Contain the VPS first, preserve evidence, and assume every secret readable from the host is exposed. Remove public access with your provider’s firewall or network controls, save a snapshot or forensic copy when required, and stop nonessential services. If the attacker had root or administrative control, the dependable recovery path is to rotate credentials from a trusted device and rebuild from a current, trusted image or reproducible infrastructure—not to trust an in-place cleanup.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Restore only reviewed data and code, reconnect in stages, and then harden the replacement with restricted management access, key-based SSH, phishing-resistant MFA, patching, monitoring, and tested protected backups.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What to do in the first hour
Work from a device you trust. Do not investigate or rotate credentials from the compromised VPS: malware may capture new passwords, keys, or tokens. If the incident could affect other systems, use an out-of-band channel that the attacker cannot monitor.
- Isolate the host. Use the provider firewall, security group, or network controls to remove public exposure. Block unnecessary ingress and egress, or detach the VPS from the network if your provider supports that safely. Stop nonessential services, but avoid wiping or rebooting before evidence is preserved unless an active attack requires immediate shutdown.
- Preserve evidence. Save a provider snapshot or disk image before destructive changes when practical. Export authentication, web-server, application, firewall, and provider-IAM logs. Record UTC timestamps, suspicious IP addresses, usernames, commands, new services, scheduled tasks, processes, and outbound connections. A snapshot created after compromise is evidence; it is not automatically a clean restore source.
- Protect the identity plane. From the trusted device, secure the provider account, reset its password, verify MFA, review administrator sessions, and revoke cloud API tokens. This prevents an attacker who stole credentials from rebuilding access after you isolate the VPS.
- Declare the recovery path. If root access or the boundary of the compromise is uncertain, plan a clean rebuild. Keep the old disk or snapshot for investigation and any legal, regulatory, insurance, or customer-notification requirements.
Do not announce remediation in a chat, ticket, or shell session that the attacker may be watching. If the VPS is part of a larger environment, isolate related hosts and accounts in a coordinated manner; CISA advises coordinated isolation and out-of-band communications during containment.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When an in-place repair is unsafe
Root access means the intruder could have altered system binaries, users, SSH authorization, cron and systemd persistence, application files, logs, and every secret readable by the operating system. A clean-looking process list or a removed malware file cannot prove that all persistence was found. CISA’s StopRansomware Guide states: “Rebuild systems based on prioritization of critical services (e.g., health and safety or revenue-generating services), using pre-configured standard images, if possible.”
Rebuild when any of these conditions applies:
- The attacker obtained root or equivalent administrative control.
- You cannot establish when access began, what files were changed, or which accounts were used.
- Unknown users, SSH keys, services, scheduled jobs, web shells, or binaries were found.
- Provider, CI/CD, database, or application credentials were present on the host.
- You need a defensible eradication decision for customers, regulators, insurers, or an investigation.
An in-place repair can retain valuable forensic context and may reduce immediate downtime, but it cannot demonstrate that every persistence mechanism was removed. If you choose it temporarily to keep a critical service available, treat the machine as untrusted, isolate it, rotate all reachable credentials, and schedule replacement rather than declaring the incident solved.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Recovery choice | Eradication confidence | Evidence retained | Downtime | Reproducibility | When it fits |
|---|---|---|---|---|---|
| Clean rebuild from a trusted image or IaC | Highest when credentials and data are reviewed | Preserve the old disk or snapshot separately | Planned cutover required | High if the build is documented | Root compromise, uncertain scope, or critical assurance needs |
| In-place investigation and repair | Lower; hidden persistence may remain | Best live context | Usually lowest initially | Depends on undocumented changes | Short-term continuity or forensic triage while replacement is prepared |
Rotate every credential the VPS could read
Assume a secret was exposed if it was stored in an environment file, configuration, shell history, home directory, deployment system, mounted volume, or process memory. Lack of evidence that a token was used is not evidence that it remained private. Perform rotation from a trusted workstation, in an order that prevents the attacker from regaining control.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Provider and identity accounts: change the provider-console password, re-enroll or verify MFA, revoke active sessions, remove unknown administrators, and rotate cloud API keys. Review billing, IAM, firewall, snapshot, and recovery-console activity.
- Emergency replacement access: generate a new SSH key pair on the trusted device. Do not reuse a private key that ever touched the compromised host. Create a clean administrative account on the replacement and use narrowly scoped sudo.
- Host credentials: replace local user and privileged passwords, invalidate shell and application sessions, and revoke old authorized keys and deployment keys.
- Application and data-plane secrets: rotate database users and passwords, application secrets, webhook and signing secrets, CI/CD credentials, registry tokens, VPN credentials, and service-account keys.
- Encryption material: replace customer-managed encryption keys or other keys that were accessible to the host, following your provider’s key-versioning and re-encryption procedure.
- Downstream systems: inspect every service that trusted the VPS, including DNS, email, payment, source-control, monitoring, backup, and internal APIs. Revoke integrations that cannot be proven unaffected.
CISA specifically advises password resets for affected systems and revocation of cloud credentials stored in application environment files. Keep a rotation ledger with the secret owner, time changed in UTC, systems updated, old-token revocation status, and validation result.
If SSH access was lost
Do not keep guessing against the public SSH endpoint. Use the provider’s recovery console or out-of-band environment. Workflows differ by distribution and provider, but a typical sequence is:
- Open the provider console and select the VPS’s recovery or emergency-access option.
- Use the documented method to set a temporary root password or attach a recovery environment. Treat that password as temporary and never reuse it.
- Mount the VPS filesystem read-only first when preserving evidence; make a separate forensic copy before editing files.
- After containment and credential rotation, install a newly generated SSH public key in the replacement account’s authorized-key file. Exact paths vary by distribution.
- Test key-based login over a restricted management network, then revoke the temporary password and disable password authentication where feasible.
- Review provider audit logs for console sessions, key changes, firewall edits, snapshots, and API-token use.
DigitalOcean documents a Recovery Console, temporary root-password reset, and installing a new SSH key before removing password access. Other providers use different labels and recovery steps, so follow the instructions for your platform.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Build a trustworthy replacement VPS
Use a currently supported distribution image and a build process another administrator can reproduce. Do not clone the compromised disk as your production base.
- Prepare the build definition. Record the operating-system release, packages, service versions, firewall rules, users, mounts, DNS records, certificates, and application configuration in infrastructure-as-code or a version-controlled checklist. Pin trusted release artifacts and verify their integrity.
- Patch before exposure. Apply all available security updates while the instance is still isolated. Install only required packages and remove default services you do not need.
- Create controlled administration. Add a named, non-root user with narrowly scoped sudo. Install a new SSH public key, prohibit direct password-based root access, and disable password authentication when your recovery process supports key-only access.
- Restrict management traffic. Permit SSH only from a defined management IP range, VPN, bastion, or provider firewall. Do not rely solely on an application-level firewall; enforce the rule at the provider boundary as well.
- Separate services. Run applications with dedicated, least-privileged accounts. Keep databases and administrative interfaces off the public internet, and expose only the ports required for the service.
- Install visibility first. Enable centralized authentication and application logs, process and file-integrity monitoring, DNS and outbound-network alerts, provider-IAM notifications, and billing alerts before the public cutover.
- Protect recovery. Configure encrypted, offline or otherwise attacker-resistant backups and automated backups where appropriate. Test restoration into an isolated environment before trusting the schedule.
DigitalOcean’s documented hardening approach similarly combines SSH keys for a sudo-capable non-root user, no password-based root access, a cloud firewall, monitoring, and automated backups. Treat those controls as a baseline, not a substitute for least privilege and patch management.
Restore data without restoring the compromise
Restore in layers, beginning with the smallest set of data needed to validate the application. Prefer a trusted source repository or signed release artifact for code rather than copying application directories from the old disk.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review before copying
- Database exports and user-uploaded content, scanned in an isolated environment.
- Application code compared with a known-good commit or release.
- Configuration rebuilt from documented values, not copied wholesale from
/etc. - Media and archives checked for unexpected executable content, server-side scripts, and path traversal names.
- Certificates and keys reissued where exposure is possible.
Do not blindly restore
- Unknown binaries, package caches, or compiled artifacts.
- Home-directory SSH authorization files and shell startup files.
- Cron entries, systemd units, timers, init scripts, and service overrides.
- Entire
/etctrees, firewall state, sudo rules, or unrecognized user and group definitions. - Web roots containing unexplained PHP or other server-side files.
Keep the old disk or snapshot retained according to your incident, legal, and regulatory requirements. Label it clearly as potentially compromised and restrict who can access it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Find persistence and the original entry point
Eradication is incomplete until you understand how access was obtained and what could recreate it. Review the old system offline where possible, then validate the replacement before reconnecting.
Identity and access
- Compare users, groups, sudo rules, SSH authorized keys, provider IAM members, and recent authentication events with your known inventory.
- Look for logins at unusual times, unfamiliar source addresses, impossible travel, and newly created accounts.
- Inspect CI/CD, registry, VPN, DNS, backup, and monitoring credentials that may have been stored on the host.
Execution and persistence
- Inventory running processes, listening sockets, services, timers, cron jobs, shell startup files, and recently modified files.
- Check web-server configuration, upload directories, container images, package repositories, and startup hooks.
- Search for unexplained outbound connections, unauthorized firewall rules, new software, web shells, and unrecognized PHP or other malicious files.
Initial access
Patch the internet-facing vulnerability or correct the configuration that enabled entry before reconnecting. Common investigation areas include exposed management interfaces, reused passwords, stolen provider tokens, vulnerable web applications, dependency compromise, and CI/CD secrets. If the entry point remains uncertain, assume another exposed account, application, dependency, provider token, or management interface may also be affected and review those systems.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Reconnect in controlled stages
- Place the replacement behind the provider firewall or a temporary restricted network path.
- Validate authentication, patch level, users, listening ports, TLS certificates, application configuration, and backup jobs.
- Restore the minimum reviewed dataset and run functional and security checks.
- Change DNS or load-balancer targets only after the replacement passes validation; reduce DNS cache impact according to your documented change plan.
- Reconnect dependencies one at a time, confirming that each uses a newly rotated credential.
- Keep the old host isolated. Do not return it to service merely because the new instance is operational.
For the first days after cutover, watch authentication, process, file-integrity, DNS, outbound-network, provider-IAM, and billing activity closely. Alert on new accounts, key changes, unexpected egress, privilege escalation, and edits to firewall or backup settings. Record indicators of compromise, decisions, owners, and UTC timestamps so a later response does not depend on memory.
Harden the VPS for the next incident
Access controls
- Use named non-root accounts and narrowly scoped sudo; remove dormant accounts.
- Require SSH keys and restrict management access by network location. Disable direct root login and password authentication where feasible.
- Protect provider, VPN, bastion, source-control, and administrative accounts with phishing-resistant MFA. A FIDO2 security key is appropriate for these high-impact accounts; it improves login resistance but does not clean a compromised VPS.
- Review keys, tokens, sessions, and IAM membership on a defined schedule.
Updates and exposure
- Track operating-system, kernel, web-server, runtime, container, and dependency updates.
- Minimize internet-facing services and place databases and admin panels on private networks.
- Use secure headers, input validation, dependency pinning, and a documented process for emergency patching.
Detection and response
- Centralize logs off the VPS so an intruder cannot erase the only copy.
- Monitor file integrity, authentication, privileged commands, process changes, DNS, egress, provider IAM, firewall edits, and billing anomalies.
- Keep an inventory of assets, owners, data sensitivity, recovery priorities, and escalation contacts.
Backups and rebuild capability
Maintain encrypted backups that are offline or otherwise protected from deletion by the VPS account. Test restoration regularly, including permissions, application consistency, DNS, certificates, and secret re-issuance. Keep a current golden image or infrastructure-as-code template; CISA recommends tested offline backups and maintained golden images or IaC for cloud rebuilds. A checklist that has never been exercised is not a proven recovery plan.
Provider controls belong in the incident plan
Cloud recovery is not only an operating-system task. Document the provider account owner, emergency contacts, MFA recovery method, IAM roles, firewall and security-group rules, snapshot retention, recovery-console process, API-token inventory, billing alerts, and escalation path. Verify which actions require account-level permissions and which can be performed by a project administrator.
Before an incident, test that you can recover the provider account without the compromised VPS, create a replacement in the intended region, attach protected backups, and update DNS. During an incident, review provider audit events for console logins, API calls, firewall changes, image creation, snapshots, key replacement, and unexpected resource creation.
Quick Recap
A practical recovery checklist
- Contain: isolate network exposure, stop nonessential services, preserve snapshots and logs, and record UTC times.
- Scope: identify affected hosts, accounts, applications, data, and likely initial access.
- Rotate: provider and IAM credentials first, then SSH, local, application, database, CI/CD, VPN, webhook, signing, and encryption secrets.
- Replace: build from a supported image or reproducible template with patches applied before exposure.
- Restore: import only reviewed data and trusted code; exclude unknown executables and persistence files.
- Validate: check users, keys, services, sockets, firewall rules, certificates, logs, backups, and monitoring.
- Reconnect: cut over in stages and keep the old disk isolated for the required retention period.
- Learn: document indicators, root cause, control gaps, owners, and the date of the next restore exercise.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
