A secure Linux VPS is not created by changing one SSH setting. Build layers: inventory and recovery access, timely patches, least-privilege accounts, deny-by-default networking, HTTPS, confinement, independent logging, and tested restoration. Complete the controls in that order so a firewall or SSH mistake does not strand you, and so an incident becomes recoverable rather than merely detectable.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This checklist is aimed at self-managed Ubuntu or Debian-style VPSs serving websites. It is an operating baseline, not a penetration test or a substitute for application, PHP, container, database, provider, or regulatory reviews.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute1. Inventory the VPS before changing it
Write down what exists before hardening. An accurate inventory prevents you from closing a port that a payment callback needs or overlooking an old service that is listening on every interface.
Record the current state
- Distribution, release, kernel version, public IPv4/IPv6 addresses, DNS names, and the provider account or project that controls the machine.
- Listening sockets and owning processes. On a Linux shell,
ss -tulpngives a useful first snapshot; repeat it after installing the web stack and after enabling containers. - Web-server, runtime, application, database, and container versions; systemd services; scheduled jobs; data and upload paths; and every privileged account.
- Provider-level firewall rules, host firewall rules, load balancers, DNS records, certificates, and locations of configuration files and secrets.
Keep a copy of this inventory outside the VPS. A public server is continuously exposed to automated scans and authentication attempts, unpatched-service exploitation, stolen SSH keys or API tokens, accidentally published container ports, privilege escalation, and deletion or encryption of reachable data. An administrator-level intruder can also erase local logs and backups.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Confirm a rollback path
Open the provider’s serial console, web console, rescue environment, or other out-of-band route and verify that it works before touching SSH or firewall policy. Know how to restore a snapshot or rebuild from an image. Keep one administrative session open while testing a second session from the intended management network; never apply a restrictive rule with your only connection.
2. Patch the operating system and define vulnerability response
Understand the support window
Canonical states (updated April 29, 2026) that a standard Ubuntu LTS release provides security support for packages in the Main repository for five years. Ubuntu Pro extends coverage to ten years and adds fixes for medium, high, and critical vulnerabilities in the Universe repository. Check the release and repository coverage for your actual instance rather than assuming every package receives the same term.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Coverage choice | What is established | Operational implication |
|---|---|---|
| Standard Ubuntu LTS | Five years of security support for Main-repository packages | Plan an upgrade before the release leaves its supported window |
| Ubuntu Pro | Ten years, plus medium, high, and critical Universe-repository fixes | Verify that the packages you rely on are covered and that the entitlement is active |
Apply and observe updates
- Review enabled repositories and remove sources you cannot identify or no longer need.
- Run the normal package update process during a controlled maintenance window, then inspect the resulting service state.
- Enable and monitor
unattended-upgrades. Ubuntu documents that supported installations install security updates after 24 hours by default and normal updates after seven days. - Inspect
/var/log/unattended-upgradesand your system journal for failures, held packages, or dependency errors. Treat a failed automated run as an incident to resolve, not as evidence that the host is current. - Configure reboot automation only when your availability plan permits it. Automatic reboots can be disruptive; schedule them, announce them, and verify that the application, monitoring, and remote access return afterward.
Third-party repositories need explicit configuration and separate trust decisions. Track Ubuntu Security Notices and the Ubuntu CVE Tracker for packages actually installed, and record who evaluates a notice, how quickly, and whether a compensating control or emergency reboot is required.
3. Create named accounts and harden SSH
Use least privilege
Ubuntu’s guidance is explicit: enforce least privilege. Create a named administrative account, grant only the sudo rights required for its work, and remove dormant accounts and unused keys. Do not share a generic administrator login; individual names make review and incident timelines possible.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Move safely to key-based access
- From your workstation, create or select an SSH key protected by a passphrase. Install the public key for the named account and test it in a new session.
- Keep the provider console available and leave the original session open while testing the new login from a second network path.
- After key access and sudo have been verified, disable SSH password authentication and direct root login in the OpenSSH server configuration, then reload the service and test again.
- Restrict SSH at both the provider firewall and host firewall to a trusted source range or VPN whenever feasible. A nonstandard SSH port may reduce noise but is not an authentication control or a substitute for patching.
Document the emergency key-revocation process, where authorized keys are stored, and who can use the provider console. If a key is exposed, remove it immediately, review authentication logs, rotate dependent secrets, and investigate commands run by that account.
4. Make the network deny by default
Allow only documented ports
Use a deny-by-default host firewall and mirror the intent in the provider firewall. Ubuntu commonly uses UFW as a wrapper. A typical sequence, adapted to your management source and application, is:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from <trusted-admin-range> to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseReplace the placeholder with a real address range before enabling the policy. If administration is through a VPN, permit the VPN interface and keep SSH off the public interface. Recheck rules after every provider or container change.
Keep internal services private
Do not expose databases, Docker APIs, metrics endpoints, admin panels, queues, or internal APIs to the public Internet unless the design explicitly requires it and includes authentication, encryption, source restrictions, and monitoring. DNS, monitoring, or VPN ports belong in the allow-list only when the VPS actually provides those services. After each deployment, compare the intended list with ss -tulpn and a scan performed from outside the VPS.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
5. Protect the web server and TLS
Make every public hostname deliberate
Redirect HTTP to HTTPS where appropriate, obtain a certificate for each public hostname, and automate renewal. TLS provides privacy, integrity, and authenticity; an expired certificate or a hostname omitted from renewal is an availability and trust failure. Monitor expiry in advance and alert on renewal errors rather than waiting for browsers to report them.
Review version-specific web settings
Check Nginx or Apache defaults against the version you run. Review server-identifying headers, request and body-size limits, timeout values, directory listing, proxy headers, upload handling, error responses, and access permissions. Do not copy a hardening fragment written for a different release or module set without testing it in staging.
Free tools Windows power users keep installed
One-click scans. No signup required.
Separate the service from application data
- Run the web server and application workers under dedicated, non-login service users.
- Keep environment files, API keys, database credentials, private keys, and other secrets outside the document root and out of version control.
- Make only the upload or cache directories writable, and ensure uploaded files cannot be executed as server-side code.
- Use separate service identities and database permissions for each application where practical.
Operating-system hardening cannot compensate for an injectable application, vulnerable PHP package, unsafe container image, or weak database account. Treat those as separate workstreams with their own patch and review schedules.
6. Constrain processes with AppArmor and a small software footprint
Keep confinement enabled
Keep AppArmor enabled where supported and review profiles for OpenSSH, Nginx or Apache, and application processes. Investigate denials before weakening a profile; a denial may reveal an unexpected path or behavior. Ubuntu Security Guide includes service-specific areas for Apache2, Nginx, and OpenSSH and can help turn a baseline into auditable settings.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Remove avoidable attack surface
- Uninstall packages and disable services that the inventory shows are unused.
- Download packages only from repositories you trust; avoid unverified
.debfiles. - Do not paste aggressive sysctl settings from unrelated guides. Validate each kernel change against the workload and keep a tested rollback.
- Review file ownership, sudo rules, scheduled jobs, container mounts, and capabilities after major upgrades.
Ubuntu’s hardening material specifically calls out unnecessary open ports, disabling AppArmor, dangerous sysctls, and untrusted package downloads as common mistakes.
7. Make logs and alerts survive an intrusion
Collect the evidence that matters
Retain authentication, sudo, firewall, web access and error, package-manager, and application logs. Set retention long enough to investigate an incident and protect logs from routine disk exhaustion. Alert on repeated authentication failures, privilege changes, newly listening ports, unexpected process or file changes, failed updates, certificate-expiry windows, and low disk space.
Forward important logs elsewhere
Send security-relevant logs to an independent destination. If an attacker gains administrator privileges, local evidence can be deleted or altered. Production baselines call for persistent and remote logs plus external alerting. Test delivery and alert receipt, not just the configuration file. Fail2ban or another rate-control tool can be useful for selected services, but it is risk-dependent; it does not replace keys, patching, source restrictions, or investigation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Back up for rebuilding, not just file recovery
Define what must be restorable
Back up application data, database dumps or snapshots, configuration, certificates and keys according to a documented key-management plan, and the metadata needed to rebuild the VPS: package lists, firewall rules, systemd units, container definitions, DNS records, and deployment instructions. Keep at least one copy independent of the VPS account and protect it from the same credentials and deletion path.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Run restore drills
- Provision a clean test instance or isolated recovery environment.
- Restore data and configuration from the independent copy.
- Repair ownership, permissions, service dependencies, and secrets without copying a compromised executable or unknown cron job.
- Verify application behavior, TLS certificates, monitoring, and scheduled jobs.
- Record elapsed time, missing dependencies, data loss point, and the steps required to return DNS and HTTPS to service.
A backup that has never been restored is an assumption. Production operations should have a target recovery time and recovery point, an owner for the drill, and evidence that the result met those targets.
9. Verify the baseline and choose an assurance level
Use a post-change checklist
- Expected ports are the only externally reachable ports.
- SSH accepts keys for named accounts, rejects passwords and direct root login, and is restricted to the intended source.
- Firewall policy is active at both provider and host layers.
- Certificates are valid, cover every public hostname, and have working renewal.
- Packages are current, unattended-update logs show success, and reboot requirements are known.
- AppArmor is enabled and denials are understood.
- Remote log delivery and each alert path have been tested.
- Backup freshness and restore evidence are recorded.
Match evidence to your risk
| Operating situation | Practical emphasis |
|---|---|
| Hobby or low-impact site | Named account, keys, minimal ports, HTTPS, updates, and an independent backup may be proportionate; still keep a provider-console path. |
| Production service | Add remote logs, external alerting, documented recovery objectives, scheduled restore drills, controlled reboots, and change review. |
| Private or VPN-only administration | Keep public web ports as required, but place SSH and internal dashboards behind the VPN and restrict provider rules accordingly. |
| Formal assurance requirement | Use Ubuntu Security Guide to audit or apply customized CIS Benchmark and DISA-STIG profiles, then retain exceptions and remediation evidence. |
CIS benchmarks are a best-practice basis, not proof that an application or provider layer is secure. Ubuntu’s introductory guidance is not comprehensive, and a VPS checklist does not certify compliance.
10. Operate the checklist on a cadence
| When | Checks |
|---|---|
| At deployment | Inventory, recovery console, named accounts, SSH keys, firewall, TLS, logging, backup, and restore plan. |
| Daily | Update results, authentication alerts, disk capacity, certificate alerts, and backup jobs. |
| Weekly | Exposed-service review, authentication events, certificate dates, firewall drift, and backup freshness. |
| Monthly and after material changes | Restore rehearsal or recovery exercise, package and service-drift review, AppArmor review, and a rerun of the security baseline. |
Coordinate reboot timing with the application’s availability requirement. Record every exception, its compensating control, an owner, and a date for reassessment. Security is maintained by this feedback loop: know what is running, reduce what is exposed, observe what changes, and prove that you can rebuild.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
