Deploying a VPS is the first step to building your online presence, hosting applications, or running business-critical services. But if you don’t secure it immediately after deployment, your server could become an easy target for hackers and automated bots.
Here’s a step-by-step security checklist for 2025 to harden your VPS from the start.
✅
1. Update Your System
Outdated packages and kernels are the biggest vulnerabilities.
Run these commands right after login:
sudo apt update && sudo apt upgrade -y # For Ubuntu/Debian
sudo dnf update -y # For CentOS/AlmaLinux✅
2. Create a New User and Disable Root Login
Never use the root account for day-to-day operations.
adduser youruser
usermod -aG sudo youruserEdit the SSH configuration:
sudo nano /etc/ssh/sshd_configChange:
PermitRootLogin noRestart SSH:
systemctl restart ssh✅
3. Set Up SSH Key Authentication
Passwords can be brute-forced. Use SSH keys instead.
Generate keys on your local machine:
ssh-keygen -t rsa -b 4096Copy your public key to the VPS:
ssh-copy-id youruser@server_ipDisable password login in /etc/ssh/sshd_config:
PasswordAuthentication noRestart SSH again.
✅
4. Change the Default SSH Port
Bots scan port 22 for vulnerabilities. Change it to a non-standard port (e.g., 2222):
sudo nano /etc/ssh/sshd_configSet:
Port 2222Restart SSH:
systemctl restart ssh✅
5. Enable a Firewall
Use UFW for Ubuntu/Debian:
sudo ufw allow 2222/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enableFor CentOS/AlmaLinux (Firewalld):
sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --reload✅
6. Install Fail2Ban
Protect against brute-force attacks:
sudo apt install fail2ban -y # Debian/Ubuntu
sudo dnf install fail2ban -y # CentOS/AlmaLinuxEnable and start Fail2Ban:
sudo systemctl enable fail2ban
sudo systemctl start fail2ban✅
7. Disable Unnecessary Services
Check running services:
systemctl list-unit-files --type=service --state=enabledDisable what you don’t need:
sudo systemctl disable service_name✅
8. Enable Automatic Security Updates
On Ubuntu/Debian:
sudo apt install unattended-upgrades -yOn CentOS/AlmaLinux:
sudo dnf install dnf-automatic -y
sudo systemctl enable --now dnf-automatic.timer✅
9. Install a Malware Scanner
Use ClamAV for basic malware scanning:
sudo apt install clamav -y✅
10. Backup Regularly
Security is not complete without backups. Use tools like:
- rsync
- rclone
- Cloud backups from your Hosteons VPS panel
Pro Tip:
Hosteons offers an Initial VPS Setup Script that secures your server instantly with best practices:
Final Thoughts
Securing your VPS should never be an afterthought. With these 10 steps, you can minimize vulnerabilities and keep your server safe from evolving cyber threats in 2025.
🛡️ Ready to get started?
Order a reliable VPS now: Hosteons VPS Plans
