A fresh VPS with a default root password is scanned by automated bots within minutes of going online. This first-hour checklist turns a soft target into a hardened server — do it before installing anything you care about.
✅ Before you start
- Connected to your VPS via SSH as root (see the SSH guide)
- Commands below are for common Linux systems — Debian/Ubuntu use apt, AlmaLinux/Rocky use dnf
The checklist
- Change the root password immediately: run passwd and set a long, generated password stored in your password manager. The delivered password has travelled by email — it retires now.
- Update the whole system: apt update && apt upgrade -y or dnf update -y. Fresh images routinely ship with known, already-fixed holes.
- Create your own user and use it: add a named user with sudo/admin rights, and do daily work as them — not as root. Root stays for deliberate administration only.
- Move SSH to key-based login: generate an SSH key pair on your computer, install the public key on the server, test it in a second window — and only then disable password login for SSH in its configuration. Keys end brute-force password attacks entirely.
- Turn on the firewall: enable the built-in firewall (ufw on Ubuntu/Debian, firewalld on AlmaLinux/Rocky) allowing only the ports you actually use — SSH (22) plus web (80/443) for a web server. Everything else closed by default.
- Install fail2ban or equivalent to auto-block addresses that keep failing logins — a small tool that removes most background noise.
- Set up backups from day one: scheduled copies of your data and configs, stored OFF the VPS. A secured server with no backups is one bad day from zero.
- Install only what you need: every extra service is an extra door. If you didn't install it, it can't be exploited — remove sample apps and unused services.
✅ Result: Your VPS now has a fresh root password, current software, key-based SSH, a real firewall, brute-force protection and backups — the baseline that automated attackers simply walk past in search of easier machines.
Lockout warning for step 4: NEVER disable password login until you've proven — in a second, separate SSH window — that key login works. More admins have locked themselves out with this step than attackers ever will.
Related articles
- How to Connect to Your VPS (SSH — Windows & Linux)
- How to Make Your Accounts Secure (Strong Passwords, 2FA)
- What to Do If Your Website Gets Hacked