VPS security checklist for 2026

Root is the most targeted username. Disabling root login forces attackers to guess both a username and a password, effectively doubling the difficulty of a brute force attack.

SSH keys are cryptographically stronger than any password. A 4096-bit RSA key would take billions of years to brute force. Once keys are set up, disable password authentication entirely.

A firewall blocks access to all ports except the ones you explicitly need (typically 22, 80, 443). Without a firewall, every service on your server is exposed to the internet.

Unpatched software is one of the top attack vectors. Exploit code for critical CVEs often appears within hours of disclosure. Update everything before doing anything else.

Manual updates are forgotten. Automatic security updates ensure critical patches are applied even when you are not watching. The risk of a broken update is far lower than the risk of an unpatched CVE.

Even with SSH keys, attackers still attempt brute force attacks that fill your logs and consume resources. Intrusion detection blocks attackers after repeated failures, stopping them at the network level.

A firewall allows traffic on ports 80/443 but cannot inspect HTTP content. SQL injection, XSS, and path traversal attacks arrive as valid HTTP requests. A WAF detects and blocks these application-level attacks.

Web application vulnerabilities can lead to uploaded web shells, cryptominers, and backdoors. Regular scanning catches what preventive measures miss. Focus on upload directories and /tmp.

Your installed packages may contain known vulnerabilities even after updating, especially for third-party software. CVE scanning matches installed versions against the NVD database.

Security headers like X-Frame-Options, X-Content-Type-Options, HSTS, and CSP protect against clickjacking, MIME sniffing, protocol downgrade, and cross-site scripting. They cost nothing and prevent entire classes of attacks.

MySQL (3306), PostgreSQL (5432), MongoDB (27017), and Redis (6379) should never be accessible from the internet. Bind to localhost and block the ports in your firewall.

If your users are all in one region, blocking entire countries at the firewall level eliminates a large percentage of automated attacks. Most SSH brute force originates from a handful of countries.

Without monitoring, you will not know about attacks until the damage is done. Real-time alerts via Slack, email, or Discord ensure you are notified of critical security events immediately.

World-readable .env files, writable web directories, and incorrect SSH key permissions are common misconfigurations. A permissions audit catches issues that standard security tools overlook.

Security auditing tools check hundreds of configuration points: kernel parameters, file permissions, service configurations, and compliance benchmarks. Run monthly to catch configuration drift.