[Home](https://servprivate.com/) / [Privacy Hosting Guides](https://servprivate.com/guides) / The First Hour of VPS Hardening: A Checklist Operations # The First Hour of VPS Hardening: A Checklist Most compromised servers fall to opportunistic scans in their first days online, not to targeted attacks. This ordered checklist covers the first hour on a new VPS: SSH keys, a firewall, fail2ban, automatic updates, and attack-surface trimming. [Read the guide](#guide-body) [FAQ](#guide-faq) #### On this page - [Guide](#guide-body) - [FAQ](#guide-faq) - [Related guides](#guide-related) - [Recommended pages](#guide-cta) No KYC Crypto Only No Logs DMCA Ignored Full Root NVMe SSD 2 min read Updated Jul 2026 On this page [011. Lock down SSH first](#1-lock-down-ssh-first) [022. Put a firewall in front](#2-put-a-firewall-in-front) [033. Add fail2ban](#3-add-fail2ban) [044. Turn on automatic security updates](#4-turn-on-automatic-security-updates) [055. Reduce the attack surface](#5-reduce-the-attack-surface) [06The hour, summarised](#the-hour-summarised) [FAQCommon questions](#guide-faq) [→Recommended pages](#guide-cta) A fresh VPS is scanned and probed within minutes of coming online. The good news: an hour of ordered hardening stops the overwhelming majority of opportunistic attacks. This is the checklist, in the order that matters, for a new privacy-focused server. ## 1. Lock down SSH first Create a non-root user with sudo, add your public key, and then disable password authentication and root login in sshd_config (PasswordAuthentication no, PermitRootLogin no). Keys-only SSH alone defeats the password-guessing that makes up most of the noise hitting your server. Restart SSH and confirm a new session works before closing your current one. The ordered hardening steps that stop the overwhelming majority of opportunistic attacks. ## 2. Put a firewall in front Default-deny inbound, allow only what you need. With ufw: deny incoming, allow outgoing, then allow your SSH port and the specific service ports you run. A firewall turns "every open port is a target" into "only the doors you chose exist," which shrinks the attack surface dramatically. ## 3. Add fail2ban Install fail2ban to watch auth logs and temporarily ban IPs that fail repeatedly. Even with keys-only SSH, it cuts log noise and blunts brute-force attempts against any service you expose. The defaults are sensible; enable the sshd jail and any jails for services you run. ## 4. Turn on automatic security updates Enable unattended-upgrades (Debian/Ubuntu) so security patches land without you remembering. The single most common way servers are compromised is a known vulnerability that had a patch available — automating updates closes that window while you sleep. ## 5. Reduce the attack surface Uninstall services you do not use, bind local-only daemons to 127.0.0.1, and check what is listening with ss -tlnp. Every listening service is a potential entry point; the fewer you run and expose, the less there is to attack. Then set up off-box backups so a compromise is recoverable, not catastrophic. ## The hour, summarised Keys-only SSH, a default-deny firewall, fail2ban, automatic updates, and a minimal listening surface. None of it is exotic, all of it is fast, and together it stops the automated attacks that account for nearly all real-world compromises. Do it before you deploy anything that matters. FAQ ## VPS hardening FAQ ### 01 What is the most important first step on a new VPS? Disable password SSH and use keys only, with root login off. Password-guessing is the bulk of the automated noise hitting a new server, and keys-only SSH defeats it outright. Do this before anything else. ### 02 Do I still need fail2ban if I use SSH keys? Yes — it reduces log noise and protects any other service you expose, not just SSH. Keys-only SSH stops password brute-force on SSH, but fail2ban blunts attacks across the board and keeps your logs readable. ### 03 Which firewall should I use? On Debian/Ubuntu, ufw is the simplest: default-deny inbound, allow outbound, then open only your SSH port and the specific services you run. The tool matters less than the default-deny posture. ### 04 Are automatic updates safe to enable? For security updates, yes — unattended-upgrades applies patches without breaking configs in the vast majority of cases, and the risk of an unpatched known vulnerability is far greater. Keep backups and it is a clear win. ### 05 How do I know what is exposed? Run ss -tlnp to list listening sockets and the processes behind them. Anything bound to 0.0.0.0 is reachable from the internet; bind what should be local to 127.0.0.1 and firewall the rest. ### 06 Can I really harden a server in an hour? Yes. Keys-only SSH, a firewall, fail2ban, automatic updates and a minimal listening surface take well under an hour and stop the overwhelming majority of opportunistic attacks. Deeper hardening can follow, but this is the high-value first pass. Related guides ## Keep reading [### How to Choose an Offshore Hosting Jurisdiction in 2026 Buying A practical decision framework for picking an offshore jurisdiction: data-retention law, MLAT exposure, DMCA stance, court speed and real-world enforcement — country by country. 6-question FAQ](https://servprivate.com/guides/choosing-an-offshore-jurisdiction) [### VPS vs Dedicated Server for Privacy-Critical Workloads Buying When a VPS is fine, when shared tenancy is a liability, and when bare metal is the only honest answer. Hardware isolation, hypervisor risk, and cost vs threat model. 6-question FAQ](https://servprivate.com/guides/vps-vs-dedicated-for-privacy) [### Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN Operations Why a self-hosted VPN beats commercial providers, and how WireGuard and OpenVPN really compare on privacy, performance and operational risk in 2026. 6-question FAQ](https://servprivate.com/guides/self-hosted-vpn-wireguard-vs-openvpn) [### RTX 4090 vs H100 SXM5 for AI Inference (and Where the RTX 5090 Fits) Buying Buying guide: which NVIDIA GPU for self-hosted LLM, image, video, speech, and fine-tuning workloads in 2026. RTX 4090 vs RTX 5090 vs H100 SXM5 vs dual H100 — VRAM, throughput, $/token, when each wins. 6-question FAQ](https://servprivate.com/guides/rtx-4090-vs-h100-for-ai-inference) [### Offshore Windows RDP for MT4 / MT5 / cTrader Forex Trading Operations Complete guide: why a Windows RDP for Forex trading, how to choose a low-latency offshore jurisdiction, MT4 / MT5 / cTrader / Expert Advisor setup, latency to broker servers, and the no-KYC checkout path. 6-question FAQ](https://servprivate.com/guides/offshore-windows-rdp-for-forex-trading) [### DMCA-Ignored Hosting Explained: What It Really Means in 2026 Buying What "DMCA ignored" hosting genuinely buys you, which jurisdictions actually back it up, the workloads that need it, and the copyright traps the term doesn't cover. 6-question FAQ](https://servprivate.com/guides/dmca-ignored-hosting-explained) [### Anonymous Domain Registration with Crypto: WHOIS Privacy in 2026 Privacy A practical 2026 guide to registering domains without revealing your identity: WHOIS regimes by TLD, registrar choice, crypto payment options, and the operational mistakes that leak you anyway. 6-question FAQ](https://servprivate.com/guides/anonymous-domain-registration-with-crypto) [### Crypto Payments for Hosting: Monero vs Bitcoin vs USDT Privacy How payment coin affects what your host learns about you. Privacy, fees, finality and chain analysis exposure for XMR, BTC and USDT — with a clear recommendation. 6-question FAQ](https://servprivate.com/guides/crypto-payments-monero-vs-bitcoin-vs-usdt) [### Is Offshore Hosting Truly Anonymous? An Honest Answer Privacy Offshore, no-KYC hosting removes the identity a normal host collects — but "anonymous" depends on payment, provider logging and your own opsec. Here is what is really traceable. 6-question FAQ](https://servprivate.com/guides/is-offshore-hosting-truly-anonymous) [### What Is No-KYC Hosting? Definition, Legality & How It Works Privacy No-KYC hosting lets you rent a server with zero identity verification — no name, no email, no ID. Here is exactly what it means, how it works technically, whether it is legal, and how to pick a genuine provider. 6-question FAQ](https://servprivate.com/guides/what-is-no-kyc-hosting) [### Is Offshore Hosting Legal? The Honest 2026 Answer Buying Offshore hosting is legal — for you and for the provider. Here is what the term really means, where the legal line actually sits, the myths worth dropping, and how to use it responsibly. 6-question FAQ](https://servprivate.com/guides/is-offshore-hosting-legal) [### How to Pay for Hosting with Monero (XMR) — Step by Step Privacy A step-by-step guide to paying for a VPS or dedicated server with Monero (XMR): why XMR is the most private option, how to get it, and how the checkout works — from invoice to a running server in minutes. 6-question FAQ](https://servprivate.com/guides/how-to-pay-for-hosting-with-monero) [### How to Host a Website Anonymously — A Practical 2026 Guide Privacy A practical, layered guide to hosting a website with no identity attached: the account, the payment, the domain, the jurisdiction, your connection and the content — each layer explained. 6-question FAQ](https://servprivate.com/guides/how-to-host-a-website-anonymously) [### How to Set Up a WireGuard VPN on a VPS — Step-by-Step Guide Operations Build your own private VPN on a VPS with WireGuard: why a self-hosted VPN beats a commercial one, the full setup from install to a connected client, and how to harden it. 6-question FAQ](https://servprivate.com/guides/how-to-set-up-wireguard-vpn-on-a-vps) [### How to Self-Host an LLM on a GPU Server — 2026 Guide Operations Run your own large language model on a rented GPU server: why self-hosting beats an API, which GPU and model to choose, the setup with Ollama or vLLM, and what it costs. 6-question FAQ](https://servprivate.com/guides/self-host-an-llm-on-a-gpu-server) [### Bulletproof Hosting vs Offshore Hosting — What Is the Difference? Buying Bulletproof hosting and offshore hosting are constantly confused — and they are not the same thing. Here is the real difference, why it matters, and which one you actually want. 6-question FAQ](https://servprivate.com/guides/bulletproof-vs-offshore-hosting) [### How to Buy a VPS with Bitcoin — Step-by-Step (2026) Buying A beginner-friendly walkthrough of buying a VPS with Bitcoin: getting BTC, choosing a plan, paying the invoice, and what you get — a running server with no card and no name attached. 6-question FAQ](https://servprivate.com/guides/how-to-buy-a-vps-with-bitcoin) [### Best Countries for DMCA-Ignored Hosting in 2026 Buying Where to host when you want servers beyond the easy reach of US-style takedowns: the jurisdictions that work, what DMCA-ignored really means, and how to choose. 6-question FAQ](https://servprivate.com/guides/best-countries-for-dmca-ignored-hosting) [### How to Host a Tor Hidden Service (.onion Site) — 2026 Guide Operations Set up a Tor onion service on a VPS: what a hidden service is, why it is the strongest form of anonymous hosting, the full setup, and how to keep it actually anonymous. 6-question FAQ](https://servprivate.com/guides/how-to-host-a-tor-hidden-service) [### Offshore Mail Server Setup — Self-Host Private Email in 2026 Operations Run your own private email server on an offshore VPS: why self-host email, what you need, the realistic setup with an all-in-one mail stack, and how to get deliverability right. 6-question FAQ](https://servprivate.com/guides/offshore-mail-server-setup) [### Crypto Node Hosting Guide — Run a Blockchain Node on a VPS Operations How to host a blockchain node on a server: why run your own node, sizing the server for Bitcoin, Ethereum, Monero and more, the setup, and keeping it private. 6-question FAQ](https://servprivate.com/guides/crypto-node-hosting-guide) [### GPU Hosting for Stable Diffusion — Run Your Own Image Server Operations Run Stable Diffusion on your own GPU server: why self-host image generation, which GPU to pick, the setup with a web UI, and what it costs versus a hosted service. 6-question FAQ](https://servprivate.com/guides/gpu-hosting-for-stable-diffusion) [### Server OpSec — Staying Anonymous When You Run a Server Privacy Operational security for anyone running an anonymous server: the mistakes that deanonymise people, the habits that prevent them, and how to keep identities truly separate. 6-question FAQ](https://servprivate.com/guides/server-opsec-staying-anonymous) [### Seedbox Setup Guide — Build Your Own Private Seedbox in 2026 Operations How to build your own seedbox on a server: what a seedbox is, sizing it, installing a torrent client with a web UI, and keeping it private and secure. 6-question FAQ](https://servprivate.com/guides/seedbox-setup-guide) ## Deploy a server worth hardening Offshore VPS and dedicated servers with full root, deployed in under five minutes — pay in crypto, no identity required. [VPS Plans](https://servprivate.com/vps) [Offshore Hosting](https://servprivate.com/offshore-hosting) [Pricing](https://servprivate.com/pricing) ## Structured data (JSON-LD) ```json { "@context": "https://schema.org", "@type": "Organization", "@id": "https://servprivate.com/#organization", "name": "ServPrivate", "alternateName": "ServPrivacy", "url": "https://servprivate.com", "description": "Offshore VPS & dedicated servers in 7 offshore jurisdictions. No KYC, no logs, crypto only. Privacy by architecture.", "logo": { "@type": "ImageObject", "url": "https://servprivate.com/ServPrivate.webp", "width": 512, "height": 512 }, "foundingDate": "2025", "areaServed": [ { "@type": "Country", "name": "Iceland" }, { "@type": "Country", "name": "Panama" }, { "@type": "Country", "name": "Moldova" }, { "@type": "Country", "name": "Romania" }, { "@type": "Country", "name": "Switzerland" }, { "@type": "Country", "name": "Netherlands" }, { "@type": "Country", "name": "Russia" } ], "knowsAbout": [ "Offshore hosting", "Offshore VPS", "Bare-metal dedicated servers", "DMCA-ignored hosting", "No KYC hosting", "Cryptocurrency payments", "Privacy engineering", "Token-based authentication", "Anonymous domain name registration", "No-KYC domain registrar", "WHOIS privacy", "Cheap .com domains", "Crypto-paid domain names", "NVIDIA GPU compute", "Windows RDP hosting", "Agentic commerce" ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "url": "https://servprivate.com/contact", "availableLanguage": [ "en", "ru", "zh", "es", "fr", "de", "pt", "ar", "ja", "ko", "hi", "id", "it", "tr", "fa", "vi" ] }, "sameAs": [ "https://servprivate.com/canary", "https://servprivate.com/press" ] } ``` ```json { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://servprivate.com/#website", "url": "https://servprivate.com", "name": "ServPrivate", "publisher": { "@id": "https://servprivate.com/#organization" }, "inLanguage": [ "en", "ru", "zh", "es", "fr", "de", "pt", "ar", "ja", "ko", "hi", "id", "it", "tr", "fa", "vi" ] } ``` ```json { "@context": "https://schema.org", "@type": "Article", "headline": "The First Hour of VPS Hardening: A Checklist", "description": "A concrete, ordered checklist to secure a new VPS in under an hour: SSH keys, a firewall, fail2ban, automatic updates, and the attack-surface reduction that stops most opportunistic attacks.", "image": "https://servprivate.com/assets/img/guides/vps-vs-dedicated-for-privacy.webp?v=1777901064", "author": { "@type": "Organization", "@id": "https://servprivate.com/#editorial", "name": "ServPrivate Editorial", "url": "https://servprivate.com/about", "description": "Operator-side editorial team writing about offshore hosting jurisdictions, offshore server architecture, self-hosted privacy stacks and crypto payments.", "knowsAbout": [ "Offshore hosting jurisdictions", "Data retention law", "MLAT and judicial cooperation", "WireGuard and OpenVPN deployment", "Tor relay operation", "Monero and Bitcoin payment privacy", "KVM virtualization and bare-metal hosting", "DMCA-ignored hosting" ], "parentOrganization": { "@id": "https://servprivate.com/#organization" } }, "publisher": { "@id": "https://servprivate.com/#organization" }, "datePublished": "2026-07-14T00:00:00+00:00", "dateModified": "2026-07-14T00:00:00+00:00", "mainEntityOfPage": "https://servprivate.com/guides/first-hour-vps-hardening-checklist", "inLanguage": "en", "keywords": "VPS hardening checklist, secure a new VPS, first hour server security, SSH hardening, fail2ban ufw setup", "articleSection": "Operations", "wordCount": 391 } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the most important first step on a new VPS?", "acceptedAnswer": { "@type": "Answer", "text": "Disable password SSH and use keys only, with root login off. Password-guessing is the bulk of the automated noise hitting a new server, and keys-only SSH defeats it outright. Do this before anything else." } }, { "@type": "Question", "name": "Do I still need fail2ban if I use SSH keys?", "acceptedAnswer": { "@type": "Answer", "text": "Yes — it reduces log noise and protects any other service you expose, not just SSH. Keys-only SSH stops password brute-force on SSH, but fail2ban blunts attacks across the board and keeps your logs readable." } }, { "@type": "Question", "name": "Which firewall should I use?", "acceptedAnswer": { "@type": "Answer", "text": "On Debian/Ubuntu, ufw is the simplest: default-deny inbound, allow outbound, then open only your SSH port and the specific services you run. The tool matters less than the default-deny posture." } }, { "@type": "Question", "name": "Are automatic updates safe to enable?", "acceptedAnswer": { "@type": "Answer", "text": "For security updates, yes — unattended-upgrades applies patches without breaking configs in the vast majority of cases, and the risk of an unpatched known vulnerability is far greater. Keep backups and it is a clear win." } }, { "@type": "Question", "name": "How do I know what is exposed?", "acceptedAnswer": { "@type": "Answer", "text": "Run ss -tlnp to list listening sockets and the processes behind them. Anything bound to 0.0.0.0 is reachable from the internet; bind what should be local to 127.0.0.1 and firewall the rest." } }, { "@type": "Question", "name": "Can I really harden a server in an hour?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Keys-only SSH, a firewall, fail2ban, automatic updates and a minimal listening surface take well under an hour and stop the overwhelming majority of opportunistic attacks. Deeper hardening can follow, but this is the high-value first pass." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://servprivate.com/" }, { "@type": "ListItem", "position": 2, "name": "Privacy Hosting Guides", "item": "https://servprivate.com/guides" }, { "@type": "ListItem", "position": 3, "name": "The First Hour of VPS Hardening: A Checklist", "item": "https://servprivate.com/guides/first-hour-vps-hardening-checklist" } ] } ```