Skip to main content
A brand-new VPS is exposed to the internet the moment it boots. Bots start knocking on port 22 within minutes. This checklist gets you from freshly claimed to reasonably hardened in about ten minutes.

​
1. Log in for the first time

Grab your credentials from the panel and SSH in. See SSH Access if you need help.

​
2. Change the root password

Even if the password we generated is strong, changing it to something only you know is worth the 5 seconds.

​
3. Update the system

Install the latest security patches before doing anything else.
Full details in Package Updates.

​
4. Create a non-root user

Running everything as root is dangerous. Create a regular user with sudo access.
Full details in User Management.

​
5. Add your SSH key

Password auth is the slow lane. SSH keys are faster and much harder to brute-force. On your local machine, generate a key pair if you do not already have one:
Copy the public key to the VPS:
Or do it by hand:
Test it in a second terminal before moving on:

​
6. Disable root SSH login

Once you can log in as your regular user, close the root door.
Set:
Reload SSH:
Do not close your working SSH session until you have confirmed key-based login works in a separate terminal. That first session is your escape hatch if something is misconfigured.

​
7. Enable the firewall

Allow SSH first, then turn on UFW.
Full details in Firewall.

​
8. Turn on automatic security updates

Set and forget:

​
9. Set the correct timezone

Logs and cron schedules are much easier to read when the clock matches yours.

​
10. Set a hostname

​
Done

You now have a hardened VPS with:
  • A non-root user with sudo.
  • Key-only SSH access.
  • Root login disabled.
  • A firewall blocking everything except SSH.
  • Automatic security patching.
From here, take a look at:
Take a backup right now, while your VPS is clean and configured the way you want it. Rolling back to “day one” is priceless when an experiment goes sideways.