Skip to main content
A new server is reachable from anywhere on the internet, so it’s worth securing it before you put anything important on it. These steps take about 30 minutes and block most common attacks.
HostCloud VPS plans are semi-managed: you’re responsible for your server’s software, security updates and backups. If you’d rather we do this for you, managed VPS help is available at ₹1,500 + GST per hour. Open a ticket to request it.
Some of these steps change how you log in. Keep your current SSH session open while you make changes, and test the new login in a second window before you close the first. If you lock yourself out, click Console on the server panel to log in from your browser.
First, connect to your VPS with SSH as root. The commands below differ slightly depending on your operating system.

​
1. Install updates

If the update included a new kernel, restart the server with reboot, then log in again.

​
2. Change the root password

Replace the password from your welcome email with a new, long one that you don’t use anywhere else:

​
3. Create your own user

Day-to-day work is safer as a normal user that can use sudo when needed. Replace priya with the username you want.
Open a second window and check that you can log in as the new user and run sudo -i.

​
4. Use an SSH key instead of a password

An SSH key is much harder to guess than a password. On your own computer (not the server), create a key and copy it to the server:
Replace 203.0.113.10 with your server’s IP address. On Windows, if ssh-copy-id isn’t available, copy the contents of the .pub file into /home/priya/.ssh/authorized_keys on the server. Then check that you can log in with ssh priya@203.0.113.10 without being asked for the server password.

​
5. Turn off password and root logins

Only do this once your SSH key login works. On the server, edit the SSH settings:
Find these lines (remove any # at the start) and set them to:
Save the file (Ctrl+O, Enter, then Ctrl+X) and restart SSH:
Test a new login in a second window before you close your current one.

​
6. Turn on a firewall

A firewall blocks every connection you haven’t allowed. Always allow SSH first, or you’ll lock yourself out.
Ports 80 and 443 are for a website. Leave them out if your server doesn’t host one. You can also attach a firewall from the Firewall tab on the server panel.

​
7. Set up backups

Your VPS isn’t backed up unless you set it up. You can:
  • Add the Automated Backup add-on from your VPS’s Addons page in the Client Area. Its status and restore points show on the Backups tab.
  • Take a snapshot before big changes, from the Snapshots tab with Create Snapshot.
  • Keep your own copy of important data somewhere other than the server.
The Backups tab on the VPS server panel, showing that automated backups are enabled, the backup interval and the restore points used

​
Keep it up to date

Repeat step 1 regularly, at least once a month, and whenever you hear about an important security fix. Still stuck? Open a ticket with your server’s IP address.