On a Self-Managed VPS you are responsible for the software and its security. Start with updates, strong logins, a firewall and backups.
Basic security checklist
- Keep the system updated. Install operating system and package updates often. Apply kernel updates and reboot when needed.
- Use strong logins. Use long, unique passwords. Use SSH keys instead of passwords where you can.
- Log in with an SSH key only. We send the access password when your VPS is activated — change it right away, set up an SSH key, and then turn off password login.
- Turn on a firewall. Open only the ports your services really need. For example, ServerCare uses the CSF firewall.
- Protect against brute-force attacks. Block IP addresses that try to log in many times.
- Scan for malware. Use a malware scanner and check for unknown files and processes.
- Remove what you do not use. Delete old user accounts, apps and services.
- Use two-factor login for control panels and apps that support it.
- Keep backups outside the server. Test that you can restore them.
- Do not run an open mail relay. It can be used to send spam from your server.
Important: Never share root passwords or private SSH keys in chat or email. Share access only inside a support ticket.
Important: If you get an abuse report about your server, reply within the time given in the notice.
Tip: Do you want us to do this for you? Linux ServerCare covers security hardening, firewall, malware protection, monitoring and updates.
Was your server or site hacked?
We can clean it for you. See Hacked Website Repair and open a support ticket. After the clean-up, update all software and change all passwords.