In this guide · 8 sections
Short answer
Create a named admin user, log in with SSH keys only, turn off root and password login, enable a firewall that allows only the ports you need, keep automatic security updates on, set up off-site backups, and add malware scans and alerts so you know when something changes.
Why a small business VPS needs hardening
A virtual private server is a rented Linux machine you control fully. That control is the point, but it also means nobody else secures it for you. The hosting company keeps the hardware and network running; the operating system, logins, firewall and software on top are your job.
Exposed servers get found quickly. Our guide to the Carbonato Docker botnet shows how attackers scan for open services and take them over. The CIS Benchmarks are the reference most auditors use: consensus-based configuration recommendations for more than 25 vendor product families, including Ubuntu. They are long and technical, so the checklist below groups the parts that matter most for a small server.
| CIS theme | What it means in plain English | Section below |
|---|---|---|
| Access control | Only the right people can log in, the right way | Accounts and SSH |
| Network configuration | Only the services you need are reachable | Firewall |
| Patching and maintenance | Known holes get closed quickly | Updates |
| Logging and auditing | You can see what happened and get alerted | Monitoring |
| Recovery | You can get back to a working state | Backups |
Accounts and SSH: keys only, no root login
Most attacks on a fresh VPS are bots guessing passwords over SSH, the remote login service. Ubuntu's OpenSSH server guide explains key-based login, which these bots cannot guess.
Create a named admin user
Give each person who manages the server their own account with sudo rights. Shared logins make it impossible to tell who did what.
Set up SSH keys
On your own computer run ssh-keygen -t ed25519, then copy the public key to the server with ssh-copy-id. Protect the private key with a passphrase.
Turn off password and root logins
In a file under /etc/ssh/sshd_config.d/, set PasswordAuthentication no and PermitRootLogin no. Ubuntu reads that folder first, so settings there win.
Test before you restart
Run sudo sshd -t to check the config, keep your current session open, then restart SSH and confirm you can log in from a second window.
Add brute-force protection
Tools such as fail2ban or CrowdSec block addresses that keep failing to log in.
Firewall: only open what you use
Ubuntu's firewall documentation says its default tool, ufw, is disabled on a new install. A typical web server needs three ports open: SSH (22), HTTP (80) and HTTPS (443). Databases, admin panels and Docker services should not be reachable from the internet at all.
Most VPS providers also offer a cloud firewall in their control panel. Using both is fine: the cloud firewall stops traffic before it reaches the server, and ufw protects you if the cloud rule is changed by mistake. If only a few staff need SSH, restrict port 22 to your office IP address.
Watch out for Docker: containers that publish ports can bypass ufw rules. Bind admin and database containers to 127.0.0.1 or put them on an internal network only.
Updates, malware scans and monitoring
Ubuntu applies security updates automatically through the unattended-upgrades package, which Ubuntu's documentation says is installed by default and runs once a day. Two gaps remain: some updates need a reboot, which is off by default, and your own website software (WordPress, Node or PHP apps, Docker images) is not covered. Our guide to automatic security updates on Linux explains safe settings for both.
Check how long your Ubuntu version gets updates. Canonical's release cycle page lists standard security maintenance for 22.04 LTS until May 2027, 24.04 LTS until May 2029 and 26.04 LTS until May 2031. Plan a move before your version runs out.
Monitoring basics
Backups: off the server, and tested
Provider snapshots are convenient, but they sit in the same account as the server. If an attacker or a mistake deletes the account's resources, the snapshots can go too. Keep at least one copy of your files and database in a separate account or service, encrypted, and keep several days of history so you can go back before an infection.
A backup you have never restored is a guess. Restore to a test server at least once a quarter and check the site actually loads. If you ever find the server compromised, follow our hacked website guide: rebuild from a clean image and restore data, rather than trying to clean a server in place.
Full VPS hardening checklist
Print this and tick it off for each server. CSA's Cyber Essentials expects the same basics: secure configuration, updates, backups and the ability to respond.
Per-server checklist
Do it yourself or get help?
If someone on your team is comfortable on the Linux command line, most of this is a day's work, plus an hour a month. If nobody is, a hardened setup with alerts you can read is safer than a server nobody looks at.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Software & Server Protection Setup (S$590) sets up firewall, SSH key-only login, brute-force protection, automatic security updates with a reboot window, daily malware scans and alerts for one VPS on tools in your own account. Server Protection Care (S$149 per server a month) applies updates monthly, checks protections are still on and tests a restore.
Frequently asked questions
Create your own admin user, set up SSH key login, then switch off password and root logins. Automated bots start guessing passwords on new servers quickly, and key-only login stops them. Then turn on the firewall with only SSH, HTTP and HTTPS open before installing anything else.
Yes. Ubuntu's documentation says the unattended-upgrades package is installed by default and applies security updates once a day. It does not reboot the server by default, so kernel updates wait until you restart, and it does not update your own application code, CMS plugins or Docker images.
The CIS Benchmarks are configuration guides published by the Center for Internet Security, a non-profit. They cover operating systems such as Ubuntu, cloud platforms and common software, and are developed by consensus among security experts. They are detailed and technical; most small businesses use them as a reference rather than applying every setting.
Not on their own. Snapshots usually live in the same provider account as the server, so a compromised account or a billing problem can remove both. Keep at least one encrypted copy of files and databases in a separate account or service, keep several days of history, and test restoring it.
Using both is good practice. The provider's cloud firewall blocks traffic before it reaches the server, and a host firewall such as ufw protects you if a cloud rule is changed by mistake. Be aware that Docker can publish container ports in ways that bypass ufw, so check those separately.