A practical VPS hardening checklist
Plan SSH access, updates, least privilege, firewall rules and tested backups for a self-managed Linux VPS.
What should I secure after receiving a Linux VPS?
Secure access without locking yourself out
Use an SSH key and limit administrative access. Test a second connection and your recovery route before changing login rules or firewall settings. Where compatible with your setup, disable password-based administrative access after key access works. Keep credentials out of public repositories.
Maintain a small, updated service
Apply operating-system and application security updates, remove unused services and give application users only the permissions they need. Restrict database and administrative ports to the intended clients. Check logs and alerts for your own applications rather than assuming a hosting location makes them safe.
Prove that recovery works
Keep encrypted backups separately from the instance and test restoration. For GHOST, ensure the workload can be rebuilt without local persistent state. A snapshot alone may share risks with the live server. The CISA ransomware guide recommends offline encrypted backups and restoration testing.
Further reading
CISA infrastructure-hardening advisory covers public-key administrative authentication and updates in its network-infrastructure context. Apply guidance to the operating system and access method you actually use.