can compromise your entire server.

Fortunately, following a layered security approach significantly lowers your risk.

1. Keep Your Server Updated

The first rule of VPS security is simple:

Always install security updates.

For Ubuntu:

sudo apt update
sudo apt upgrade -y

For AlmaLinux/Rocky Linux:

sudo dnf update -y

Updates patch vulnerabilities before attackers exploit them. The official Ubuntu Server security documentation provides guidance on maintaining a secure Linux server, installing security updates, and following recommended hardening practices.

2. Create a Non-Root User

Never use the root account for daily administration.

Instead:

adduser adminuser

usermod -aG sudo adminuser

Login using your normal account and elevate privileges only when needed.

Benefits:

• Better auditing
• Reduced accidental damage
• Improved security

3. Disable Root SSH Login

Attackers almost always attempt to log in as root.

Edit:

/etc/ssh/sshd_config

Change:

PermitRootLogin no

Restart SSH:

sudo systemctl restart ssh

4. Use SSH Keys Instead of Passwords

Password authentication is vulnerable to brute-force attacks.

Generate a key:

ssh-keygen -t ed25519

Copy it:

ssh-copy-id username@server-ip

Disable password login:

PasswordAuthentication no

SSH keys provide significantly stronger authentication than traditional passwords. According to the OpenSSH project, public key authentication is one of the most effective ways to secure remote server access and reduce the risk of brute-force attacks.

5. Change the Default SSH Port

Bots continuously scan port 22.

Example:

Port 2222

Although changing the port isn’t a replacement for proper security, it greatly reduces automated attacks.

6. Configure a Firewall

Ubuntu:

sudo ufw allow 80
sudo ufw allow 443
sudo ufw allow 2222

sudo ufw enable

Check:

sudo ufw status

Only expose ports that your applications actually need. Ubuntu’s UFW documentation explains how to configure firewall rules, allow or block ports, and secure services exposed to the internet.

7. Install Fail2Ban

Fail2Ban automatically blocks repeated login attempts.

Install:

sudo apt install fail2ban

Enable:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Fail2Ban protects services such as SSH, Nginx, Apache, and Postfix by monitoring log files and automatically banning IP addresses that repeatedly fail authentication. The official Fail2Ban documentation includes advanced configuration options for custom jails and filters.

8. Enable Automatic Security Updates

Ubuntu:

sudo apt install unattended-upgrades

Enable automatic security patching to reduce exposure to newly discovered vulnerabilities.

9. Use Strong Passwords

Every account should use:

• At least 16 characters
• Uppercase letters
• Lowercase letters
• Numbers
• Symbols

Never reuse passwords across servers.

10. Enable Two-Factor Authentication (2FA)

Whenever possible, protect:

• Hosting control panels
• SSH
• Git repositories
• Cloud dashboards

2FA provides an additional layer of security if credentials are compromised.

11. Secure Your SSH Configuration

Recommended settings:

PermitRootLogin no

PasswordAuthentication no

MaxAuthTries 3

PermitEmptyPasswords no

AllowUsers yourusername

Protocol 2

12. Remove Unused Software

Unused software increases your attack surface.

Review installed packages regularly:

apt list --installed

Remove unnecessary services.

13. Close Unused Ports

Check listening ports:

sudo ss -tulpn

Disable services that shouldn’t be publicly accessible.

14. Install an Intrusion Detection System

Popular options include:

• AIDE
• Wazuh
• OSSEC
• Tripwire

These tools monitor critical system files and alert you to unauthorised changes.

15. Monitor Server Logs

Important logs:

/var/log/auth.log

/var/log/syslog

/var/log/nginx/

journalctl

Look for:

• Failed logins
• Unexpected reboots
• Unknown processes
• Suspicious IP addresses

16. Configure Backups

Security also means being able to recover quickly.

Your backup strategy should include:

• Daily backups
• Weekly full backups
• Off-site backups
• Encrypted backups
• Backup verification

Always test restoration procedures.

17. Use HTTPS Everywhere

Install SSL certificates using Let’s Encrypt:

sudo certbot --nginx

Encrypting traffic protects sensitive user data, improves visitor trust, and is an important ranking signal for search engines. You can obtain free SSL/TLS certificates through Let’s Encrypt, while Certbot automates certificate installation and renewal.

18. Protect Against DDoS Attacks

While most VPS providers offer basic network protection, you can further improve resilience by:

• Using Cloudflare
• Rate limiting requests
• Enabling caching
• Configuring Nginx limits
• Blocking abusive IPs

19. Install Malware Scanners

Useful tools:

ClamAV

Lynis

chkrootkit

rkhunter

Run regular scans to detect malware and rootkits. ClamAV is one of the most widely used open-source antivirus solutions for Linux servers and can help identify known malicious files.

20. Secure Your Web Server

For Nginx:

Hide server version:

server_tokens off;

Disable directory listing:

autoindex off;

Limit upload sizes where appropriate.

21. Secure Your Database

Never expose MySQL or MariaDB directly to the internet.

Instead:

• Bind to localhost
• Use strong passwords
• Remove anonymous users
• Delete test databases
• Enable TLS for remote access when required

22. Use Principle of Least Privilege

Only grant users the permissions they require.

Avoid:

• Running applications as root
• World-writable files
• Unnecessary sudo access

23. Regularly Audit Your Server

Perform monthly security audits and compare your configuration against the CIS Benchmarks, which provide industry-recognised security recommendations for Linux servers:

• Check users
• Review running services
• Audit firewall rules
• Verify SSH configuration
• Inspect cron jobs
• Review logs

24. Monitor Resource Usage

Unexpected spikes in:

• CPU
• RAM
• Network traffic
• Disk usage

may indicate compromise or abuse.

Tools include:

htop

iftop

iotop

vnstat

25. Have an Incident Response Plan

If your VPS is compromised:

1. Disconnect the server if necessary.
2. Preserve logs for investigation.
3. Restore from a clean backup.
4. Rotate all passwords and API keys.
5. Apply missing security patches.
6. Review access controls before bringing the server back online.

Being prepared can significantly reduce downtime and data loss.

VPS Security Checklist

Common VPS Security Mistakes

Avoid these common pitfalls:

• Using the root account for everyday tasks.
• Leaving SSH password authentication enabled.
• Ignoring operating system updates.
• Exposing databases directly to the internet.
• Running outdated CMS or plugins.
• Forgetting to test backups.
• Leaving unused ports open.
• Installing software from untrusted repositories.
• Using weak or reused passwords.
• Neglecting log monitoring.

Avoiding these mistakes significantly reduces your attack surface. The OWASP Foundation publishes widely recognised security guidance covering common vulnerabilities, secure coding practices, and web application security.

Securing a VPS is an ongoing process rather than a one-time task. The NIST Cybersecurity Framework recommends continuous monitoring, regular patch management, access control, and ongoing risk assessments as part of a comprehensive security strategy. By combining operating system updates, SSH hardening, firewalls, intrusion prevention, monitoring, backups, and least-privilege access, you can dramatically reduce the risk of compromise.

No server is completely immune to attacks, but a well-maintained and properly hardened VPS is far more resilient against common threats. Regular reviews, timely patching, and proactive monitoring should be part of your routine to keep your applications and customer data protected.

Frequently Asked Questions

How do I secure my VPS server?

Start by updating your operating system, creating a non-root user, disabling root SSH login, using SSH keys, enabling a firewall, installing Fail2Ban, configuring automatic updates, monitoring logs, and maintaining reliable backups.

Is a VPS more secure than shared hosting?

A VPS offers greater isolation and control than shared hosting, which can improve security. However, you are responsible for configuring and maintaining that security. An unmanaged VPS can be less secure than well-managed shared hosting if it is not properly maintained.

Should I disable root login on my VPS?

Yes. Disabling direct root login reduces the risk of brute-force attacks. Use a standard user account with sudo privileges for administration.

Which firewall should I use on Ubuntu?

UFW (Uncomplicated Firewall) is an excellent choice for most users. It provides a simple interface for managing iptables rules and is suitable for many VPS deployments.

What is Fail2Ban?

Fail2Ban is a security tool that monitors log files and temporarily blocks IP addresses that repeatedly fail authentication. It is particularly effective at reducing automated SSH brute-force attacks.

How often should I update my VPS?

Check for updates at least weekly, or enable automatic security updates so critical patches are installed as soon as they become available.

Is changing the SSH port enough to secure my VPS?

No. Changing the default SSH port helps reduce automated scans, but it should always be combined with SSH keys, disabling password authentication, a firewall, and other security measures.

Should I install antivirus software on a Linux VPS?

Linux servers are generally less targeted than desktop systems, but malware can still affect them. Running periodic scans with tools such as ClamAV and monitoring for rootkits can add another layer of protection.