Essential Security and Optimization Tips for Your VPS

A VPS gives you a whole Linux server with root access, and with it the job of keeping that server secure and fast. This guide is a practical checklist for your own VPS or dedicated server: what to lock down on day one, what to monitor, and which tuning changes actually help.

1. Start from a supported operating system

Security starts with an OS that still receives fixes. In 2026 that means a current long-term-support release such as Ubuntu 24.04 LTS, Debian 12 or 13, AlmaLinux 9 or 10, or Rocky Linux 9 or 10. CentOS Linux has reached end of life and gets no security updates; if a server still runs it, plan a migration to AlmaLinux or Rocky Linux.

Update everything right after the first login, and reboot if the kernel changed:

# Ubuntu / Debian
sudo apt update && sudo apt full-upgrade -y

# AlmaLinux / Rocky Linux
sudo dnf upgrade -y

Then turn on automatic security updates so patches don't wait for you: unattended-upgrades on Ubuntu and Debian, dnf-automatic (with apply_updates = yes) on AlmaLinux and Rocky Linux.

2. Lock down SSH

SSH is the front door, and bots try it constantly. The essentials:

Changing the SSH port away from 22 reduces log noise but is not real protection; if you do it, open the new port in the firewall first, and on AlmaLinux or Rocky also label it for SELinux. The full walk-through is in the SSH security hardening checklist.

3. Firewall and brute-force protection

Default-deny inbound traffic and open only what you serve:

# Ubuntu / Debian (ufw)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

# AlmaLinux / Rocky Linux (firewalld)
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service={ssh,http,https}
sudo firewall-cmd --reload

Never open database ports such as 3306 (MySQL) or 5432 (PostgreSQL) to the internet. Bind the database to 127.0.0.1 and reach it through an SSH tunnel.

Add fail2ban to ban addresses that keep failing logins. In /etc/fail2ban/jail.local, enable the [sshd] jail with backend = systemd, a maxretry of 3 to 5 and a bantime such as 1h, and add your own static IP to ignoreip. If you install a control panel that ships its own firewall (CSF, for example), use that one and don't run two firewalls side by side. See also modern firewall management with nftables.

4. Protect your websites and applications

• HTTPS everywhere. Get free certificates from Let's Encrypt with Certbot (sudo certbot --nginx or --apache). Certbot installs a timer that renews automatically; check it with sudo certbot renew --dry-run.
• Keep applications patched. Outdated WordPress plugins, themes and frameworks cause far more break-ins than the operating system does.
• Consider a web application firewall. ModSecurity with the OWASP Core Rule Set, or a proxy such as Cloudflare in front of the server, blocks common attacks like SQL injection. Test in detection-only mode first, because the rules can block legitimate requests. See understanding web application firewalls.
• Add security headers such as HSTS and a content security policy; see security headers explained.
• Use mandatory access control that ships with your OS. Ubuntu and Debian use AppArmor and AlmaLinux and Rocky use SELinux, both enabled by default. Leave them on; fix a denial with a proper rule instead of disabling them.

5. Monitor the server and read the logs

You can't fix what you don't see. Start simple:

htop                     # live CPU, memory and processes
df -h                    # disk space per filesystem
free -h                  # memory and swap
sudo journalctl -p err -b   # errors since the last boot
sudo journalctl -u ssh --since today   # SSH logins (the unit is sshd on AlmaLinux/Rocky)

Web server logs normally live in /var/log/nginx/ or /var/log/apache2/ (/var/log/httpd/ on AlmaLinux and Rocky). Make sure logrotate is rotating them; it is installed and configured by default on all these distributions.

For alerts, an external uptime check plus a metrics stack is enough for most businesses. Production observability with Prometheus, Grafana and Loki shows a complete setup.

6. Tune for speed: measure first

Change one thing at a time, and measure before and after.

Remove what you don't use: systemctl list-units --type=service --state=running shows every running service, and sudo systemctl disable --now name stops one.

7. Backups you can actually restore

A backup only counts if it is somewhere else and you have restored it at least once.

• Follow 3-2-1: three copies, on two kinds of storage, one off the server.
• Automate it. A nightly mysqldump or pg_dump plus rsync or restic to remote storage, run from cron or a systemd timer.
• Test restores on a spare server or a local virtual machine every few months.
• Know what your provider keeps. Check which snapshots your VPS plan lists on the plan page, and keep your own off-server copy anyway.

8. Network, DNS and DDoS

• Put a CDN such as Cloudflare in front of busy or media-heavy sites; it cuts latency for distant visitors and absorbs a lot of junk traffic. See Cloudflare setup for Indian websites.
• Rate-limit logins and APIs at the web server (for example nginx limit_req).
• For attacks against a single service, mitigating DDoS attacks with CSF covers the server-side options.
• DNSSEC is set up with your DNS provider and registrar. For a domain registered with Domain India, ask support.

9. Your regular maintenance routine

10. Running this on a Domain India VPS

Domain India VPS plans use KVM virtualization with full root access and NVMe storage, and they are self-managed: every step in this guide is yours to carry out. At checkout you can choose no control panel, CyberPanel, Webuzo or DirectAdmin; cPanel isn't offered on a VPS. The live VPS page lists the servers as located in Germany, so a CDN is worth considering if most of your visitors are in India. On 19 September 2026, Domain India list prices started at ₹552 a month for VPS Starter, excluding 18% GST.

If you don't want to manage a server, shared hosting keeps the server security and updates on our side, and the App Platform runs Node.js apps or any Dockerfile without a server to maintain.

Ready to run your own server? Compare plans on VPS hosting, follow the VPS setup and activation guide, or open a support ticket if you have a question first.