Hosting VPS and Dedicated Spanish version

Support article

How to Harden VPS Security: Complete Guide

Harden your VPS security: fail2ban, UFW, SSH keys, automatic updates and best practices to protect your server.

Published: 11/07/2026 Updated: 11/07/2026

Introduction

A VPS exposed to the internet receives attack attempts constantly: bots trying passwords, scanning ports and looking for vulnerabilities 24 hours a day. That’s the reality of having a server connected to the internet.

The good news is that with a few security measures (what we call hardening) you can reduce the risk to almost zero. In this article you’ll see, in priority order, the most effective actions to protect your VPS.

If you have a miHosting managed VPS, we apply and maintain all these measures for you. This guide is for those who manage their own server.

Level 1: the essentials (do it no matter what)

1. Update the system

The first cause of intrusions is outdated software with known vulnerabilities.

apt update && apt upgrade -y

Configure automatic security updates:

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

2. Use SSH keys and disable password access

Passwords can be guessed. SSH keys can’t. It’s the most effective measure.

Once your SSH keys are configured, edit the configuration:

nano /etc/ssh/sshd_config

And set:

PasswordAuthentication no
PermitRootLogin no

Restart SSH:

systemctl restart ssh

3. Change the SSH port

Bots attack port 22 by default. Change it:

nano /etc/ssh/sshd_config

Port 2222

Remember to open the new port in the firewall before restarting SSH, or you’ll be locked out.

4. Enable the firewall

A firewall closes all ports except the ones you explicitly open. On Ubuntu/Debian:

ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

[Imagen sugerida: screenshot of UFW activation in the terminal]

Level 2: highly recommended (do it soon)

5. Install fail2ban

Fail2ban detects repeated failed access attempts and automatically blocks the IP making them. It’s one of the best tools against brute force attacks.

apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

By default, fail2ban protects SSH. If you changed the port, create a configuration file:

nano /etc/fail2ban/jail.local

[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600

Restart fail2ban:

systemctl restart fail2ban

6. Create a normal user and don’t use root

Always working as root is dangerous. Create a user with sudo and disable root SSH access (we already did this above):

adduser myuser
usermod -aG sudo myuser

7. Close unnecessary ports

Every open port is an entry door. Check which ports are open:

ss -tulpn

Close the ones you don’t need from the firewall.

Level 3: advanced measures (for serious projects)

8. Install a WAF (Web Application Firewall)

A WAF protects web applications from attacks like SQL injection or XSS. Common options:

ModSecurity for Apache and Nginx.
Wordfence or Solid Security for WordPress.

9. Configure SELinux or AppArmor

These systems control what each program can do, limiting damage if one is compromised. AppArmor is active on Ubuntu; SELinux on AlmaLinux/Rocky.

10. Periodic audit

Regularly review:

Access logs: /var/log/auth.log.
System users: cat /etc/passwd.
Running processes: htop.
Open ports: ss -tulpn.

Security checklist

Check these points to have your VPS well protected:

Useful tips

Never use weak passwords. Use a password manager to generate and store robust passwords.
Don’t install software from dubious sources. Always use official repositories.
Back up. Security is never 100%. Always keep a recent copy in case the server is compromised.
Monitor logs. Attack attempts are normal; what matters is that they don’t succeed.
Apply updates regularly. At least once a month.

Common problems

I got locked out of the server

You probably forgot to open the new port in the firewall or disabled the password without having configured the SSH keys. Use the panel’s recovery console or contact support.

I receive many fail2ban alerts

It’s normal. It means fail2ban is doing its job blocking access attempts. If the volume is very high, you can raise the bantime to block longer.

The server is slower after installing fail2ban

It shouldn’t be. fail2ban consumes very few resources. If you notice slowness, check with htop what’s consuming CPU or memory.

I don’t know if my server is secure

You can audit with tools like Lynis:

apt install lynis -y
lynis audit system

It will give you a report with points to improve.

Frequently asked questions

Is a firewall enough?

No. The firewall is important, but only controls connections. You also need SSH keys, fail2ban and an updated system.

Can fail2ban block me?

Yes, if you fail the password several times. If it blocks you, log in via recovery console and unblock with fail2ban-client set sshd unbanip your-ip.

How long until a new VPS is attacked?

Minutes. As soon as your IP is visible on the internet, bots start trying. That’s why the initial setup should be done ASAP.

Can automatic updates break the server?

Security updates rarely cause problems. Major version updates can. That’s why it’s worth separating automatic ones (security only) from manual ones (major versions).

Do I need an antivirus?

On Linux servers it’s not as common as on Windows. More than an antivirus, what’s useful is a web malware scanner (like ClamAV or maldet) if you host WordPress or other apps.

Protect your VPS from day one

VPS security isn’t something you do once and forget: it’s a set of measures applied from day one and maintained over time. Level 1 ones are essential and take little time. Level 2 and 3 give you very solid protection.

If you don’t want to handle all this configuration, at miHosting we offer managed VPS where we apply and maintain all these security measures for you: firewall, fail2ban, SSH keys, automatic updates and monitoring. Open a ticket from your client panel and we’ll help.