A freshly provisioned VPS is vulnerable by default. Without proper hardening, your server is exposed to brute-force attacks, unauthorized access, and common exploits. This checklist covers the essential security measures every VPS administrator should implement within the first hour of deployment.

1. Update All System Packages

Before anything else, run a full system update to patch known vulnerabilities. Configure unattended-upgrades for automatic security patches on Debian/Ubuntu systems, or enable automatic security updates on RHEL-based distributions.

2. Harden SSH Access

Disable root login and password authentication. Use SSH key-based authentication only. Change the default SSH port from 22 to a non-standard port. Restrict SSH access to specific IP addresses if possible. Install fail2ban to automatically block IPs after repeated failed login attempts.

3. Configure the Firewall

Enable UFW or firewalld and set a default deny policy for incoming connections. Allow only the ports your applications require: 80 and 443 for web traffic, your custom SSH port, and any database ports if remote access is needed. Block all other inbound traffic.

4. Install and Configure a Web Application Firewall

For Nginx-based setups, install the ModSecurity or Naxsi WAF. Configure rules to block SQL injection, cross-site scripting, and common exploit patterns. Keep the rule set updated regularly.

5. Enable Automatic Security Updates

Configure your package manager to automatically install security updates. On Debian/Ubuntu, install unattended-upgrades and configure it to apply security patches without prompting. This ensures your system stays protected against newly discovered vulnerabilities.

6. Monitor and Log

Enable auditd for system call monitoring. Configure log rotation and forward logs to a remote syslog server. Set up alerts for failed login attempts, privilege escalation, and unusual resource usage. Review logs regularly for signs of compromise.

7. Keep Applications Updated

Install WordPress, PHP, and all plugins with automatic updates enabled. For custom applications, establish a regular update cycle. Outdated software is the most common entry point for attackers.