What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Secure a new VPS before you publish its application: establish console recovery, patch the operating system, create and test a named administrator with SSH keys, restrict SSH, configure a deny-by-default firewall, keep the database private, leave AppArmor enabled, enable monitored security updates, and finish with HTTPS, logging, backups, and a recovery test. The same host controls apply whether the web tier is Apache (LAMP) or Nginx (LEMP).
Use this order: recover, patch, restrict, then publish
A fresh VPS is not secure merely because it has a new IP address. Automated scanners will find exposed SSH, database, and web services quickly. Hardening is safest when performed in an order that preserves a way back:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Confirm an out-of-band console or provider recovery path.
- Apply operating-system and security updates.
- Create and test named, key-based administration.
- Restrict SSH and enable a least-privilege sudo policy.
- Allow only required network ports at both the provider and host firewalls.
- Install the smallest required LAMP or LEMP stack.
- Constrain the application, PHP, and database.
- Verify AppArmor, HTTPS, logging, backups, and restoration.
Canonical’s Ubuntu guidance summarizes two principles that govern the entire procedure: “Regularly update your Ubuntu system to keep it protected from known vulnerabilities” and “Use and enforce the principle of least privilege.” Treat both as ongoing operating practices, not one-time setup tasks.
1. Preserve a recovery path before changing access
Do not begin by editing SSH or firewall rules over your only remote session. Sign in to the VPS provider’s web console, serial console, rescue environment, or equivalent out-of-band route and verify that it actually reaches the machine. Record the current public IP address, the SSH port you intend to retain, the console credentials, and the location of the provider’s emergency reset controls.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
- Keep the current SSH session open while testing every access change.
- Open a second session from another terminal or network and prove that it can log in before closing the first one.
- Write down how to disable a bad firewall rule or restore an SSH configuration from the console.
- Take a provider snapshot only if you understand its retention, encryption, and restoration behavior; a snapshot is not a substitute for independent backups.
If you lose both SSH and console access after a change, a carefully written hardening plan is no help. Recovery access is the prerequisite for every later step.
2. Patch Ubuntu before installing the stack
On an Ubuntu VPS, refresh package metadata and install all available updates before adding Apache, Nginx, PHP, or a database:
sudo apt update
sudo apt full-upgrade -y
sudo rebootReboot when the kernel or other core components require it. Reconnect through the second test session after the reboot and confirm the host name, IP address, disk space, and system time are correct.
Enable unattended security updates
Install Ubuntu’s update service and review its policy rather than assuming that “automatic updates” means unattended maintenance of every package:
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgradesUbuntu’s default policy uses configured APT origins that include Ubuntu security updates. Inspect the service and its logs after enabling it, and schedule an administrative review for failed runs, held packages, changed configuration files, and kernels waiting for a reboot. Automatic installation reduces the time a known vulnerability remains unpatched; it does not test application compatibility or perform your reboot and rollback decisions.
3. Create a named administrator and lock down SSH
Never make direct root login the normal administration workflow. Create a personal, named account, add it to the administrative group, and install a public key. The exact group name is sudo on Ubuntu:
Recommended Free Tools
sudo adduser adminname
sudo usermod -aG sudo adminnameReplace adminname with the account you will actually use. From your workstation, install the public key (for example with ssh-copy-id) or paste it into the account’s ~/.ssh/authorized_keys. The directory must be owned by the user and not writable by other users:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysOpen a new SSH session as the named user and run a harmless privileged command such as sudo -v. Do not continue until key authentication and sudo both work in that independent session.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Apply SSH policy only after testing
Use a dedicated drop-in such as /etc/ssh/sshd_config.d/60-hardening.conf so that local policy is visible and less likely to be overwritten. A common baseline is:
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yesValidate the syntax before reloading:
sudo sshd -t
sudo systemctl reload sshKeep the first session open and test a fresh key-based connection. If your environment requires password or keyboard-interactive authentication, do not disable it until an approved alternative is operating. If you use a nonstandard SSH port, record it and allow that port before enabling the firewall. Changing the port can reduce noise but is not an access-control measure; keys, policy, and patching are.
For larger teams, consider an AllowGroups or AllowUsers policy and individual keys rather than shared credentials. Remove departed users’ keys promptly. Grant additional sudo commands only when a documented operational need exists; avoid handing every service account unrestricted sudo.
4. Make the firewall an explicit allowlist
UFW is Ubuntu’s firewall frontend. Start with a deny-by-default incoming policy, permit outbound connections needed for updates and the application, add SSH first, and then expose web traffic only when the site is ready:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose
sudo ufw status numberedIf SSH uses another port, replace 22/tcp before enabling UFW. If administration should come only from a corporate or home address, narrow the rule, for example:
sudo ufw allow from 203.0.113.10 to any port 22 proto tcpUse sudo ufw delete <number> to remove an obsolete rule after checking the numbered status. Do not leave rules for FTP, database, control-panel, development, or monitoring services that the deployment does not require.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Open only these public ports in the normal web case
| Port | Purpose | Normal exposure |
|---|---|---|
| 22/tcp (or your documented SSH port) | Administrative SSH | Restricted to trusted source addresses when practical |
| 80/tcp | HTTP and certificate-validation or redirect traffic | Public only if the site needs it |
| 443/tcp | HTTPS | Public for a public website |
| 3306/tcp | MySQL or MariaDB | Not public for routine administration |
A provider security group or network ACL is a second enforcement layer, not a replacement for UFW. Apply the same allowlist there and remove stale rules in either layer. If a database must be reached from another server, permit only that private address or network and require database authentication and encryption; never open it to the whole internet for convenience.
5. Install only the LAMP or LEMP components you need
Choose the web server that matches your team’s configuration model and application requirements. Install the database and PHP components required by the application, not a broad bundle of modules you may never patch.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
| Decision point | LAMP (Apache) | LEMP (Nginx) |
|---|---|---|
| Web-server model | Apache virtual hosts, with per-directory controls where enabled | Nginx server blocks and explicit location rules |
| PHP integration | May use an Apache PHP module or PHP-FPM; choose one deliberately | Typically passes PHP requests to PHP-FPM over a Unix socket or private TCP endpoint |
| Static files and reverse proxy | Strong general-purpose module ecosystem | Efficient static-file serving and reverse-proxy configuration |
| Isolation and configuration | Separate virtual hosts, users, and permissions must be designed | Separate server blocks, FPM pools, users, and permissions must be designed |
| Logs | Usually under /var/log/apache2/, plus PHP-FPM and application logs |
Usually under /var/log/nginx/, plus PHP-FPM and application logs |
| Best choice | Teams familiar with Apache directives or applications that depend on them | Teams comfortable with Nginx routing and PHP-FPM |
Host-level controls—updates, least privilege, SSH, UFW, private database binding, AppArmor, TLS, monitoring, and backups—do not change when you choose Apache instead of Nginx.
Remove defaults and samples
After the intended virtual host or server block responds correctly, disable the distribution’s default site, remove sample applications, and uninstall modules that are not needed. Do not delete the default site before confirming that your replacement answers on the expected IP and host name; otherwise you can mistake a configuration problem for a firewall problem.
6. Protect the application and the PHP boundary
Run each application with a dedicated service identity rather than a shared, all-purpose web user. The document root should be readable by the web process but not broadly writable. A common arrangement gives the deployment account ownership of release files, grants the web process write access only to explicit upload, cache, or generated-content directories, and keeps secrets elsewhere.
- Store environment files, API keys, database passwords, and signing keys outside the document root.
- Set restrictive ownership and modes on secrets; no unrelated user should be able to read them.
- Disable directory listing and remove diagnostic files such as
phpinfo()pages. - Do not make the entire web root writable by Apache or Nginx merely to support uploads.
- Ensure the web process cannot traverse other users’ home directories or read their private SSH keys.
PHP-FPM controls
Assign an appropriate user and group to each PHP-FPM pool. Keep pool status and ping endpoints private, and expose them only to a local monitoring process or trusted administrative network. Review production values for upload limits, execution time, error display, and error logging; detailed errors belong in protected logs, not in responses sent to visitors. Make sure the Nginx or Apache configuration passes only intended script paths to PHP-FPM so that arbitrary files are not interpreted as PHP.
7. Harden MySQL or MariaDB
Run the database vendor’s hardening procedure after installation. Remove anonymous accounts, test databases, and unused accounts; set a strong administrative credential or use the distribution’s socket-authentication mechanism; and create an application-specific database user.
- Grant the application only the privileges it needs on its own schema.
- Do not use the database superuser in application configuration.
- Bind the service to localhost or a private interface unless remote access is an explicit requirement.
- When traffic leaves the host, configure and require encrypted database connections.
- Log and review failed authentication and unusual administrative activity.
Prefer a local Unix socket for a same-host application when the framework supports it. For remote administration, use a private network or an SSH tunnel rather than publishing port 3306. Back up the database separately from site files and perform a real restore test; a successful dump command alone does not prove that the backup can be used.
8. Keep AppArmor enabled and check its profiles
AppArmor is Ubuntu’s per-program mandatory access-control system. It limits the files and capabilities that profiled applications may use and is installed and loaded by default on Ubuntu. Check it after installing or changing Apache, Nginx, PHP, or the database:
sudo aa-status
sudo systemctl is-active apparmorUnexpected denials in the kernel or system logs can indicate either an attack or an application that needs a carefully bounded rule. Put local changes in the documented local-override locations instead of editing the vendor profile directly. Test a new profile in complain mode, review the events it generates, narrow the rules to the application’s actual needs, and switch to enforcing mode only after functional testing. Do not disable AppArmor globally to make a deployment work; fix the specific profile or file-layout conflict.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
9. Configure HTTPS and protect certificate keys
Obtain a certificate through an ACME-capable workflow or another trusted certificate process, install it in the correct virtual host or server block, and restrict the private-key file to the administrator and the service that must read it. The certificate can be public; the private key is a secret.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAn Nginx HTTPS server block can follow this pattern, with your actual certificate paths and host name:
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate www.example.com.crt;
ssl_certificate_key www.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
}Use the equivalent modern-protocol policy in an Apache SSL virtual host. After the certificate is working, redirect normal HTTP requests to HTTPS. Keep port 80 available only for the validation and redirect behavior your deployment requires. Monitor renewal dates and run a staging or dry-run renewal before the certificate approaches expiry. Verify that renewal updates the live service without making the private key readable by non-administrative users.
10. Log, detect, and limit repeated attacks
Know where each layer records events before an incident occurs. Review SSH authentication logs, Apache or Nginx access and error logs, PHP-FPM logs, database logs, AppArmor denials, UFW messages, and application audit logs. On Ubuntu, systemd’s journal is useful alongside service-specific files:
sudo journalctl -u ssh --since "24 hours ago"
sudo journalctl -u nginx --since "24 hours ago"
sudo journalctl -u apache2 --since "24 hours ago"
sudo journalctl -k | grep -i apparmorUse rate limiting or an intrusion-prevention tool when repeated authentication failures justify it, but treat that as a supplement to key-based SSH, patching, and the firewall. Send important logs to a separate system when possible so an attacker who gains local access cannot erase the only record. Set retention limits and protect log files from unauthorized modification.
Free tools Windows power users keep installed
One-click scans. No signup required.
11. Back up both data and the recovery procedure
Maintain encrypted, versioned backups of the database, uploaded files, application releases, configuration, certificate renewal material, and any data needed to rebuild the server. Keep at least one copy independent of the VPS provider. Document the order of restoration: provision a clean host, apply updates, restore secrets safely, restore the database, restore files, validate permissions, and bring the web service online.
Perform a scheduled restore to an isolated VPS or test environment. Confirm that the restored application can connect to the database, that uploads and scheduled jobs work, and that credentials can be rotated. Record the recovery-console URL and credentials in the same protected incident documentation; do not store them in the public web root or an unencrypted text file on the server.
12. Validate every control before launch
Use this launch gate after deployment and after major configuration changes:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Administration: a new session can log in with the intended SSH key; root login and password login follow your documented policy; sudo is limited to named administrators.
- Network exposure: UFW and the provider firewall expose only the retained SSH port and the HTTP/HTTPS ports the site needs.
- Listeners:
sudo ss -tulpnshows no unexpected public listener. - Database: MySQL or MariaDB is bound to localhost or a private interface and cannot be reached from the public internet.
- Application files: the web process can write only the upload or cache paths that require it and cannot read private keys, environment files, or another site’s files.
- Mandatory access control: AppArmor is loaded and the expected profiles are enforcing.
- Transport security: HTTP redirects as intended, HTTPS presents the correct certificate, obsolete protocol settings are absent, and renewal succeeds in a dry run.
- Updates: unattended-upgrades is active, its logs are reviewed, and you know which reboots require scheduling.
- Recovery: both database and file backups restore successfully and the out-of-band console works.
Test from outside the VPS network as well as from inside it. A service that appears closed locally may still be reachable through a provider security-group rule, and a service that works locally may be blocked by the provider layer.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →13. Operate the server after the first deployment
Daily or automated checks
- Watch failed update jobs, certificate-renewal timers, disk usage, and critical service health.
- Alert on repeated SSH failures, unexpected new listeners, AppArmor denials, and database authentication errors.
- Check that backups completed and that the backup destination is reachable.
Monthly or change-driven checks
- Review user accounts, SSH keys, sudo rules, firewall entries, provider security-group rules, and installed packages.
- Remove abandoned virtual hosts, DNS records, sample files, PHP modules, and service accounts.
- Run a restoration exercise and rotate credentials when staff, applications, or vendors change.
- Review application dependencies and PHP-FPM pool settings after upgrades.
Automatic patching is valuable, but maintenance still includes compatibility review, kernel reboot planning, package-configuration review, and recovery testing.
Common failure modes and safe fixes
SSH stops working immediately after firewall or configuration changes
Leave the original session open, use the provider console, run sshd -t, inspect UFW’s numbered rules, and restore the last known-good drop-in or allow rule. Only close the original session after a fresh key-based login succeeds.
The website returns a default page or a 502 error
First verify DNS and the selected virtual host or server block. Then check that the PHP-FPM socket path and pool service match the web-server configuration, that the application files are readable, and that AppArmor has not denied an intended path. Correct the smallest failing layer instead of disabling the firewall or AppArmor.
Certificate renewal fails
Confirm that DNS still points to the VPS, port 80 or the chosen validation method is reachable, the renewal timer is active, and the certificate and key paths are readable by the service. Run the renewal client’s dry-run procedure, inspect its logs, and reload the web server only after the new files are present.
A remote administrator needs database access
Do not respond by opening 3306 globally. Use a private network or an SSH tunnel, create a narrowly privileged database account, require encrypted connections when traffic leaves the host, and remove the access path when the task is complete.
What changes between LAMP and LEMP?
Apache and Nginx differ in configuration syntax, request routing, PHP integration, static-file handling, and the locations of their logs. Those differences affect how you isolate sites, define PHP execution, and troubleshoot a request. They do not alter the security baseline: patch the host, use named key-based administration, allowlist network access, keep the database private, enforce application and file permissions, retain AppArmor, protect TLS keys, monitor logs, and prove that backups restore.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
