Your VPS arrives as a blank box with an IP address and a root password. It works, but it is not ready for traffic. This guide walks through three steps: secure the system, allocate resources, and configure services. Each step is a checkpoint you can verify before handing the server to users.
Step 1: Harden the base system
Most attacks target default configurations. A fresh VPS often runs with password login enabled, outdated packages, and a root account that accepts remote connections. Change that before you install anything else.
Create a limited user
Log in as root and create a standard user. This account handles daily tasks without the blast radius of root.
adduser deploy
usermod -aG sudo deploy
Set a strong password for this account. Then lock the root account so it cannot be used for remote logins.
passwd -l root
Disable password authentication
Edit the SSH config. Find the lines that control authentication and change them to match the example below.
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
Restart the SSH service and test the new key-based login from a separate terminal before closing your current session.
systemctl restart sshd
Update the package index
Keep the system current. Outdated packages carry known vulnerabilities that scanners flag within hours of deployment.
sudo apt update && sudo apt upgrade -y
Enable a firewall
A firewall filters incoming traffic before it reaches your services. Configure it to allow only what you need.
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
Step 2: Allocate resources correctly
Resource allocation is a planning task, not a one-time setting. You need to match CPU, RAM, and disk to your workload. A small site with a few visitors does not need a large VPS, but a busy application will suffer if the host is undersized.
Check what you have
Use built-in tools to see current usage.
free -h
df -h
top
Plan for headroom
Leave at least 20% of RAM free for spikes. If your application uses 2 GB, provision 4 GB or more. Disk should follow the same rule. Keep a buffer for logs, temporary files, and package caches.
Use swap wisely
Swap acts as a safety net when RAM fills. Without it, the system kills processes instead of slowing down. Create a swap file and enable it.
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
Monitor from day one
Install a monitoring tool or set up log rotation. Watch load averages, memory, and disk I/O. A quiet server can turn busy in minutes during traffic spikes or failed jobs.
Step 3: Configure services and access
With the system hardened, you can install the software you actually need. The order matters. Install services, verify they start, then lock down what they expose.
Install only what you need
Every service adds a surface for attack. Install the web server, database, or application stack separately. Keep the base OS lean.
Set up a reverse proxy
A reverse proxy handles SSL termination and routes traffic to your application. It also centralizes logging and caching.
sudo apt install nginx
Secure your database
If you run a database, bind it to localhost unless you need remote access. Change the default credentials and apply security patches promptly.
Back up regularly
Backups are the only recovery path when something breaks. Set up automated snapshots or file-level backups. Test a restore before you need it.
Common pitfalls to avoid
Beginners often skip hardening and jump straight to installing software. That order leaves the server exposed. Another mistake is ignoring swap. A server without swap can crash under a sudden spike. Some people also forget to update the firewall after adding a service. Each new service needs an explicit allow rule.
What to check first
Start with SSH access, then verify the firewall, and finally check resource usage. These three items cover the most common failure points. A secure, monitored, and properly sized server handles traffic without surprises. Follow the steps in order, verify each one, and your VPS will stay stable for months.