Linux VPS Security Basics for a New Server

Create a named administrator, use a unique credential, and prepare SSH key authentication. Keep a tested console or recovery path before changing SSH or firewall rules. Shared root credentials make investigation and revocation harder.

A private key should stay on the administrator's device and should be protected with a passphrase. Remove keys and accounts promptly when access is no longer required.

Install current security updates and define who reviews and applies future updates. Remove or disable packages, services, and listening ports the workload does not need. Every additional service adds configuration and maintenance work.

Automated security updates can reduce exposure, but they still need monitoring and a reboot strategy. Test important application paths after operating system or runtime changes.

Set a default-deny inbound host firewall policy and allow only documented application ports. Restrict administration to trusted source addresses or a private access path where practical. Do not expose database or management ports broadly for convenience.

Changing a default port can reduce scanning noise, but it is not an authentication or authorization control. Strong keys, source restrictions, updates, and monitoring carry more security value.

Monitor authentication failures, privilege changes, service restarts, storage capacity, application errors, and backup freshness. Send important logs or alerts somewhere that remains available if the server is compromised or unavailable.

Back up stateful data outside the VPS and test a restore. A security plan that cannot recover cleanly from compromise or operator error is incomplete.