VPS Security Checklist: 9 Essential Steps Right After Setup (2026)

A new VPS is being scanned by automated bots within minutes of going live. Before you install applications or point a domain at your server, run through this checklist. These nine steps cover the attack surface that automated exploits target first — root login, weak SSH, open ports, and unpatched packages. Contabo VPS and VDS plans also include a free network-level firewall managed from the Customer Control Panel (CCP), which adds a hardware layer before traffic ever reaches your OS. Step 9 covers that.

The 9-Step VPS Security Checklist

Step 1: Update the Operating System First

The VPS image may have been built weeks ago — patching first ensures every subsequent step runs on a clean, patched base.

# Ubuntu / Debian
sudo apt update && sudo apt upgrade -y
sudo reboot  # if a kernel update was applied

# AlmaLinux / Rocky Linux
sudo dnf update -y

Step 2: Create a Non-Root Sudo User

Running everything as root means a single compromised process has full system access. Create a dedicated admin user and use it for all subsequent steps.

adduser [username]
usermod -aG sudo [username]
su – [username]

Step 3: Set Up SSH Key Authentication

Passwords can be brute-forced; cryptographic key pairs cannot. Generate a key pair locally, copy it to the server, and verify it works before touching any SSH configuration.

# On your LOCAL machine:
ssh-keygen -t ed25519 -C “[email protected]”

# Copy public key to the VPS:
ssh-copy-id [username]@[server-ip]

# Verify key login works BEFORE proceeding:
ssh [username]@[server-ip]

Step 4: Disable Root Login and Password Authentication

With SSH key access confirmed, close the two most-exploited entry points: direct root login and password authentication.

sudo nano /etc/ssh/sshd_config

# Set these lines:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

# Restart SSH:
sudo systemctl restart sshd

Optional: change the default SSH port from 22 to a non-standard port (add Port [number] to sshd_config). This reduces automated scanning noise significantly — particularly useful if your auth logs show high volume. Not a replacement for proper authentication. If you change the port, update UFW rules (Step 5) and the Contabo CCP firewall (Step 9) to allow the new port.

Step 5: Configure UFW Firewall (Default-Deny)

A default-deny firewall blocks all inbound connections you haven’t explicitly allowed. Allow SSH first — or you will lock yourself out.

sudo apt install ufw -y

# Allow SSH (use your custom port if changed in Step 4):
sudo ufw allow 22/tcp

# Allow web traffic if needed:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Set policies and enable:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose

Step 6: Install Fail2ban

Fail2ban monitors auth logs and bans IPs that exceed a threshold of failed login attempts. It appeared in 86 out of 90 AI responses for this topic — the near-universal recommendation.

sudo apt install fail2ban -y

# Copy config (never edit jail.conf directly):
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit jail.local — find [sshd] and set:
# bantime = 1h
# maxretry = 5
# findtime = 10m

sudo systemctl enable –now fail2ban
sudo fail2ban-client status sshd

Step 7: Enable Automatic Security Updates

Manual patching gaps are a leading cause of successful server exploits. Unattended-upgrades applies critical security patches automatically.

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure –priority=low unattended-upgrades

# Verify security updates are enabled:
grep ‘security’ /etc/apt/apt.conf.d/50unattended-upgrades

Step 8: Enable 2FA/TOTP for SSH

Two-factor authentication adds a second layer even if SSH keys are compromised — login still requires a time-based one-time password from your authenticator app. The full setup (Google Authenticator PAM module, sshd_config, and PAM configuration) is covered in the dedicated guide — see the internal link below. Keep this step brief here; the guide walks through each command.

Step 9: Activate Contabo’s Network-Level Firewall in the CCP

Every Contabo Cloud VPS and Cloud VDS plan includes a free network-level firewall managed from the Customer Control Panel. It operates at the network layer, before traffic reaches the VPS OS, complementing the UFW software firewall configured in Step 5.

To activate: Contabo CCP → select your server → Firewall → create inbound rules matching the ports allowed in Step 5 (SSH, 80, 443, and any custom ports). Set all other inbound to deny. The network-level firewall provides hardware-level defence against port scans and volumetric attacks before they consume any server resources — a feature most providers charge extra for or don’t include at all.

Bonus: Set Up Regular Backups

The best security posture still fails without a tested backup. If a server is compromised, ransomware-encrypted, or misconfigured beyond recovery, a recent backup is the difference between a one-hour recovery and a complete rebuild. Backups are treated as a core security measure — not an optional extra.

• Contabo CCP snapshots — take a full-server snapshot before significant changes. Restorable from the CCP within minutes.
• Offsite backups to Contabo Object Storage — use rclone to schedule automated backups of critical data to an S3-compatible bucket. A compromised server cannot delete an offsite backup.
• Test your backups — a backup that has never been restored is a backup you don’t actually have.

FAQ: VPS Security After Setup