VPS Security Checklist: 15 Linux Server Hardening Steps

A VPS security checklist helps you secure a virtual private server before it becomes exposed to unnecessary attacks. A fresh VPS should not be considered secure simply because it runs Linux. SSH access, open ports, outdated software, weak credentials, unnecessary services, and poorly configured applications can all increase its attack surface.

The most important linux server hardening steps include keeping the operating system updated, securing SSH, configuring a firewall, limiting user privileges, removing unnecessary services, protecting the control panel, monitoring logs, and maintaining reliable backups.

This guide provides a practical checklist to help you harden Linux server and reduce common security risks on a VPS.

What Should You Check in a VPS Security Checklist?

Before making individual changes, think about VPS security in layers.

This layered approach follows the broader principle behind the CIS Controls, which prioritize essential cyber hygiene such as secure configuration, account management, firewall management, and continuous security practices.

How Do You Secure a VPS Before Hardening Linux?

Start by identifying what is actually running on the server.

Do not change security settings blindly.

First determine:

• Which Linux distribution is installed
• Which version is running
• Which users have administrative access
• Which services are active
• Which ports are listening
• Which websites or applications are hosted
• Which control panel is installed
• Which ports must remain publicly accessible
• Where backups are stored

You can check the operating system with:

cat /etc/os-release

cat /etc/os-release

To see listening network services:

sudo ss -tulpn

sudo ss -tulpn

The goal is simple: know what needs to be exposed before you start closing things.

How Do You Harden a Linux Server With Security Updates?

Keeping the operating system and installed software updated is one of the most important linux server hardening steps.

Security updates often address vulnerabilities that attackers can use to compromise exposed systems.

On Ubuntu, security updates can be handled automatically through unattended-upgrades, which is included in current Ubuntu Server installations. Ubuntu documents automatic security updates as a standard security measure.

For a manual update on Ubuntu:

sudo apt update
sudo apt upgrade -y

sudo apt update
sudo apt upgrade -y

If your VPS uses AlmaLinux, Rocky Linux, Debian, or another distribution, use its appropriate package manager and update procedure.

Do You Need to Reboot After Security Updates?

Sometimes.

Kernel updates and certain library or service updates can require a restart before the new code is actually being used.

Ubuntu’s current documentation notes that some updates require services to restart and that a reboot can sometimes be required.

Before rebooting a production VPS, check whether the applications and services can tolerate the interruption.

How Do You Secure SSH on a VPS?

SSH is one of the most important areas to secure because it provides administrative access to your server.

A strong SSH configuration should include:

• SSH keys for administrative access
• Limited user privileges
• Disabled direct root login where practical
• Password authentication disabled after key access is confirmed
• Firewall restrictions
• Monitoring for failed login attempts

Ubuntu recommends using SSH for secure remote administration and supports configuration through /etc/ssh/sshd_config and configuration snippets in /etc/ssh/sshd_config.d/.

How Do You Use SSH Keys Instead of Passwords?

Generate a key pair on your trusted local computer:

ssh-keygen -t ed25519

ssh-keygen -t ed25519

Then copy the public key to the server using your preferred secure method.

After confirming that key-based login works in a separate SSH session, you can disable password authentication.

For OpenSSH configurations that use the standard setting:

PasswordAuthentication no

PasswordAuthentication no

Do not disable password authentication until you have confirmed that your SSH key works.

Otherwise, you can lock yourself out.

Should You Disable Root SSH Login?

For many production VPS environments, yes.

Instead, create a dedicated administrative account and give it controlled sudo access.

Ubuntu’s security guidance recommends least privilege and using non-root accounts for normal administration, reserving elevated privileges for administrative tasks.

A typical configuration is:

PermitRootLogin no

PermitRootLogin no

However, verify your provider’s recovery and console access before making this change.

Should You Change the SSH Port?

Changing SSH from port 22 can reduce automated noise from basic scanning, but it is not a substitute for authentication and firewall controls.

The important protections are:

• SSH keys
• Strong access control
• Firewall rules
• Limited users
• Monitoring
• Secure authentication

Do not treat a non-standard SSH port as your primary security measure.

If you change the SSH port, update your firewall rules before restarting SSH and keep an existing session open until the new connection has been tested.

How Do You Configure a VPS Firewall?

A firewall should expose only the ports that your server actually needs.

Ubuntu uses UFW as a simpler firewall management interface. Its documentation provides commands for enabling UFW, allowing ports, and reviewing firewall rules.

For a basic Ubuntu server:

sudo ufw status

sudo ufw status

To allow SSH:

sudo ufw allow 22/tcp

sudo ufw allow 22/tcp

To allow standard web traffic:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Then enable the firewall:

sudo ufw enable

sudo ufw enable

If your SSH service uses another port, replace 22 with that port.

Always allow your confirmed SSH port before enabling the firewall.

Otherwise, you can lose remote access.

Which VPS Ports Should You Keep Open?

There is no universal port list.

A web server commonly needs:

Your actual requirements depend on the services installed.

CyberPanel installations can require additional ports, including its panel port and mail, DNS, FTP, and web server ports. Its current installation documentation lists TCP 8090 for CyberPanel, TCP 80/443 and UDP 443 for the web server, plus additional service ports depending on the installation.

Do not open every port simply because an application supports it.

How Do You Remove Unnecessary Linux Services?

Every unnecessary service can add complexity and potentially increase the attack surface.

First list active services:

systemctl list-units --type=service --state=running

systemctl list-units --type=service --state=running

You can inspect a specific service with:

systemctl status service-name

systemctl status service-name

If you identify a service that is genuinely unnecessary, stop and disable it according to your distribution’s service-management procedure.

Do not disable a service simply because you do not recognize its name.

A hosting panel may depend on services that are not obvious from the application interface.

The goal is to remove unnecessary services without breaking required functionality.

How Do You Harden User Accounts on a VPS?

User accounts should follow the principle of least privilege.

Review the accounts on your VPS:

cat /etc/passwd

cat /etc/passwd

Review users with administrative privileges according to your distribution’s configuration.

Avoid sharing one administrative account among multiple people.

Use separate accounts when possible and grant only the permissions required for each role.

Also review:

• Old employee accounts
• Former contractors
• Unused SSH keys
• Sudo access
• Service accounts
• Shared credentials

CIS Controls specifically recommends restricting administrator privileges to dedicated administrator accounts and maintaining control over service accounts.

How Do You Secure an Open Source Control Panel?

A secure open source control panel still needs to be hardened.

Open source does not mean automatically secure, and a control panel should not be treated as a replacement for operating system security.

If you use CyberPanel, secure both:

Linux server → CyberPanel → Websites and applications

CyberPanel provides several security-related features, including firewall management, ModSecurity, SSH management, and two-factor authentication.

Enable Two-Factor Authentication

CyberPanel provides built-in 2FA for panel users. Its current documentation shows that users can enable 2FA through the user-management area and authenticate with a time-based code from an authenticator application.

2FA should be enabled for administrative accounts wherever supported.

Secure the CyberPanel Firewall

CyberPanel provides firewall management through its Security section.

Its documentation describes adding, deleting, starting, stopping, and reloading firewall rules from the panel.

Review the rules regularly and remove ports that are no longer required.

Use ModSecurity for Web Applications

If your hosting stack supports it, a web application firewall can add another layer between incoming HTTP requests and your application.

CyberPanel provides ModSecurity configuration through its security tools, including rule and audit settings.

A WAF should complement secure application configuration rather than replace it.

How Do You Secure Websites Hosted on a VPS?

Server hardening does not protect an outdated application automatically.

For every website:

• Keep the CMS updated
• Update plugins and themes
• Remove abandoned extensions
• Use HTTPS
• Restrict file permissions
• Remove unused applications
• Protect administrator accounts
• Review application logs
• Back up the website and database

For WordPress, do not install plugins simply because they claim to improve security.

Use a small number of trusted tools and keep them updated.

A compromised website can also become a path to other services on the same VPS, depending on the server configuration and account isolation.

How Do You Secure File and Directory Permissions?

Incorrect permissions can allow unauthorized users or applications to modify files they should only be able to read.

Review ownership and permissions for important application directories.

For example:

ls -la /var/www/

ls -la /var/www/

The correct permissions depend on your web server, PHP handler, hosting panel, and application.

Do not blindly run commands such as:

chmod -R 777

chmod -R 777

on a website.

World-writable permissions can create serious security problems.

Use the minimum permissions required for the application to operate.

How Do You Secure HTTPS on a VPS?

Use HTTPS for websites, control panels, APIs, and other services that transmit sensitive information.

A valid TLS certificate protects data in transit between clients and the server.

For websites hosted through CyberPanel, SSL certificates can be managed through its website management tools. CyberPanel’s documentation also provides SSL management and troubleshooting resources.

After enabling HTTPS:

• Redirect HTTP to HTTPS where appropriate
• Renew certificates automatically
• Remove insecure application URLs
• Check mixed content
• Keep TLS configuration maintained

HTTPS does not secure a compromised server. It protects communication between the client and server.

How Do You Protect a VPS From Brute-Force Attacks?

Brute-force attacks commonly target exposed authentication services such as SSH, FTP, mail, and control panels.

Your first defenses should be:

1. Strong authentication
2. SSH keys
3. Disabled unnecessary services
4. Firewall restrictions
5. Rate limiting or automated blocking where appropriate
6. Monitoring and alerting

Fail2Ban is one option for automatically responding to repeated failed authentication attempts. CyberPanel documents Fail2Ban as a tool that monitors logs and can block IP addresses that match configured attack patterns.

Do not rely on IP blocking alone.

Strong authentication remains essential.

How Do You Monitor a VPS for Security Problems?

Hardening is not a one-time task.

Monitor:

• Failed SSH logins
• New user accounts
• Unexpected processes
• New listening ports
• CPU spikes
• Memory usage
• Disk usage
• Authentication logs
• Web server logs
• Application errors
• Firewall events

For example, you can review recent authentication activity on many Linux systems with:

sudo journalctl -u ssh

sudo journalctl -u ssh

The exact service name can vary by distribution.

You should also periodically review listening services:

sudo ss -tulpn

sudo ss -tulpn

If a new service appears unexpectedly, investigate it.

How Do You Protect VPS Backups?

A backup is part of server security because it gives you a recovery option after ransomware, accidental deletion, configuration mistakes, or compromise.

Follow the 3-2-1 principle where practical:

• Keep at least three copies
• Use at least two different storage types
• Keep at least one copy away from the VPS

Do not keep your only backup on the same server.

If an attacker gains administrative access and deletes the VPS data, a local-only backup may disappear with it.

Also test restoration.

A backup that has never been restored is not a proven recovery plan.

How Often Should You Review a VPS Security Checklist?

Security settings should be reviewed whenever the server changes.

Review the VPS after:

• Installing new software
• Opening a new port
• Adding a website
• Installing a control panel
• Changing SSH settings
• Adding an administrator
• Changing firewall rules
• Upgrading the operating system
• Migrating applications
• Discovering a security incident

For ongoing maintenance, schedule periodic reviews of users, SSH keys, listening ports, firewall rules, software versions, and backups.

CIS Controls v8.1 emphasizes continuous management of secure configurations, accounts, software, and network controls rather than treating security as a one-time setup.

VPS Security Checklist: 15 Essential Checks

Use this checklist before considering a production VPS hardened.

This checklist covers the foundational controls that reduce common attack paths. More advanced environments may also require centralized logging, vulnerability management, intrusion detection, network segmentation, configuration management, and formal security monitoring.

What Are the Most Important Linux Server Hardening Steps?

If you have limited time, start with the controls that reduce the largest number of common risks:

1. Patch the server

Keep the operating system and installed software current.

2. Secure SSH

Use keys, limit administrative access, and disable direct root login where appropriate.

3. Configure the firewall

Expose only services that the server actually needs.

4. Remove unnecessary services

Reduce the attack surface by disabling software you do not need.

5. Protect administrative interfaces

Use 2FA, HTTPS, strong authentication, and restricted access where available.

6. Monitor the server

Review authentication activity, logs, ports, and unexpected changes.

7. Maintain tested backups

Make sure you can recover if security controls fail.

These controls align with the broader security principles of least privilege, secure configuration, firewall management, and ongoing maintenance reflected in Ubuntu guidance and CIS Controls.

What Should You Never Do When Hardening a VPS?

Avoid security changes that can lock you out or break essential services.

Do not:

• Disable SSH before testing your replacement access
• Enable a firewall without allowing your management port
• Disable services without checking dependencies
• Delete unknown system users
• Change file permissions recursively without understanding ownership
• Disable security updates without a replacement process
• Store the only backup on the same VPS
• Expose databases directly to the public internet without a specific need
• Assume changing the SSH port makes SSH secure
• Treat a control panel as a complete security solution

The safest hardening process is incremental.

Make one change, verify it, then continue.

Frequently Asked Questions

Final Thoughts

A VPS security checklist is most useful when it becomes part of your regular server maintenance instead of a one-time setup task.

Start with the fundamentals: update the operating system, secure SSH, limit privileges, configure the firewall, remove unnecessary services, protect the control panel, enable HTTPS and 2FA where appropriate, monitor logs, and maintain tested off-server backups.

If you need to harden a Linux server, work carefully and verify every change before moving to the next one. A secure configuration should reduce attack surface without accidentally removing the access or services your applications need.

For CyberPanel users, the control panel can simplify several security tasks, including firewall management, SSH management, ModSecurity, and two-factor authentication.

Use this checklist before exposing a new VPS to production, then review it whenever the server changes.