[Home](https://anonport.com/) / [Privacy Hosting Guides](https://anonport.com/guides) / The First Hour of VPS Hardening: A Checklist Operations # The First Hour of VPS Hardening: A Checklist Most compromised servers fall to opportunistic scans in their first days online, not to targeted attacks. This ordered checklist covers the first hour on a new VPS: SSH keys, a firewall, fail2ban, automatic updates, and attack-surface trimming. [Read the guide](#guide-body) [FAQ](#guide-faq) ## On this page - [Guide](#guide-body) - [FAQ](#guide-faq) - [Related guides](#guide-related) - [Recommended pages](#guide-cta) No KYC Crypto Only No Logs DMCA Ignored Full Root NVMe SSD 2 min read Updated Jul 2026 On this page [011. Lock down SSH first](#1-lock-down-ssh-first) [022. Put a firewall in front](#2-put-a-firewall-in-front) [033. Add fail2ban](#3-add-fail2ban) [044. Turn on automatic security updates](#4-turn-on-automatic-security-updates) [055. Reduce the attack surface](#5-reduce-the-attack-surface) [06The hour, summarised](#the-hour-summarised) [FAQCommon questions](#guide-faq) [→Recommended pages](#guide-cta) A fresh VPS is scanned and probed within minutes of coming online. The good news: an hour of ordered hardening stops the overwhelming majority of opportunistic attacks. This is the checklist, in the order that matters, for a new privacy-focused server. ## 1. Lock down SSH first Create a non-root user with sudo, add your public key, and then disable password authentication and root login in sshd_config (PasswordAuthentication no, PermitRootLogin no). Keys-only SSH alone defeats the password-guessing that makes up most of the noise hitting your server. Restart SSH and confirm a new session works before closing your current one. The ordered hardening steps that stop the overwhelming majority of opportunistic attacks. ## 2. Put a firewall in front Default-deny inbound, allow only what you need. With ufw: deny incoming, allow outgoing, then allow your SSH port and the specific service ports you run. A firewall turns "every open port is a target" into "only the doors you chose exist," which shrinks the attack surface dramatically. ## 3. Add fail2ban Install fail2ban to watch auth logs and temporarily ban IPs that fail repeatedly. Even with keys-only SSH, it cuts log noise and blunts brute-force attempts against any service you expose. The defaults are sensible; enable the sshd jail and any jails for services you run. ## 4. Turn on automatic security updates Enable unattended-upgrades (Debian/Ubuntu) so security patches land without you remembering. The single most common way servers are compromised is a known vulnerability that had a patch available — automating updates closes that window while you sleep. ## 5. Reduce the attack surface Uninstall services you do not use, bind local-only daemons to 127.0.0.1, and check what is listening with ss -tlnp. Every listening service is a potential entry point; the fewer you run and expose, the less there is to attack. Then set up off-box backups so a compromise is recoverable, not catastrophic. ## The hour, summarised Keys-only SSH, a default-deny firewall, fail2ban, automatic updates, and a minimal listening surface. None of it is exotic, all of it is fast, and together it stops the automated attacks that account for nearly all real-world compromises. Do it before you deploy anything that matters. FAQ ## VPS hardening FAQ ### 01 What is the most important first step on a new VPS? Disable password SSH and use keys only, with root login off. Password-guessing is the bulk of the automated noise hitting a new server, and keys-only SSH defeats it outright. Do this before anything else. ### 02 Do I still need fail2ban if I use SSH keys? Yes — it reduces log noise and protects any other service you expose, not just SSH. Keys-only SSH stops password brute-force on SSH, but fail2ban blunts attacks across the board and keeps your logs readable. ### 03 Which firewall should I use? On Debian/Ubuntu, ufw is the simplest: default-deny inbound, allow outbound, then open only your SSH port and the specific services you run. The tool matters less than the default-deny posture. ### 04 Are automatic updates safe to enable? For security updates, yes — unattended-upgrades applies patches without breaking configs in the vast majority of cases, and the risk of an unpatched known vulnerability is far greater. Keep backups and it is a clear win. ### 05 How do I know what is exposed? Run ss -tlnp to list listening sockets and the processes behind them. Anything bound to 0.0.0.0 is reachable from the internet; bind what should be local to 127.0.0.1 and firewall the rest. ### 06 Can I really harden a server in an hour? Yes. Keys-only SSH, a firewall, fail2ban, automatic updates and a minimal listening surface take well under an hour and stop the overwhelming majority of opportunistic attacks. Deeper hardening can follow, but this is the high-value first pass. Related guides ## Keep reading [### How to Choose an Offshore Hosting Jurisdiction in 2026 Buying How to pick an offshore hosting jurisdiction: data-retention law, MLAT exposure, DMCA stance, court speed and real enforcement, country by country. 6-question FAQ](https://anonport.com/guides/choosing-an-offshore-jurisdiction) [### VPS vs Dedicated Server for Privacy-Critical Workloads Buying When a VPS is fine, when shared tenancy is a liability, and when bare metal is the only honest answer: isolation, hypervisor risk, cost vs threat model. 6-question FAQ](https://anonport.com/guides/vps-vs-dedicated-for-privacy) [### Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN Operations Why a self-hosted VPN beats commercial providers, and how WireGuard and OpenVPN really compare on privacy, performance and operational risk in 2026. 6-question FAQ](https://anonport.com/guides/self-hosted-vpn-wireguard-vs-openvpn) [### RTX 4090 vs H100 for AI Inference (RTX 5090 Included) Buying Which NVIDIA GPU for self-hosted LLM, image, video and speech work in 2026: RTX 4090 vs RTX 5090 vs H100 SXM5 on VRAM, throughput and $/token. 6-question FAQ](https://anonport.com/guides/rtx-4090-vs-h100-for-ai-inference) [### Offshore Windows RDP for MT4 / MT5 / cTrader Forex Trading Operations Why a Windows RDP for forex trading, how to pick a low-latency offshore jurisdiction, MT4/MT5/cTrader and EA setup, broker latency, and the no-KYC checkout. 6-question FAQ](https://anonport.com/guides/offshore-windows-rdp-for-forex-trading) [### DMCA-Ignored Hosting Explained: What It Really Means in 2026 Buying What DMCA-ignored hosting really buys you, which jurisdictions back it up, the workloads that need it, and the copyright traps the term does not cover. 6-question FAQ](https://anonport.com/guides/dmca-ignored-hosting-explained) [### Anonymous Domain Registration with Crypto — 2026 Guide Privacy Register a domain without revealing your identity: WHOIS regimes by TLD, registrar choice, crypto payment options, and the mistakes that leak you anyway. 6-question FAQ](https://anonport.com/guides/anonymous-domain-registration-with-crypto) [### Crypto Payments for Hosting: Monero vs Bitcoin vs USDT Privacy How the coin you pay with changes what your host learns about you: privacy, fees, finality and chain-analysis exposure for XMR, BTC and USDT. 6-question FAQ](https://anonport.com/guides/crypto-payments-monero-vs-bitcoin-vs-usdt) [### Is Offshore Hosting Truly Anonymous? An Honest Answer Privacy Offshore no-KYC hosting removes the identity a normal host collects, but anonymity also depends on payment, logging and your own OpSec. What is traceable. 6-question FAQ](https://anonport.com/guides/is-offshore-hosting-truly-anonymous) [### What Is No-KYC Hosting? Definition, Legality & How It Works Privacy No-KYC hosting means renting a server with zero identity checks: no name, email or ID. What it means, how it works, whether it is legal, how to choose one. 6-question FAQ](https://anonport.com/guides/what-is-no-kyc-hosting) [### Is Offshore Hosting Legal? The Honest 2026 Answer Buying Offshore hosting is legal, for you and the provider. What the term means, where the legal line sits, the myths worth dropping, how to use it responsibly. 6-question FAQ](https://anonport.com/guides/is-offshore-hosting-legal) [### How to Pay for Hosting with Monero (XMR) — Step by Step Privacy Step by step: paying for a VPS or dedicated server with Monero (XMR). Why XMR is the most private option, how to get it, and how checkout works end to end. 6-question FAQ](https://anonport.com/guides/how-to-pay-for-hosting-with-monero) [### How to Host a Website Anonymously — A Practical 2026 Guide Privacy A layered guide to hosting a website with no identity attached: account, payment, domain, jurisdiction, your connection and the content, each explained. 6-question FAQ](https://anonport.com/guides/how-to-host-a-website-anonymously) [### How to Set Up a WireGuard VPN on a VPS — Step-by-Step Guide Operations Build your own private VPN on a VPS with WireGuard: why self-hosted beats commercial, the full setup from install to a connected client, and how to harden it. 6-question FAQ](https://anonport.com/guides/how-to-set-up-wireguard-vpn-on-a-vps) [### How to Self-Host an LLM on a GPU Server — 2026 Guide Operations Run your own LLM on a rented GPU server: why self-hosting beats an API, which GPU and model to choose, the setup with Ollama or vLLM, and what it costs. 6-question FAQ](https://anonport.com/guides/self-host-an-llm-on-a-gpu-server) [### Bulletproof vs Offshore Hosting — What's the Difference? Buying Bulletproof hosting and offshore hosting are constantly confused, and they are not the same thing. The real difference, why it matters, which one you want. 6-question FAQ](https://anonport.com/guides/bulletproof-vs-offshore-hosting) [### How to Buy a VPS with Bitcoin — Step-by-Step (2026) Buying A beginner-friendly walkthrough of buying a VPS with Bitcoin: getting BTC, choosing a plan, paying the invoice, and getting a server with no name attached. 6-question FAQ](https://anonport.com/guides/how-to-buy-a-vps-with-bitcoin) [### Best Countries for DMCA-Ignored Hosting in 2026 Buying Where to host beyond the easy reach of US-style takedowns: the jurisdictions that work, what DMCA-ignored really means, and how to choose between them. 6-question FAQ](https://anonport.com/guides/best-countries-for-dmca-ignored-hosting) [### How to Host a Tor Hidden Service (.onion Site) — 2026 Guide Operations Set up a Tor onion service on a VPS: what a hidden service is, why it is the strongest form of anonymous hosting, the setup, and how to keep it anonymous. 6-question FAQ](https://anonport.com/guides/how-to-host-a-tor-hidden-service) [### Offshore Mail Server Setup — Self-Host Private Email in 2026 Operations Run a private email server on an offshore VPS: why self-host email, what you need, a realistic all-in-one mail stack, and how to get deliverability right. 6-question FAQ](https://anonport.com/guides/offshore-mail-server-setup) [### Crypto Node Hosting Guide — Run a Blockchain Node on a VPS Operations How to host a blockchain node on a server: why run your own node, sizing the server for Bitcoin, Ethereum, Monero and more, the setup, and keeping it private. 6-question FAQ](https://anonport.com/guides/crypto-node-hosting-guide) [### GPU Hosting for Stable Diffusion — Run Your Own Image Server Operations Run Stable Diffusion on your own GPU server: why self-host image generation, which GPU to pick, the web UI setup, and what it costs versus a hosted service. 6-question FAQ](https://anonport.com/guides/gpu-hosting-for-stable-diffusion) [### Server OpSec — Staying Anonymous When You Run a Server Privacy Operational security for anyone running an anonymous server: the mistakes that deanonymise people, the habits that prevent them, how to keep identities apart. 6-question FAQ](https://anonport.com/guides/server-opsec-staying-anonymous) [### Seedbox Setup Guide — Build Your Own Private Seedbox in 2026 Operations How to build your own seedbox on a server: what a seedbox is, sizing it, installing a torrent client with a web UI, and keeping it private and secure. 6-question FAQ](https://anonport.com/guides/seedbox-setup-guide) [### How to Bypass DPI Censorship with Your Own VPS (2026 Guide) Privacy Bypass DPI censorship with your own VPS: what deep packet inspection detects, which protocol beats which block, and a full VLESS+REALITY walkthrough. 6-question FAQ](https://anonport.com/guides/bypass-dpi-censorship-with-your-own-vps) [### Full-Disk Encryption on a VPS: LUKS Setup Guide Operations Encrypt a VPS with LUKS: encrypted data volumes, full-root encryption with remote unlock over SSH, the settings that matter on a small server, what it stops. 8-question FAQ](https://anonport.com/guides/full-disk-encryption-on-a-vps) [### Hiding Your Origin Server IP: CDNs, Proxies & Leaks Privacy Should you put a CDN in front of an offshore server? What it hides, the abuse desk you inherit, six ways an origin IP leaks anyway, and how to audit yours. 8-question FAQ](https://anonport.com/guides/hiding-your-origin-server-ip) [### VPS Backup Strategy: Encrypted, Off-Site, Restorable Operations Your host keeps no backups. What destroys servers, why push backups die with them, restic vs Borg, the keys everyone forgets, and how to test a restore. 8-question FAQ](https://anonport.com/guides/vps-backup-strategy) [### Self-Hosting Matrix: Federation, Metadata & E2EE Limits Operations What a Matrix homeserver really gives you: Synapse vs Conduit, the server_name you can never change, media that eats the disk, and what federation reveals. 8-question FAQ](https://anonport.com/guides/self-host-a-matrix-server) [### How to Migrate a Website to Offshore Hosting Without Downtime Operations Make a host migration boring: lower the DNS TTL early, run both servers in parallel, freeze writes for minutes, clean the passive-DNS, CT and WHOIS trail. 8-question FAQ](https://anonport.com/guides/migrate-website-to-offshore-hosting) [### How to Self-Host a Crypto Payment Gateway with BTCPay Server Operations Run a non-custodial checkout on an offshore VPS with BTCPay Server, a pruned Bitcoin node, Lightning and Monero: disk sizing, keys, where KYC reappears. 8-question FAQ](https://anonport.com/guides/self-host-a-crypto-payment-gateway) [### VPS DDoS Protection: Where Your Host Stops and Layer 7 Begins Operations Your host filters packet floods; request floods are yours. How L3/L4 scrubbing works, why Layer 7 passes through, and the caching and limits that keep you up. 8-question FAQ](https://anonport.com/guides/surviving-a-ddos-attack-on-your-vps) [### Best Offshore Hosting Providers in 2026: 12 Compared Buying 12 offshore and anonymous hosts compared on signup identity, Monero, jurisdictions, DMCA policy and bare metal — including where AnonPort loses. 6-question FAQ](https://anonport.com/guides/best-offshore-hosting-providers) ## Deploy a server worth hardening Offshore VPS and dedicated servers with full root, deployed in under five minutes — pay in crypto, no identity required. [VPS Plans](https://anonport.com/vps) [Offshore Hosting](https://anonport.com/offshore-hosting) [Pricing](https://anonport.com/pricing) ## Structured data (JSON-LD) ```json { "@context": "https://schema.org", "@type": "Organization", "@id": "https://anonport.com/#organization", "name": "AnonPort", "url": "https://anonport.com", "description": "Offshore VPS & dedicated servers in 7 offshore jurisdictions. No KYC, no logs, crypto only. Privacy by architecture.", "logo": { "@type": "ImageObject", "url": "https://anonport.com/icon-512.png", "width": 512, "height": 512, "caption": "AnonPort" }, "image": "https://anonport.com/assets/img/og-image.jpg", "foundingDate": "2025", "areaServed": [ { "@type": "Country", "name": "Iceland" }, { "@type": "Country", "name": "Panama" }, { "@type": "Country", "name": "Moldova" }, { "@type": "Country", "name": "Romania" }, { "@type": "Country", "name": "Switzerland" }, { "@type": "Country", "name": "Netherlands" }, { "@type": "Country", "name": "Russia" } ], "knowsAbout": [ "Offshore hosting", "Offshore VPS", "Bare-metal dedicated servers", "DMCA-ignored hosting", "No KYC hosting", "Cryptocurrency payments", "Privacy engineering", "Token-based authentication", "Anonymous domain name registration", "No-KYC domain registrar", "WHOIS privacy", "Cheap .com domains", "Crypto-paid domain names", "NVIDIA GPU compute", "Windows RDP hosting", "Agentic commerce" ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "url": "https://anonport.com/contact", "availableLanguage": [ "en", "ru", "zh" ] } } ``` ```json { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://anonport.com/#website", "url": "https://anonport.com", "name": "AnonPort", "publisher": { "@id": "https://anonport.com/#organization" }, "inLanguage": [ "en", "ru", "zh" ] } ``` ```json { "@context": "https://schema.org", "@type": "Article", "headline": "The First Hour of VPS Hardening: A Checklist", "description": "An ordered checklist to secure a new VPS in under an hour: SSH keys, firewall, fail2ban, automatic updates and the attack-surface cuts that stop most attacks.", "image": "https://anonport.com/assets/img/guides/vps-vs-dedicated-for-privacy.webp?v=1785320299", "author": { "@type": "Organization", "@id": "https://anonport.com/#editorial", "name": "AnonPort Editorial", "url": "https://anonport.com/about", "description": "Operator-side editorial team writing about offshore hosting jurisdictions, offshore server architecture, self-hosted privacy stacks and crypto payments.", "knowsAbout": [ "Offshore hosting jurisdictions", "Data retention law", "MLAT and judicial cooperation", "WireGuard and OpenVPN deployment", "Tor relay operation", "Monero and Bitcoin payment privacy", "KVM virtualization and bare-metal hosting", "DMCA-ignored hosting" ], "parentOrganization": { "@id": "https://anonport.com/#organization" } }, "publisher": { "@id": "https://anonport.com/#organization" }, "datePublished": "2026-07-14T00:00:00+00:00", "dateModified": "2026-07-14T00:00:00+00:00", "mainEntityOfPage": "https://anonport.com/guides/first-hour-vps-hardening-checklist", "inLanguage": "en", "keywords": "VPS hardening checklist, secure a new VPS, first hour server security, SSH hardening, fail2ban ufw setup", "articleSection": "Operations", "wordCount": 391 } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the most important first step on a new VPS?", "acceptedAnswer": { "@type": "Answer", "text": "Disable password SSH and use keys only, with root login off. Password-guessing is the bulk of the automated noise hitting a new server, and keys-only SSH defeats it outright. Do this before anything else." } }, { "@type": "Question", "name": "Do I still need fail2ban if I use SSH keys?", "acceptedAnswer": { "@type": "Answer", "text": "Yes — it reduces log noise and protects any other service you expose, not just SSH. Keys-only SSH stops password brute-force on SSH, but fail2ban blunts attacks across the board and keeps your logs readable." } }, { "@type": "Question", "name": "Which firewall should I use?", "acceptedAnswer": { "@type": "Answer", "text": "On Debian/Ubuntu, ufw is the simplest: default-deny inbound, allow outbound, then open only your SSH port and the specific services you run. The tool matters less than the default-deny posture." } }, { "@type": "Question", "name": "Are automatic updates safe to enable?", "acceptedAnswer": { "@type": "Answer", "text": "For security updates, yes — unattended-upgrades applies patches without breaking configs in the vast majority of cases, and the risk of an unpatched known vulnerability is far greater. Keep backups and it is a clear win." } }, { "@type": "Question", "name": "How do I know what is exposed?", "acceptedAnswer": { "@type": "Answer", "text": "Run ss -tlnp to list listening sockets and the processes behind them. Anything bound to 0.0.0.0 is reachable from the internet; bind what should be local to 127.0.0.1 and firewall the rest." } }, { "@type": "Question", "name": "Can I really harden a server in an hour?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Keys-only SSH, a firewall, fail2ban, automatic updates and a minimal listening surface take well under an hour and stop the overwhelming majority of opportunistic attacks. Deeper hardening can follow, but this is the high-value first pass." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anonport.com/" }, { "@type": "ListItem", "position": 2, "name": "Privacy Hosting Guides", "item": "https://anonport.com/guides" }, { "@type": "ListItem", "position": 3, "name": "The First Hour of VPS Hardening: A Checklist", "item": "https://anonport.com/guides/first-hour-vps-hardening-checklist" } ] } ```