A fresh VPS is probed by automated attackers within minutes of going online — often before you finish your coffee. Learning how to run a secure VPS is not optional; it is the first job of every server owner. This guide gives you 15 essential steps that take a default Ubuntu install from wide-open to properly hardened, in an order that keeps you from locking yourself out.
Why You Must Secure Your VPS on Day One
Botnets constantly scan the entire internet for SSH, RDP, and database ports. A default VPS ships with password authentication enabled, no firewall, and every service the image builder thought you might want. Each of those is an invitation. The steps below to secure your VPS close those doors one by one, and most of them take under five minutes each.
15 Essential Steps for a Secure VPS
1. Update Everything Immediately
Run apt update && apt upgrade -y on Debian/Ubuntu (or dnf upgrade -y on RHEL-based systems). Image templates are often weeks old and ship with known vulnerabilities.
2. Create a Non-Root Sudo User
Never work as root day-to-day. Create a normal user with adduser deploy, add it to the sudo group, and use it for everything. If an attacker compromises your session, they do not land directly in root.
3. Switch to SSH Key Authentication
Generate a key pair with ssh-keygen on your computer and copy the public key to ~/.ssh/authorized_keys on the server. Keys are practically unguessable; passwords are not. This single change to secure your VPS defeats nearly all SSH brute-force attacks.
4. Disable SSH Password Authentication
In /etc/ssh/sshd_config, set PasswordAuthentication no and PermitRootLogin prohibit-password, then restart sshd. Test your key login in a second terminal before closing your current session.
5. Change the Default SSH Port
Moving SSH from port 22 to something like 2222 does not stop a targeted attacker, but it eliminates 99% of background noise from bots that only knock on 22. Update your firewall rule to match.
6. Enable a Firewall (UFW)
Allow only what you need and deny everything else:
ufw default deny incoming ufw default allow outgoing ufw allow 2222/tcp ufw allow 80,443/tcp ufw enable
7. Install Fail2ban
Fail2ban watches your logs and temporarily bans IPs that fail authentication too many times. apt install fail2ban and its default SSH jail starts protecting you immediately — a must-have layer when you secure a VPS that faces the public internet.
8. Enable Automatic Security Updates
Install unattended-upgrades so security patches apply themselves. You will still schedule major upgrades manually, but critical CVEs get fixed overnight without you lifting a finger.
9. Disable Unused Services
Every running service is attack surface. List listening ports with ss -tlnp and disable anything you do not recognize with systemctl disable --now servicename.
10. Harden the Kernel with Sysctl
Add basic network hardening to /etc/sysctl.conf: disable IP forwarding if you do not need it, ignore ICMP redirects, and enable SYN flood protection. Apply with sysctl -p.
11. Set Up Regular Backups
Security includes recovery. Take automated snapshots (most VPS hosts like Contabo offer them as a cheap add-on) and keep off-site copies of critical data with rsync or restic.
12. Install a Rootkit Scanner
Tools like rkhunter and chkrootkit establish a baseline of your system files and alert you to tampering. Run a scan weekly via cron.
13. Monitor Your Logs
Set up logwatch or forward logs to a central server. You cannot respond to an intrusion you never notice — daily log summaries take two minutes to skim.
14. Secure Your Hosting Control Panel
If you run a panel (HestiaCP, CyberPanel, CloudPanel), restrict its admin port to your IP in the firewall, enforce 2FA, and keep the panel itself updated — panels are a favorite target.
15. Use 2FA Everywhere It Exists
Enable two-factor authentication on your hosting provider account, domain registrar, and DNS provider. A secure VPS means nothing if an attacker resets your password through your host's billing panel. Hostwinds and other reputable hosts all support 2FA on accounts.
Bonus: Securing a VPS That Sends Email
Mail servers attract extra attention. Beyond the 15 steps, lock down your MTA: require authentication on port 587, never run an open relay, keep SPF/DKIM/DMARC records valid, and monitor blacklists weekly. A compromised mail server gets your IP blacklisted within hours.
Key Takeaways
- To secure a VPS, work through the list in order: updates → sudo user → SSH keys → firewall → fail2ban → everything else.
- SSH key authentication plus disabled password login eliminates the most common attack vector entirely.
- A default-deny firewall and fail2ban handle the background noise; automatic updates handle the zero-days.
- Backups and log monitoring are security controls too — plan for recovery, not just prevention.
- Mail servers need extra care: authenticated relay only, valid authentication records, and blacklist monitoring.
Related Guides
- Best Open Port 25 VPS Providers in 2026 — pick a host that fits a mail-server workload.
- How to Install PowerMTA on Ubuntu 24.04 — secure the MTA itself after hardening the OS.
- How to Install Zimbra Mail Server — groupware with its own security considerations.