10 VPS Security Steps Every Beginner Must Take Immediately After Setup

Your new VPS is exposed to the internet the moment it boots. Bots start scanning your IP within minutes, trying default passwords and known exploits. These 10 steps — ordered by priority — will lock down your server before attackers get a foothold.

1. Run System Updates Immediately

The first command on any new VPS should be a full system update. On Ubuntu or Debian run:

sudo apt update && sudo apt upgrade -y

On CentOS or AlmaLinux use sudo yum update -y. Outdated packages are the single most common entry point for attackers. Don’t skip this step even if you’re in a hurry.

2. Change the Default SSH Port

Port 22 is the first thing every bot checks. Edit /etc/ssh/sshd_config and change Port 22 to a high-numbered port like 2222 or 10022. Then restart SSH with sudo systemctl restart sshd. Make sure your firewall allows the new port before disconnecting your current session.

3. Enforce SSH Key Authentication Only

Password-based SSH login is the #1 vulnerability on new servers. Generate a key pair on your local machine with ssh-keygen -t ed25519, copy the public key to your server, then set PasswordAuthentication no and PubkeyAuthentication yes in sshd_config.

4. Set Up a Firewall

UFW is the simplest firewall for Ubuntu. Allow only what you need:

sudo ufw allow 2222/tcp   # your custom SSH port
sudo ufw allow 80/tcp      # HTTP
sudo ufw allow 443/tcp     # HTTPS
sudo ufw default deny incoming
sudo ufw --force enable

5. Install and Configure Fail2ban

Fail2ban monitors authentication logs and bans IPs after repeated failures. Install it, enable the SSH jail, and set a reasonable ban time:

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Fail2ban’s default settings work well — it bans IPs for 10 minutes after 5 failed attempts.

6. Disable Root Login

Create a regular user with sudo privileges for daily work, then disable direct root login via SSH. In sshd_config set PermitRootLogin no. Attackers target the root account by default — removing that target dramatically reduces your risk profile.

7. Install Automatic Security Updates

On Ubuntu, install unattended-upgrades to apply security patches automatically. This covers you when you’re not watching the server.

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

8. Secure Shared Memory

Mount /dev/shm with noexec, nosuid, and nodev to prevent certain privilege escalation attacks. Add this line to /etc/fstab:

tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0

9. Set Up a Basic Intrusion Detection System

Tools like rkhunter and chkrootkit scan for known rootkits and suspicious files. Run them weekly via cron. They won’t catch everything, but they’ll flag the low-hanging fruit.

10. Configure Automated Off-Site Backups

Security isn’t just about prevention — it’s also about recovery. Set up daily automated backups to a separate location (another server, S3-compatible storage, or rsync.net). Test your restore process monthly. A server you can’t recover is a server you don’t truly own.

For a deeper dive into VPS security configurations, including advanced firewall rules and SELinux policies, check out our VPS security features guide.