How to Keep Your VPS Secure: A Beginner's Guide

Setting up a server for the first time is exciting, but a lot of people forget that a fresh VPS is basically an open door until you lock it down. Attackers scan the internet constantly, looking for machines with weak passwords, outdated software, or default settings that nobody bothered to change. Most of the time this has nothing to do with someone targeting you personally. It is an automated script working through thousands of servers a day, looking for the easy ones.

The good news is that securing a server does not require years of experience. Most of the damage is prevented by a handful of habits and a few configuration changes. This guide covers two layers of protection. The first is common sense, the everyday habits that keep you safe regardless of what operating system you run. The second is technical hardening, the actual settings and tools you configure on your server. We will walk through both Linux (Debian, Ubuntu, AlmaLinux, and Rocky Linux) and Windows Server 2025, since the steps differ a bit depending on your platform.

Part 1: Common Sense Security

Before touching any configuration file, there are habits that matter more than any firewall rule.

Use strong, unique passwords

Never reuse a password from another account for your server or hosting panel. A password manager such as Bitwarden or KeePass makes this painless, since you only need to remember one master password. Aim for at least sixteen characters, mixing letters, numbers, and symbols.

Keep backups, and actually test them

A backup you have never restored is not really a backup. Set up automatic backups of your important data and configuration files, keep at least one copy somewhere other than the server itself, and try restoring from it every so often to confirm it actually works.

Only install what you need

Every extra package, plugin, or service running on your server is one more thing that could have a vulnerability. If you are not using it, remove it or turn it off.

Know who has access

Keep track of every person who has login details, SSH keys, or RDP access to your server. When someone no longer needs access, revoke it the same day, not next week.

Be careful with links and attachments

If you manage your server through email notifications or a web based control panel, treat unexpected login prompts or password reset emails with suspicion. Phishing is still one of the most common ways servers get compromised, simply because the attacker asks for the password instead of guessing it.

Watch your resource usage and billing

A sudden spike in bandwidth or CPU usage, or a bill that is unexpectedly high, can be one of the first signs that something on your server has been compromised and is quietly mining cryptocurrency or sending spam.

Part 2: Core Security Principles

These ideas apply no matter which operating system you run.

Least privilege. Give every user and application only the access it actually needs, nothing more. An account that only needs to read files should not also be able to write to them.

Defense in depth. Do not rely on a single protection. A firewall combined with SSH keys, fail2ban, and regular updates is far stronger than any one of those alone.

Keep everything updated. Most successful attacks target known vulnerabilities that were already patched months earlier. Updating your operating system and software regularly closes those doors.

Check your logs. Your server keeps a record of login attempts, errors, and system events. Looking at these occasionally helps you catch problems early, before they turn into disasters.

Part 3: Securing Linux Servers (Debian, Ubuntu, AlmaLinux, Rocky Linux)

Debian and Ubuntu use the APT package manager, while AlmaLinux and Rocky Linux, both built on Red Hat Enterprise Linux, use DNF. The commands differ slightly, but the ideas behind them are identical across all four, and the same DNF based steps apply to most other RHEL based distributions too.

Step 1: Update your system

On Debian or Ubuntu:

bash

sudo apt update && sudo apt upgrade -y

On AlmaLinux or Rocky Linux:

bash

sudo dnf update -y

Do this before anything else, and repeat it regularly.

Step 2: Create a separate user account

Logging in as root for daily tasks is risky, since any mistake or compromised command runs with full system privileges. Create a separate account instead.

On Debian or Ubuntu:

bash

sudo adduser yourusername
sudo usermod -aG sudo yourusername

On AlmaLinux or Rocky Linux:

bash

sudo adduser yourusername
sudo passwd yourusername
sudo usermod -aG wheel yourusername

From now on, log in with this account and use sudo only when you need elevated permissions.

Step 3: Set up SSH key authentication

Passwords can be guessed or brute forced. SSH keys are far harder to break. On your own computer, not the server, generate a key pair:

bash

ssh-keygen -t ed25519 -C "[email protected]"

Then copy the public key to your server:

bash

ssh-copy-id yourusername@your_server_ip

Step 4: Disable password login and root login over SSH

Open the SSH configuration file:

bash

sudo nano /etc/ssh/sshd_config

Find these lines and set them as shown:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Save the file, then restart SSH. On Debian or Ubuntu:

bash

sudo systemctl restart ssh

On AlmaLinux or Rocky Linux:

bash

sudo systemctl restart sshd

Keep your current session open and test logging in from a new terminal window first, so you are not locked out if something was typed wrong.

Step 5 (optional): Change the default SSH port

Moving the port from 22 to something less common, for example 2222, will not stop a determined attacker, but it does cut down the constant automated scanning noise your server receives. In the same file, change:

Port 2222

If you are on AlmaLinux or Rocky Linux, SELinux will block the new port unless you tell it about the change first:

bash

sudo dnf install policycoreutils-python-utils -y
sudo semanage port -a -t ssh_port_t -p tcp 2222

Whichever distribution you use, allow the new port through your firewall before restarting SSH, or you may lock yourself out.

Step 6: Set up a firewall

On Debian or Ubuntu, UFW is the simplest option:

bash

sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw enable

If you changed your SSH port, allow that number instead, for example sudo ufw allow 2222/tcp.

On AlmaLinux or Rocky Linux, firewalld is included by default:

bash

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

If you changed the port, add it directly instead: sudo firewall-cmd --permanent --add-port=2222/tcp. Only open the ports your server actually needs, such as 80 and 443 for a website.

Step 7: Install Fail2ban

Fail2ban watches your logs and temporarily bans IP addresses that fail login attempts repeatedly.

On Debian or Ubuntu:

bash

sudo apt install fail2ban -y

On AlmaLinux or Rocky Linux, you will need the EPEL repository first:

bash

sudo dnf install epel-release -y
sudo dnf install fail2ban -y

Then enable it on either system:

bash

sudo systemctl enable --now fail2ban

Step 8: Enable automatic security updates

On Debian or Ubuntu:

bash

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

On AlmaLinux or Rocky Linux:

bash

sudo dnf install dnf-automatic -y
sudo systemctl enable --now dnf-automatic.timer

By default this only downloads updates without installing them. Open /etc/dnf/automatic.conf and set apply_updates to yes if you also want them installed automatically.

Step 9: Review and disable unused services

See what is currently enabled:

bash

systemctl list-unit-files --state=enabled

Disable anything you do not recognize or use:

bash

sudo systemctl disable --now service_name

Part 4: Securing Windows Server 2025

Windows Server 2025 already ships with a stronger baseline than earlier versions. Credential Guard, which helps protect stored credentials from certain theft techniques, is turned on by default on supported hardware, and the operating system now includes OpenSSH out of the box. Still, plenty of settings are left up to you to configure.

Step 1: Create a new administrator account and rename or disable the default one

Everyone knows the built in Administrator account exists, which makes it a common target. Open PowerShell as administrator and create a new account:

powershell

New-LocalUser "yournewadmin" -Password (Read-Host -AsSecureString "Enter password")
Add-LocalGroupMember -Group "Administrators" -Member "yournewadmin"

Then rename or disable the original account:

powershell

Rename-LocalUser -Name "Administrator" -NewName "somethingelse"

powershell

Disable-LocalUser -Name "Administrator"

Step 2: Set an account lockout policy

This locks an account after a number of failed login attempts, which slows down brute force attacks. Run secpol.msc, then go to Account Policies, Account Lockout Policy, and set a lockout threshold of around five attempts.

Step 3: Consider using built in OpenSSH instead of RDP

Since Windows Server 2025 includes OpenSSH server support natively, you can manage your server over SSH with key based login, the same way you would on Linux, instead of relying only on RDP. Install it from Server Manager under Add Roles and Features, or with PowerShell:

powershell

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

The installer usually creates a matching firewall rule automatically, but it is worth checking in Windows Defender Firewall that a rule for the OpenSSH server exists and is enabled.

Step 4: Secure Remote Desktop if you still use it

RDP is one of the most attacked services on the internet, so this step matters a lot if you keep it enabled.

First, turn on Network Level Authentication. Open System Properties, go to the Remote tab, and check the box for allowing connections only from computers running Remote Desktop with Network Level Authentication.

Second, avoid exposing RDP directly to the internet if you can help it. A VPN, a bastion host, or Windows Admin Center are safer ways to reach your server, with RDP itself only reachable from trusted addresses through your firewall. If you must expose it directly, at least restrict the allowed source addresses in Windows Defender Firewall with Advanced Security (wf.msc), under the inbound rule for RDP.

Step 5: Configure Windows Firewall and trim unused services

Open Windows Defender Firewall with Advanced Security (wf.msc) and review your inbound rules. Block anything you do not recognize, and only allow the ports your applications actually require.

While you are at it, look at what is running that you do not need. Print Spooler and Remote Registry are two classic examples that are enabled by default on Windows Server 2025 even though most VPS setups never use them, and both have a long history of security issues. If your server is not acting as a print server, you can turn them off:

powershell

Stop-Service -Name Spooler
Set-Service -Name Spooler -StartupType Disabled
Stop-Service -Name RemoteRegistry
Set-Service -Name RemoteRegistry -StartupType Disabled

Step 6: Keep Windows Update turned on

Go to Settings, then Windows Update, and confirm automatic updates are enabled. Windows Server 2025 also supports hotpatching through Azure Arc, which installs many security updates without a full restart. If your server is connected to Azure Arc, it is worth checking whether hotpatching is available for your subscription, since it cuts down on maintenance downtime considerably.

Step 7: Check Windows Defender

Open Windows Security and confirm real time protection is turned on. For a production workload, Microsoft Defender for Endpoint gives more visibility into threats across the server than the built in tools alone.

Step 8: Turn on BitLocker if physical security matters

If your server hardware could be physically accessed by someone else, for example in a shared data center, BitLocker encrypts the disk so the data cannot be read without the key. BitLocker is not installed by default on Windows Server, so add the feature first:

powershell

Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools

Restart, then enable it:

powershell

Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256

A TPM chip makes this much simpler. Without one, you will need extra Group Policy configuration to allow a different type of protector.

Step 9: Review your logs

Open Event Viewer and check the Security log occasionally for repeated failed logon attempts, which show up as Event ID 4625. A large number of these coming from one address is a sign someone is trying to guess passwords.

Part 5: A Quick Ongoing Checklist

Security is not a one time setup, it is a routine. Roughly once a month, try to do the following.

Check for and install updates on your server.

Review who currently has access and remove anyone who should not.

Look through your logs for anything unusual.

Confirm your backups are still running and still restorable.

Review your firewall rules to make sure nothing was opened that should not have been.

Final Thoughts

None of this needs to be perfect on day one. Start with the basics, strong passwords, SSH keys or a proper admin account, a firewall, and regular updates, then build from there over time. A server that follows even half of this guide is already far ahead of the countless machines online that were never secured at all.

How to keep your VPS secure

How to Keep Your VPS Secure: A Beginner's Guide

Part 1: Common Sense Security

Use strong, unique passwords

Keep backups, and actually test them

Only install what you need

Know who has access

Be careful with links and attachments

Watch your resource usage and billing

Part 2: Core Security Principles

Part 3: Securing Linux Servers (Debian, Ubuntu, AlmaLinux, Rocky Linux)

Step 1: Update your system

Step 2: Create a separate user account

Step 3: Set up SSH key authentication

Step 4: Disable password login and root login over SSH

Step 5 (optional): Change the default SSH port

Step 6: Set up a firewall

Step 7: Install Fail2ban

Step 8: Enable automatic security updates

Step 9: Review and disable unused services

Part 4: Securing Windows Server 2025

Step 1: Create a new administrator account and rename or disable the default one

Step 2: Set an account lockout policy

Step 3: Consider using built in OpenSSH instead of RDP

Step 4: Secure Remote Desktop if you still use it

Step 5: Configure Windows Firewall and trim unused services

Step 6: Keep Windows Update turned on

Step 7: Check Windows Defender

Step 8: Turn on BitLocker if physical security matters

Step 9: Review your logs

Part 5: A Quick Ongoing Checklist

Final Thoughts