iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
A VPS is an Internet-facing server, so securing it requires more than changing an SSH port or installing a firewall. Protect the hosting account and administrator identities, expose only necessary services, patch and minimize the system, monitor both logins and outbound traffic, keep independent backups, and maintain a tested rebuild plan. This guide gives a platform-agnostic sequence that works across common Linux and Windows VPS deployments while identifying where provider or operating-system details change the implementation.
What VPS security is designed to prevent
Most VPS abuse starts with an exposed service, a stolen credential, an unpatched application, or a vulnerable website. Once an attacker gains access, the server may be used for brute-force attacks, malware hosting or distribution, phishing pages, spam, network scanning, cryptomining, or attacks launched with stolen credentials. A compromised website can also be altered to redirect visitors or deliver malware.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security is therefore a lifecycle rather than a single setting. NIST Special Publication 800-123 (2008) describes server security as access control, authentication, configuration management, maintenance, monitoring, incident response, and system integrity. CISA similarly calls architectural hardening a “defense-in-depth strategy,” combining segmentation, firewalls and access-control lists, protected centralized logging, current TLS, and removal of obsolete protocols such as SSH version 1.
- Prevent entry: strong identities, MFA, least privilege, patched software, and minimal exposure.
- Limit damage: service isolation, restrictive firewall and egress rules, protected secrets, and separate application accounts.
- Detect quickly: centralized logs, resource alerts, file-integrity signals, and outbound-traffic monitoring.
- Recover reliably: independent backups, restoration tests, and a documented rebuild and credential-rotation procedure.
Start with an inventory and threat model
Before changing access rules, record what exists. Keep the inventory in a protected location outside the VPS so an attacker cannot silently alter your source of truth.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Provider, account and control-panel identities, operating system and version.
- Public IPv4 and IPv6 addresses, domains, DNS records and certificates.
- Listening ports, daemons, containers, scheduled jobs, databases and deployment tools.
- Service and administrator accounts, SSH keys, API tokens and where each secret is used.
- Data types, retention obligations and any systems that connect to the VPS.
- Recovery console, rescue environment, snapshot process and the person authorized to use them.
For every service, answer three questions: must it be reachable from the public Internet, can it be limited to a private network or VPN, and what is the consequence if it is compromised? This threat model determines firewall rules and monitoring priorities. If you cannot explain why a port is open, treat it as a candidate for removal or restriction.
Lock down the provider account and administrator identities
Protect the control plane first
An attacker who takes over the hosting account can create new servers, alter firewall rules, read backups, or reset console access even when the VPS itself is well configured. Enable multi-factor authentication (MFA) on the provider account, billing account and control panel. Prefer a FIDO2/WebAuthn security key where the provider supports it; keep a second, separately stored recovery method and document the recovery process. Use unique passwords stored in a password manager, and review active sessions, API keys and recovery email addresses.
Recommended Free Tools
Use named administrators and least privilege
Create an individual administrator account for each person who needs access. Grant routine privileges through the operating system’s elevation mechanism (such as sudo) rather than sharing a root password. Remove departed users and unused service accounts, disable interactive login for accounts that only run software, and review group membership regularly. A named account makes an action attributable in logs and lets you revoke one person’s access without disrupting everyone else.
Move SSH to keys, then disable fallback access
Generate an individual SSH key pair on a trusted device, protect the private key with a passphrase, and install only the public key on the intended account. Never copy a private key to the VPS. Before disabling passwords, open a second session and verify that key authentication works; then verify that the provider console or rescue environment can still recover the machine if a rule is wrong.
After confirming recovery, disable direct root SSH login and password authentication in the SSH server configuration. Reload the service and test from a new terminal while keeping the verified session open. Do not rely on changing the SSH port: it may reduce background noise but is not an access control. Disable SSH version 1 and any obsolete ciphers or protocols supported by the daemon. Restrict SSH source addresses to a VPN, bastion, office range or other controlled network whenever practical.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Configuration names differ by distribution and SSH implementation. A safe workflow is:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Back up the current SSH configuration and record the console recovery path.
- Edit the daemon configuration to require public-key authentication, deny direct root login and remove obsolete protocol settings.
- Validate the configuration with the platform’s SSH test command before reloading.
- Reload the daemon, open a fresh session, and confirm both an allowed key and a deliberately rejected password behave as expected.
Reduce the network attack surface
Discover what is listening
Compare the inventory with the operating system’s actual listeners. On many Linux systems, ss -tulpn provides a starting point; Windows administrators can use the operating system’s equivalent socket and service tools. Map each listener to an owning process and configuration. Remove unused daemons, sample applications, public test endpoints, compilers and packages that are not required for the workload.
Apply default-deny firewall rules
Configure a host firewall with a default-deny inbound policy. Allow only the ports required for the application, normally HTTPS and a restricted management path. Permit database, cache, orchestration and administrative ports only from the specific private networks or hosts that need them. Apply equivalent rules to IPv4 and IPv6; protecting only the IPv4 address leaves an IPv6 route exposed when the provider enables it.
Use the provider’s network firewall or ACL as an additional layer where available, but keep a host firewall because provider controls may not follow workloads inside the server. Before enforcing a deny rule, allow your current management source and confirm console access. Keep a documented change path for emergency rollback.
Control outbound traffic as well as inbound traffic
Attackers often use a compromised VPS to scan, send spam, contact command-and-control systems or mine cryptocurrency. Egress filtering can limit which destinations and ports each service may use. At minimum, alert on new high-volume outbound connections, unexpected protocols, connections to many unrelated addresses, and traffic that begins after a new process or scheduled job appears. Blocking all outbound traffic can break updates, DNS, certificate renewal and application integrations, so implement it service by service.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Patch and minimize the operating system and applications
Enable a defined maintenance schedule or controlled automatic security updates for the operating system, kernel, web server, language runtime, database, containers and management tools. Prioritize high-severity vulnerabilities and components reachable from the Internet. Subscribe to security advisories for the distributions and software you actually run, and record exceptions when an update must wait for compatibility testing.
Minimization is as important as patching. Remove unused packages, daemons, sample sites, development tools and public diagnostics. Pin or verify trusted third-party dependencies, validate package signatures where supported, and prevent applications from downloading arbitrary executable code. Reboot when a kernel or other update requires it, then verify that every expected service returned and that firewall rules persisted.
Use a maintenance checklist that records the update date, changed versions, test result and rollback plan. A server that cannot be rebuilt from documented configuration is difficult to patch safely; keep deployment definitions and configuration backups outside the host.
Harden applications, secrets and data paths
Separate applications from the operating system
Run each application as its own unprivileged user. Separate web, worker, database and deployment identities, and deny write access to code and configuration wherever the process does not need it. Containers or service managers can add boundaries, but they do not replace host patching or least privilege.
Protect secrets
Keep passwords, API tokens, signing keys and database credentials out of source repositories, images, command histories and world-readable files. Use a permissions-controlled secret store or environment mechanism appropriate to the deployment, rotate credentials when staff or systems change, and revoke tokens that are no longer needed. Ensure backups receive the same protection as live secrets.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use secure transport and application controls
Use currently supported TLS versions and renew certificates before expiry. Place public applications behind a correctly configured reverse proxy when that provides rate limiting, request-size controls or clearer isolation. Validate input, enforce authorization on every sensitive action, limit login and expensive endpoints, and prevent file-upload paths from executing uploaded content. Application logs should include enough context to investigate abuse without recording passwords, tokens or unnecessary personal data.
Monitor for compromise and abuse
Collect SSH and other authentication logs, firewall decisions, web and application events, database activity, system messages and outbound-network telemetry. Send copies to protected centralized storage or a separate logging account so an intruder cannot erase the only record. Restrict access to logs and synchronize server time; inconsistent timestamps make incident reconstruction unreliable.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Alerts worth acting on
- Repeated failed logins, impossible travel or authentication from an unrecognized source.
- Creation of a new privileged account, unexpected group membership or a changed SSH key.
- Modified binaries, startup files, firewall rules, TLS configuration or scheduled jobs.
- Processes consuming sustained CPU, memory or network bandwidth, especially mining-like patterns.
- New phishing or malware files, unexpected web shells, redirects or bulk email activity.
- Outbound connections to unusual destinations, scanning behavior or a sudden increase in connection count.
A brute-force control such as fail2ban or an equivalent can temporarily block repeated failures, but it complements rather than replaces MFA, key-based access and source restriction. Tune thresholds to avoid locking out legitimate administrators and monitor the blocker itself.
Back up data and rehearse recovery
Back up application data, databases, configuration, certificates, deployment definitions and the information needed to recreate the server. Encrypt backups in transit and at rest, keep them outside the VPS account or storage cluster, and retain at least one offline or independently controlled copy. A provider snapshot is not automatically an independent backup: verify where it is stored, who can delete it, how long it is retained and whether restoration works to a clean environment.
Set a retention schedule that matches the data’s value and recovery-point objective. Test restoration on a separate instance, not only by checking that a backup job reports success. Record the time to rebuild, restore and validate the application, and update the procedure whenever deployment or firewall rules change. CISA’s ransomware guidance summarizes the operational principle as: “Backup data often; offline or leverage cloud-to-cloud backups.”
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Keep a rebuild runbook
- Provision a clean instance with the required operating-system version and network rules.
- Apply updates, create named administrators, install only required packages and restore secrets through the approved process.
- Restore data from a known-good backup and verify file ownership, permissions, database consistency and application integrity.
- Rotate passwords, API tokens, certificates and SSH keys that may have been present on the old host.
- Run functional, security and monitoring checks before directing production traffic to the rebuilt service.
Respond to an abuse complaint or suspected compromise
Treat a provider notice, unexplained resource spike, unfamiliar process or suspicious outbound traffic as an incident until disproved. Do not simply delete the reported file and continue operating; persistence may remain elsewhere.
- Contain: isolate the affected service or host, restrict ingress and egress, or suspend the compromised account. Preserve a safe management path and avoid actions that destroy evidence.
- Preserve evidence: copy relevant authentication, firewall, web, system and application logs to protected storage. Record times, observed indicators, commands run and people involved.
- Notify the provider: acknowledge the notice, state the containment action and request the timestamps, destination addresses, ports and sample traffic they observed. Follow the provider’s acceptable-use and incident procedures.
- Rotate from a clean device: change provider passwords, API tokens, application secrets, database credentials and SSH keys. Revoke sessions and keys that cannot be trusted.
- Rebuild or restore: use a known-good image or backup rather than trusting a host where root-level compromise is possible. Patch the exploited component before reconnecting it.
- Validate and monitor: check accounts, binaries, scheduled jobs, firewall rules, dependencies and outbound traffic; then watch closely after reactivation.
If legal, contractual or privacy obligations apply, preserve evidence and involve the appropriate incident-response or legal contact before wiping systems. Keep a post-incident record of the entry point, affected data, missed control and corrective action.
Choose a provider using security controls, not marketing labels
Responsibility is divided between you and the provider. One provider’s documentation, for example, states that customers configure the firewall, apply updates and provide their own monitoring, while native backups remain on the same storage cluster. Treat those statements as a reminder to verify every provider’s actual boundaries rather than assuming “managed” includes all controls.
| Area | Questions to verify before deployment |
|---|---|
| Network defense | What upstream DDoS mitigation, traffic filtering, network firewall, ACL and private-network features are included? Can rules cover IPv4 and IPv6? |
| Administrative access | Is there console or recovery access if SSH is locked out? Are MFA, hardware security keys and SSH-key injection supported? |
| Backups | Are backups isolated from the VPS account and storage cluster? What are encryption, retention, deletion protection and restoration-testing options? |
| Monitoring | What host, network and availability alerts exist, and can logs be exported to an independent system? |
| Abuse response | How are notices delivered, what evidence is supplied, and what escalation or suspension process applies? |
| Operations | Who patches the host and platform, how are maintenance windows communicated, and what incident support is available? |
| Location and terms | Which data-center geographies are available, what security commitments apply, and what does the acceptable-use policy prohibit? |
CIS Controls v8 contains seven safeguards in Control 15, Service Provider Management. That is a framework count, not a probability that a VPS will be abused; no authoritative universal percentage exists for the risk of abuse of a generic VPS.
Quick Recap
A practical ongoing schedule
| Cadence | Tasks |
|---|---|
| Every day or on each deployment | Review high-priority authentication and outbound alerts; confirm critical services and backups completed; inspect changes to privileged accounts and keys. |
| Weekly | Review listening ports, firewall and IPv6 rules, scheduled jobs, package updates, resource usage and unusual web activity. |
| Monthly | Apply and document updates, remove unused software and accounts, review provider sessions and API keys, test a representative restore, and verify certificate expiry dates. |
| Quarterly or after major change | Exercise the rebuild runbook, rotate selected credentials, review provider terms and recovery-console access, test alert delivery, and reassess which services truly need public exposure. |
Common mistakes that leave a VPS exposed
- Disabling root or password login before testing recovery: keep a verified console or rescue path and a second key session before enforcing the change.
- Opening broad firewall ranges “temporarily”: use a named source restriction and an expiry date, then remove the exception.
- Securing IPv4 but forgetting IPv6: audit both address families whenever a rule or service changes.
- Assuming fail2ban is authentication: it slows repeated attempts; it does not replace MFA, keys or least privilege.
- Treating a snapshot as an independent backup: confirm storage separation and perform a real restore.
- Only watching inbound attacks: monitor egress, process behavior and resource use because a compromised host is often used to attack others.
- Keeping a “temporary” test endpoint: remove it or restrict it before production traffic reaches the server.
- Changing the SSH port as the main defense: obscurity does not fix weak authentication or an exposed service.
Minimum viable hardening checklist
- Provider account and control panel protected by MFA, preferably a supported FIDO2/WebAuthn key.
- Named administrator accounts, least privilege, passphrase-protected SSH keys and no shared credentials.
- Direct root SSH login and password authentication disabled only after recovery testing.
- Default-deny firewall with only required services exposed and matching IPv4/IPv6 rules.
- Unused packages, daemons, test endpoints and accounts removed.
- Operating system, applications and dependencies patched on a documented schedule.
- Applications isolated under unprivileged users; secrets protected and TLS kept current.
- Authentication, system, firewall, application and outbound-network logs centralized and protected.
- Encrypted backups stored independently, with restoration and rebuild procedures tested.
- Incident contacts, provider abuse procedures and credential-rotation steps written down.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
