Secure Your Server
Last updated 4 August 2026
Start here
Your server is reachable from the internet the moment it boots, and automated scanners find new addresses within minutes. Everything below can be done in about fifteen minutes and removes the overwhelming majority of that risk.
You have full root access, so all of this is yours to change.
1. Use an SSH key instead of a password
A password can be guessed. A key cannot, in any practical sense.
Add your public key on the server's page in your dashboard, or append it to ~/.ssh/authorized_keys on the server itself.
Before you disable password login, open a second terminal and confirm the key works. Keep your first session open while you test. If the key is wrong and you have already turned passwords off, you will be locked out.
Once a key session is confirmed, edit /etc/ssh/sshd_config:
PasswordAuthentication no
PermitRootLogin prohibit-password
Then reload SSH (systemctl reload sshd). Reload rather than restart, so an existing session survives a mistake.
2. Move SSH off port 22
Port 22 takes constant automated login attempts. Moving it does not make you secure on its own, but it removes almost all of that noise and the log volume with it.
Set Port 2222 (or any free port above 1024) in /etc/ssh/sshd_config, allow it in the firewall before reloading, and reconnect with ssh -p 2222.
3. Turn on the firewall
Open only what you actually serve. On Ubuntu and Debian:
ufw allow 2222/tcp
ufw allow 80,443/tcp
ufw enable
Add your SSH port to the firewall before enabling it, or you will disconnect yourself. On AlmaLinux and Rocky the equivalent is firewall-cmd.
4. Keep security updates installing
Most compromises use a vulnerability that was patched months earlier.
apt install unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades
On AlmaLinux and Rocky, use dnf-automatic.
5. Take backups before you need them
Automated Backups can be enabled per server from your dashboard. A snapshot before any significant change costs nothing and is the difference between an inconvenience and a rebuild.
What we look after, and what you look after
Our support covers our network, our hardware and the platform itself: connectivity, routing, the hypervisor, storage and your dashboard. If something is wrong on our side, we will fix it.
Your server is self-managed. The operating system, the software you install and the configuration inside the server are under your control, and as a matter of policy we do not log in to customer servers. If you would prefer us to take that on, contact support and we will set out the options.
If something looks wrong
Check the server's console from your dashboard before assuming the network is at fault: the console reaches the server even when SSH does not, which separates "my firewall rule locked me out" from "the server is unreachable".