Secure a New $5 VPS in 10 Minutes (2026)

Every cheap VPS is on the public internet the second it boots. Lock it down before anything else.

Bottom line: a fresh budget VPS gets brute-forced within hours. These four steps — SSH keys, UFW, fail2ban, auto-updates — drop the attack surface to near zero and take about 10 minutes. This is the foundation of the full VPS security checklist.

Step 1 — SSH keys, disable password login

ssh-keygen -t ed25519          # on your laptop
ssh-copy-id root@YOUR_VPS_IP   # copy the key
# on the VPS:
sudo nano /etc/ssh/sshd_config
#   PasswordAuthentication no
#   PermitRootLogin prohibit-password
sudo systemctl restart sshd

Step 2 — UFW firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp        # SSH
sudo ufw allow 80,443/tcp    # web if you host sites
sudo ufw enable

Only open the ports your apps actually use. If you run Uptime Kuma, that's 3001 — expose it only if you need public dashboards.

Step 3 — fail2ban for brute force

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
# default bans after 5 failed attempts, 10 min

Step 4 — auto security updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades  # enable

If you run Docker, apply the same logic to containers — see the Docker starter stack for a hardened Compose baseline, and don't expose ports to 0.0.0.0 unless you must.

Deploy a VPS to harden →

Affiliate disclosure: we earn a commission on RackNerd signups at no cost to you.