Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A secure Linux VPS is built in layers: inventory and recovery access, timely patching, least-privilege accounts, hardened SSH, a deny-by-default firewall, correctly configured HTTPS, confinement, monitoring, and tested recovery. Complete the checklist below before putting a web service on the public Internet, then repeat the verification steps after every material change.
What this checklist covers—and what it does not
This guide is for owners of self-managed Debian- or Ubuntu-style Linux VPSs running web services. It addresses the operating system, remote administration, network exposure, web-server baseline, logging, and recovery. It is not a penetration test or a substitute for application, PHP, container, database, cloud-provider, or regulatory-specific security reviews. Those components have their own attack surfaces and hardening requirements.
A public VPS should be treated as continuously exposed. The current 2026 VPS baseline identifies automated scans and authentication attempts, unpatched services and dependencies, stolen SSH keys or API tokens, accidentally published Docker ports, privilege escalation after an application compromise, deletion or encryption of reachable data and backups, log destruction by an administrator-level attacker, and human error during updates or network changes as realistic failure modes.
1. Create an inventory and a recovery path first
Do not begin by changing SSH or firewall settings from your only remote session. First make sure you can reach the provider console, serial console, rescue environment, or another out-of-band control plane. Keep that route open while testing every access change.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Record the baseline
- Distribution name, release, kernel version, architecture, and support status.
- Public IP addresses, DNS names, IPv4/IPv6 records, and provider-level firewall rules.
- Listening sockets and owning processes. On a systemd host,
ss -tulpnprovides a useful snapshot. - Web server, runtime, application, database, container-engine, and monitoring versions.
- Enabled systemd services, scheduled jobs, containers, bind mounts, and data paths.
- Privileged accounts, sudo rules, SSH keys, API credentials, and service users.
- Locations of configuration files, uploads, databases, certificates, private keys, and backups.
Save the inventory outside the VPS and date it. Repeat it after installing a web stack, enabling a container, or changing provider networking. An unexpected new listener or service is then detectable rather than invisible.
2. Keep the operating system and vulnerability process current
Understand the support window
Canonical states that a standard Ubuntu LTS release receives security support for packages in the Main repository for five years. Ubuntu Pro extends support to ten years and adds patching for medium-, high-, and critical-severity vulnerabilities in the Universe repository. Confirm which release and subscription state your VPS actually has; do not assume that an LTS label means every package is covered for the same period.
Apply and observe updates
- Review configured repositories and remove stale or untrusted sources. Third-party repositories require explicit configuration and should be treated as additional supply-chain risk.
- Run normal package updates during a maintenance window and inspect the resulting service changes.
- Enable the distribution’s unattended-upgrades mechanism where appropriate.
- Check
/var/log/unattended-upgradesand your central logging destination for successes, failures, held packages, and repository errors. - Define who receives update alerts and what happens when a security update cannot be installed.
Ubuntu’s current documentation says supported installations install security updates by default after 24 hours and normal updates after seven days. Treat those as default delays, not proof that your host is updating: repository failures, held packages, disabled timers, and unsupported releases can stop the process.
Plan for reboots
Kernel and library updates can require a reboot. Automatic rebooting is configurable, but Ubuntu warns that it can be disruptive. Decide whether your application can tolerate an unattended restart, schedule reboots for a defined window when it cannot, and verify service health afterward. Record the last boot time and kernel so an emergency update does not leave you guessing which code is running.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Track vulnerabilities in installed packages
Use Ubuntu Security Notices and the Ubuntu CVE Tracker to determine whether a vulnerability affects packages you run and whether a fix has been released. Prioritize internet-facing services, authentication components, kernels, runtimes, and libraries reachable by the web application. Keep an exception record for packages that cannot be updated immediately, including compensating controls and a deadline.
3. Build named, least-privilege administration
Ubuntu Server guidance explicitly recommends the principle of least privilege: each person and service should have only the permissions required for its task. Avoid shared administrator logins because they destroy accountability and make key rotation difficult.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Create and test a named account
- Create an individual administrative account and grant only the sudo commands that role needs. Avoid granting unrestricted sudo to an application or deployment account.
- Install a unique SSH public key for that account and test it from a second terminal before altering existing access.
- Confirm that the account can perform required recovery tasks without logging in as root.
- Document an emergency account and its storage location, then protect its key separately.
After the new path is proven, disable direct root login and SSH password authentication. Keep the provider console available in case a key, sudo rule, or firewall change is wrong. Removing a changed SSH port from a checklist does not make a host secure; authentication strength, patching, and network restriction matter more.
Restrict where SSH can come from
At the provider firewall and on the host firewall, allow SSH only from a trusted office range, management network, or VPN when feasible. If a changing home address makes that impractical, use a VPN or another controlled access gateway rather than opening SSH broadly. Rate-control tools such as Fail2ban can be useful for some services, but the 2026 VPS baseline treats them as risk-dependent, not mandatory on every host.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
4. Enforce a deny-by-default network policy
Use the provider firewall and the VPS firewall as separate layers. Ubuntu identifies UFW as its common firewall wrapper and recommends a firewall for server deployments. Start by listing required flows, then permit only those flows.
Typical public web-server policy
| Port or flow | Exposure decision | Reason and control |
|---|---|---|
| HTTP (usually TCP 80) | Open only if needed for an HTTP-to-HTTPS redirect or an ACME challenge | Do not serve sensitive content over cleartext. |
| HTTPS (usually TCP 443) | Open to the Internet for a public site | Terminate TLS and monitor certificate renewal. |
| SSH (usually TCP 22) | Restrict to a trusted source range or VPN | Never rely on changing the port as the primary defense. |
| Database, cache, metrics, admin, Docker API | Keep private unless a documented design requires exposure | Use private networking, authentication, and compensating controls. |
| DNS, monitoring, or VPN ports | Open only when the service is intentionally provided | Limit sources and document the purpose. |
After installing Nginx, Apache, a container stack, or a monitoring agent, run a new listening-socket inventory. Container port publishing can bypass assumptions made in the initial firewall plan. Never expose a database, control panel, metrics endpoint, or Docker API merely because a package’s default configuration makes it convenient.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →5. Harden the web server and TLS deployment
Make HTTPS complete, not cosmetic
TLS provides privacy, integrity, and authenticity only when certificates, hostname coverage, and renewal are correct. Obtain a certificate for every public hostname, redirect HTTP to HTTPS where appropriate, automate renewal, and alert before expiry. Test renewal rather than waiting for the first failed renewal to reveal a permissions or DNS problem.
Review version-specific web-server behavior
Do not copy a generic Nginx or Apache snippet without checking your installed version and application architecture. Review:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Server identification and unnecessary version disclosure.
- Request-size, header, body, and timeout limits that prevent resource exhaustion without breaking legitimate uploads.
- Directory listing and unintended static-file exposure.
- Upload directories, temporary paths, and executable-file handling.
- Reverse-proxy headers, trusted proxy addresses, and preservation of the original scheme and host.
- Access permissions on document roots, sockets, logs, and deployment directories.
Separate service identities and secrets
Run the web server, application runtime, workers, and database with separate service users where practical. Keep API keys, database passwords, signing keys, and certificate private keys outside the document root. Make writable directories as narrow as possible; an upload directory should not also be an executable application directory. Review PHP, container, and database settings as separate hardening work rather than assuming an operating-system checklist covers them.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match6. Reduce privilege with confinement and a smaller footprint
Keep AppArmor enabled where supported and review profiles for the web server, SSH daemon, and application processes. AppArmor denials are useful evidence: investigate whether a rule reflects an attack, a broken deployment, or an intentional behavior that needs a narrowly scoped profile adjustment.
Remove avoidable attack surface
- Uninstall unused packages and disable services that are not required.
- Do not download untrusted
.debfiles or install software without verifying its source and update path. - Review file ownership and permissions after deployments, restores, and container volume changes.
- Avoid dangerous
sysctlvalues copied from unrelated guides. Validate each setting against your kernel, workload, and provider network. - Use Ubuntu Security Guide when you need an auditable starting point for customized CIS Benchmark or DISA-STIG profiles.
Ubuntu’s hardening guidance specifically calls out unnecessary open ports, disabling AppArmor, dangerous sysctls, and untrusted package downloads as common mistakes. A control that cannot be explained, monitored, and reversed is not a reliable hardening control.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Make logs and alerts independent of the server
Retain authentication, sudo, firewall, web access and error, package, system, and application logs. Forward important records to an independent destination. An attacker who gains administrator access can delete or alter local evidence, so local files alone are not an incident record.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Alert on signals that require action
- Repeated authentication failures, successful logins from unusual sources, and changes to SSH keys.
- New sudo privileges, unexpected privileged commands, or changes to administrator accounts.
- New listening ports, altered firewall rules, or newly published container ports.
- Certificate-expiry windows and failed renewal attempts.
- Disk exhaustion, failed package updates, reboot loops, and stopped services.
- Unexpected process, binary, configuration, or web-content changes.
- Missed log-delivery heartbeats and stale backup jobs.
Alerting must include an owner, a response time, and a test. A dashboard that nobody checks is not detection.
8. Design backups for compromise, not just hardware failure
Back up application data, configuration, databases, certificates and keys according to a documented key-management plan, and the metadata needed to rebuild the VPS. Keep at least one copy independent of the VPS account. A reachable backup account can be deleted or encrypted by the same compromise that damages production.
Run restore drills
- Provision an isolated recovery environment.
- Restore a recent backup without using the production host as a source of missing files.
- Record restore duration, required dependencies, ownership and permission fixes, and any schema or runtime migrations.
- Verify that the application serves correctly, certificates are available, and secrets can be reintroduced safely.
- Document when DNS can be switched and how long TLS and cache changes take to propagate.
A backup that has never been restored is an assumption. Production systems should have evidence of a tested restore and a recovery objective that matches their availability needs.
9. Verify the baseline after every change
Use the same post-change checklist after updates, firewall edits, web-server changes, container deployments, and restores:
- Expected ports are listening; unexpected ports are closed at both provider and host layers.
- SSH accepts the intended key-based accounts, rejects password authentication if that is the policy, and blocks direct root login.
- Firewall rules are deny-by-default and documented.
- TLS certificates are valid for every hostname, redirect behavior is correct, and renewal testing succeeds.
- Package timers, repository configuration, unattended-upgrade logs, and reboot status are healthy.
- AppArmor is enabled, profiles are loaded, and denials have been reviewed.
- Authentication, sudo, firewall, web, package, and application logs arrive at the independent destination.
- Alerts arrive in a test and have an assigned responder.
- Backups are fresh, readable, independent, and covered by recent restore evidence.
For formal assurance, Ubuntu Security Guide can audit and apply customized CIS Benchmark and DISA-STIG profiles. CIS benchmarks are a useful best-practice basis, but passing a profile does not prove that your application, provider configuration, or business recovery plan is secure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
10. Use an operating cadence in 2026
| When | Tasks |
|---|---|
| At deployment | Inventory the host; establish provider-console access; create named accounts; install and test keys; disable root and password SSH after verification; configure firewalls; deploy TLS; set up logs, alerts, backups, and a first restore test. |
| Daily | Review update results, security alerts, failed jobs, certificate warnings, and backup status. |
| Weekly | Review exposed services, authentication events, firewall changes, certificate dates, package exceptions, and backup freshness. |
| Monthly or after material changes | Re-run the inventory and baseline, review package and service drift, test a restore or recovery procedure, inspect AppArmor events, and confirm reboot planning. |
Match reboot timing to the application’s availability requirement. Automatic reboots can reduce exposure to kernel vulnerabilities, but they must be coordinated with service dependencies, monitoring, and a verified rollback or provider-console path.
Quick Recap
Choosing the right assurance level
| Situation | Minimum sensible approach | Additional evidence to add |
|---|---|---|
| Hobby or low-impact site | Named key-based access, patched supported release, restricted firewall, HTTPS, basic logs, and an independent backup. | Periodic restore test and simple uptime or certificate alerts. |
| Production site | All checklist layers, monitored automation, remote logs, documented secrets, tested restore, and controlled maintenance windows. | Recovery-time objectives, incident runbooks, and change records. |
| Private or VPN-only administration | Keep management ports off the public Internet and enforce VPN or trusted-source access. | VPN key rotation, gateway monitoring, and an emergency out-of-band path. |
| Compliance-driven environment | Map controls to the applicable requirement rather than treating a generic checklist as certification. | Ubuntu Security Guide output, CIS or DISA-STIG evidence, approvals, and recurring audits. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
