A new VPS can be reached from the whole internet the moment it goes live, and automated bots start trying its SSH port within minutes. This checklist is the short version: ten things to do, in order, before you put a website or app on it. It applies to a VPS where you have root access; on Domain India shared hosting (cPanel, DirectAdmin, Webuzo) the server is managed for you and you can't change its firewall or SSH settings.
The complete walk-through, with commands for Ubuntu, Debian, AlmaLinux and Rocky Linux, is in Essential security and optimization tips for your VPS. Every SSH setting is explained in the SSH security hardening checklist.
Update the operating system and turn on automatic security updates, create a sudo user, log in with an SSH key, then switch off root and password logins. Allow only the ports you use through a firewall, add fail2ban, remove services you don't need, keep databases private and keep tested backups off the server. A Domain India VPS is self-managed, so every step here is yours to carry out.
1. The ten-step checklist
| Step | What to do | Done when |
|---|---|---|
| 1. Supported OS | Use a current LTS release such as Ubuntu 24.04, Debian 12 or 13, AlmaLinux 9 or 10, or Rocky Linux 9 or 10 | The release still receives security updates |
| 2. Updates | Install all updates, then turn on unattended-upgrades (Ubuntu, Debian) or dnf-automatic (AlmaLinux, Rocky) | No security updates are waiting |
| 3. Sudo user | Create your own user and add it to the sudo or wheel group | sudo whoami prints root |
| 4. SSH key | Run ssh-keygen -t ed25519 on your computer, then ssh-copy-id | Key login works in a new terminal |
| 5. No root, no passwords | Set PermitRootLogin and PasswordAuthentication to no | sshd -T shows both as no |
| 6. Firewall | ufw or firewalld, deny incoming by default | Only SSH, 80, 443 and ports you really serve are open |
| 7. fail2ban | Enable the sshd jail with backend = systemd | fail2ban-client status sshd lists the jail |
| 8. Unused services | Stop and disable what you don't use | ss -tulpn shows nothing you don't recognise |
| 9. Private databases | Bind MySQL or PostgreSQL to 127.0.0.1 | Ports 3306 and 5432 can't be reached from outside |
| 10. Backups | Copies on another system, restored at least once | A test restore has worked |
2. SSH: the settings that matter
Put your SSH settings in a drop-in file such as /etc/ssh/sshd_config.d/00-hardening.conf, so a file like 50-cloud-init.conf can't switch password login back on:
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3Then check the file and the settings sshd will actually use, and reload it:
sudo sshd -t
sudo sshd -T | grep -Ei '^(permitrootlogin|passwordauthentication)'
sudo systemctl reload sshd # the service is called ssh on Ubuntu and DebianKeep your current session open and log in again from a new terminal. If you do lock yourself out, use the Console tab on your VPS page (client area › VPS & Servers › your VPS). Use reboot, never poweroff: a VPS powered off from inside stays off until you click Start on your VPS page.
3. Firewall and brute-force protection
Deny incoming traffic by default and open only SSH, 80, 443 and the ports you really serve, with ufw on Ubuntu and Debian or firewalld on AlmaLinux and Rocky Linux. Add fail2ban with an sshd jail and your own static IP in ignoreip. If a control panel you install brings its own firewall, use that one and don't run two side by side. For a new server, don't start with CSF: ConfigServer stopped developing it in 2025. The exact commands are in the full VPS security guide.
4. Older advice you can drop
Many checklists online, including the earlier version of this page, still carry dated or risky steps:
| Older advice | What to do now |
|---|---|
Set UsePAM no | Leave UsePAM at the distribution default. Key-only login doesn't need it switched off |
| Copy jail.conf to jail.local and edit it | Put only your own changes in jail.local, with backend = systemd |
| Point fail2ban at /var/log/auth.log | Debian 12 and later log to the systemd journal and have no auth.log by default |
yum update on CentOS | CentOS Linux is end of life; migrate to AlmaLinux or Rocky Linux and use dnf |
| Add a /run/shm line to /etc/fstab | Not needed on current releases, and a wrong fstab line can stop the server booting |
| Nightly rkhunter scans | Run a Lynis audit every few months instead; it reports what to fix |
5. Running this on a Domain India VPS
Domain India VPS plans use KVM virtualisation with full root access and NVMe storage, and they are self-managed: updates, firewall rules, backups and the software you install are yours to look after. A VPS comes without a control panel; you can install one yourself, and cPanel isn't offered on a VPS. A new VPS already has a firewall on the host that opens only SSH (22), HTTP (80), HTTPS (443) and ping, which you change on the Firewall tab, and outbound mail ports 25 and 465 are blocked (587 works). From your VPS page you can start, restart and stop the VPS, open a browser console (it asks for your account password or 2FA code) and reinstall the OS. Older VPS without a VPS page in your client area: open a ticket with the VPS IP address and our team will do this for you.
- 1 vCPU
- 2 GB DDR4 RAM
- 64 GB NVMe SSD Storage
- 2 TB Monthly Bandwidth
Prices on the cards exclude 18% GST.
Rather not manage a server? Shared hosting keeps server security on our side, and the App Platform runs Node.js apps, or any app with a Dockerfile, without a server to maintain.
What should I do first on a new VPS?
Update the operating system, create a sudo user, add an SSH key, switch off root and password logins over SSH, and enable a firewall that allows only the ports you use. Test each SSH change from a second terminal before you log out.
Does Domain India secure my VPS for me?
No. Domain India VPS plans are self-managed. You are responsible for updates, firewall rules, backups and the software you install on the server.
What if I lock myself out of my VPS?
Open the Console tab on your VPS page, log in there and undo the change. For an older VPS without a VPS page, open a support ticket and support will help you regain access.
Ready to harden your server? Work through the full VPS security guide, lock down SSH with the SSH hardening checklist, or compare VPS plans. Questions first? Open a support ticket or use the 24/7 live chat.
KVM virtualisation, full root access and NVMe storage, with your choice of Linux and room for a control panel you install yourself.
See VPS plans