Server security checklist

This guide covers a practical checklist for protecting a VPS: access, updates, firewall, services, logs and backups. Work through it once after setup, then review it regularly.

Before you begin

• SSH access with a user that has sudo rights.
• A backup, or the plan's backup option. See Backups, snapshots and reboot.

Steps

1. Use SSH keys, not passwords, for every user that signs in. See SSH keys and root access.
2. Use a normal user for daily work. Before restricting root access, test a separate SSH session with keys and sudo, and confirm console recovery. Keep the current session open until the replacement works.
3. Install updates regularly. See Updates and firewall.
4. Allow only the ports you need. Preserve tested administrative access. Direct public web hosting needs its web ports. Review both provider and server firewalls.
5. Remove services you do not use. Each running service is a possible entry point. Check which services listen with sudo ss -tulpn.
6. Keep software current. Update the web server, database and application packages through the package manager, not by copying files by hand.
7. Check the logs. Look at sudo journalctl -u ssh for sign-in attempts you do not recognise.
8. Use strong passwords for any account that still uses a password, and store them in a password manager.
9. Back up regularly, and test that you can restore a file. See Backups, snapshots and reboot.
10. Keep a note of who has access. Remove access for anyone who no longer needs it.

Never turn off security controls to troubleshoot

Do not disable the firewall, SSH key checks or other security settings as a shortcut. Find the rule or setting that blocks what you need, and change only that.

Expected result

Only the people and services you need can reach the server, updates are current, and you can restore your important files.

If something goes wrong

• You see sign-in attempts you do not recognise. Confirm that password sign-in is off, then read Recognise a compromised account.
• A service has stopped after a security change. Restore the previous setting, then make the smallest change that allows the service.
• You are not sure what a running service does. Do not stop it. Ask support before you change it.

Related articles

• Secure your hosting
• Recognise a compromised account
• SSH keys and root access
• Updates and firewall

Last reviewed

2026-10-28