VPS Security Checklist (2026)

Why bother: a freshly-provisioned VPS with a default SSH setup gets hammered by automated scanners within hours — bots try common passwords and SSH usernames constantly. The good news: hardening a box is fast and free. Do these once and you can stop thinking about it.

The 15-minute checklist

1. Update everything first

Before touching configs, patch the base image. On Debian/Ubuntu:

sudo apt update && sudo apt upgrade -y

Then reboot if a kernel updated: sudo reboot.

2. SSH hardening — the single highest-value step

Disable password login and root login, and use a key. Edit /etc/ssh/sshd_config:

PasswordAuthentication no
PermitRootLogin prohibit-password

Add your public key with ssh-copy-id (from your laptop) before disabling passwords, or you'll lock yourself out. Then sudo systemctl restart ssh.

Check: open a second terminal and confirm you can still log in with the key before closing the first. Lockouts are the #1 self-inflicted VPS incident.

3. Firewall — allow only what you need

UFW is the fastest path on Debian/Ubuntu:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp     # SSH
sudo ufw allow 80,443/tcp # web/HTTPS (if serving traffic)
sudo ufw enable

Add any specific ports your services need (e.g. 3001 for Uptime Kuma, 5678 for n8n). Everything else gets dropped.

4. Automatic security updates

For unattended security patching on Debian/Ubuntu:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Answer "Yes" to apply security updates automatically. The single most effective habit you can automate.

5. fail2ban — the brute-force brake

sudo apt install fail2ban
sudo systemctl enable --now fail2ban

Default config bans IPs after repeated SSH failures. Done in one command.

6. A non-root daily-driver user

Run as a normal user with sudo, not root:

sudo adduser yourname
sudo usermod -aG sudo yourname

7. If you run Docker

Keep images current (rebuilt from fresh tags), don't map Docker ports straight to 0.0.0.0 unless you must, and put a reverse proxy like Caddy in front of anything public. The self-host stack guide and Uptime Kuma guide follow this pattern — Docker binds internal, proxy fronts it.

That's genuinely it

These seven steps cover the attacks that actually reach a new VPS. Everything past this is nice-to-have and usually overkill for a personal or small-project box.

Pick a VPS that fits this checklist →

Affiliate disclosure: signups through comparison links on this site may earn us a commission. It doesn't change our rankings.