The moment a new VPS goes live with a public IP address, automated bots begin scanning it, probing for open ports, default credentials, and known vulnerabilities. This happens within minutes, not days, which means securing your server is not something to schedule for later. It needs to happen before you install anything else.
Here is how Nigerian businesses running a VPS can actually lock things down properly.
Step 1: Switch To SSH Key Authentication Immediately
Password-based SSH login is one of the most common entry points for automated attacks, since bots can attempt thousands of password guesses per hour against a standard login. Switching to SSH key authentication, where access requires possession of a specific private key file rather than knowledge of a password, makes brute-force login attempts effectively impossible, since the key space involved is far too large to guess.
Generate a strong key pair, add your public key to the server, and disable password-based login entirely once key access is confirmed working.
Step 2: Disable Direct Root Login
Running everything as the root user, the account with unrestricted control over the entire server, means any compromise of that single account gives an attacker complete access. Create a separate administrative user with sudo privileges instead, and disable direct root login over SSH entirely, requiring anyone, including you, to log in as a standard user first.
Step 3: Change Your SSH Port Away From The Default
Port 22 is the default SSH port and the very first one automated scanners check. Moving SSH to a different, non-standard port does not make your server fundamentally more secure on its own, but it filters out the overwhelming majority of unsophisticated, automated scanning traffic that only targets the default port, meaningfully reducing the noise and risk your server is exposed to.
Step 4: Set Up A Firewall With A Default-Deny Policy
Configure your firewall to block all incoming traffic by default, then explicitly allow only the specific ports your VPS genuinely needs, such as your website’s HTTP and HTTPS ports and your chosen SSH port. Every open port represents a potential attack surface, so keeping this list as short as possible meaningfully reduces your overall exposure.
Step 5: Install Fail2Ban Or A Similar Intrusion Prevention Tool
Fail2Ban monitors your server’s login logs and automatically blocks IP addresses showing repeated failed login attempts, adding a genuine second layer of defense even on top of SSH key authentication. Configuration typically takes only a few minutes and provides continuous, ongoing protection against brute-force attempts without requiring manual monitoring.
Step 6: Keep Everything Updated Without Delay
A significant share of successful server compromises exploit known, already-patched vulnerabilities that simply were not applied in time. Update your operating system and installed software regularly, and enable automatic security updates where your setup safely supports it, since exploit attempts for newly disclosed vulnerabilities often begin within hours of the vulnerability becoming public knowledge.
Step 7: Monitor Your Server For Warning Signs
Set up basic monitoring so you notice a compromise quickly rather than discovering it weeks later. Watch for:
- Unexpected CPU spikes, which can indicate unauthorized processes like cryptocurrency mining running on your server
- Unfamiliar user accounts or unexpected changes to system files
- Successful logins from unfamiliar IP addresses in your authentication logs
- Your server’s IP address appearing on spam blacklists, often a sign it is being used to send unauthorized email
Step 8: Secure Your Web Applications, Not Just The Server Itself
Server-level hardening protects the foundation, but the applications running on top, your website, database, and any installed software, need their own attention too.
- Keep your website’s core platform, themes, and plugins updated just as diligently as the server operating system itself.
- Use strong, unique passwords for every database and application-level account, not just your server login.
- Consider a web application firewall for an additional layer of protection specifically against web-based attacks.
Step 9: Maintain Regular, Automated Backups
Even a well-hardened server is not immune to every possible threat. Regular, automated backups stored separately from the server itself ensure that if something does go wrong, you can restore quickly rather than facing a prolonged, stressful recovery or permanent data loss.
Common Mistakes That Leave A VPS Exposed
- Delaying security setup until “later,” after the server is already live and exposed to automated scanning.
- Relying on a single security measure, like just a firewall, instead of layering multiple defenses together.
- Ignoring routine updates, leaving known, already-patched vulnerabilities open for exploitation.
- Never monitoring logs or server activity, missing early warning signs of a compromise already in progress.
Securing a VPS is not a one-time task completed on setup day. It is a layered, ongoing practice: SSH keys, a proper firewall, intrusion prevention, and consistent updates working together to keep your server well ahead of the automated threats constantly probing it.
Ready to run your business on a VPS built with security in mind from the start? Explore HoganHost’s managed and unmanaged VPS plans and get the support to keep your server properly secured.
