A fresh VPS is exposed to the internet from minute one. Ten minutes of hardening removes the most common risks. Run these steps as root right after your first login.
1. Change the root password
passwd
Pick a long, unique password — or better, switch to SSH keys (step 4).
2. Update all packages
Ubuntu / Debian:
apt update && apt upgrade -y
AlmaLinux / Rocky / CentOS:
dnf update -y
3. Create a non-root user with sudo
adduser deploy
usermod -aG sudo deploy
(On AlmaLinux/Rocky use the wheel group: usermod -aG wheel deploy.) Do daily work as this user, not root.
4. Use SSH keys and disable password login
Generate a key on your own computer with ssh-keygen, copy it with ssh-copy-id deploy@YOUR_SERVER_IP, then in /etc/ssh/sshd_config set:
PermitRootLogin no
PasswordAuthentication no
Restart SSH with systemctl restart sshd. ⚠ Keep your current session open and test a new login in a second window before you log out — if the key login fails you can still fix it.
5. Enable a firewall
Ubuntu / Debian:
ufw allow OpenSSH
ufw enable
AlmaLinux / Rocky:
systemctl enable --now firewalld
Only open the ports you actually use (e.g. 80/443 for a web server).
6. Optional: fail2ban
apt install fail2ban (or dnf) blocks IPs that repeatedly fail to log in. The default configuration already protects SSH.
7. Keep your own backups
FormoHost does not provide backups unless explicitly stated for a specific product, so schedule your own — even a simple nightly copy of your data to another machine or object storage counts.
Questions while hardening your server? Open a support ticket — we are available 24/7.
