Bought a VPS? 10 Things You Should Do Right After Launching Your Server

A new VPS may be online and accessible from the internet within minutes, but that does not mean it is ready for production use. Default configurations are designed to get you connected quickly, not necessarily to provide the security and reliability you need long term.

If you have just purchased your first VPS, these ten steps will help you establish a safer and more manageable starting point.

1. Connect to Your VPS via SSH

Most Linux VPS providers give you an IP address and either a root password or an SSH key.

From Linux, macOS, or a modern Windows terminal, you can usually connect with:

ssh root@YOUR_SERVER_IP

Replace YOUR_SERVER_IP with the public IP address assigned to your VPS.

2. Update the Operating System

One of the first things you should do is install available security patches and package updates.

On Ubuntu or Debian:

apt update
apt upgrade -y

On distributions using DNF, such as newer versions of AlmaLinux, Rocky Linux, or Fedora:

dnf upgrade -y

Keeping the operating system updated reduces the chance that your new server remains exposed to vulnerabilities that have already been fixed upstream.

After major updates, check whether the system requires a reboot.

3. Create a Separate Administrative User

Using the root account for everyday administration is generally unnecessary.

On Ubuntu or Debian, create a new user:

adduser adminuser

Then give the account administrative privileges:

usermod -aG sudo adminuser

Replace adminuser with the username you want to use.

4. Configure SSH Keys

Passwords can be attacked automatically by bots scanning public IP addresses. SSH key authentication provides a stronger option for routine server administration.

On your local computer, you can create a modern Ed25519 key with:

ssh-keygen -t ed25519

Then copy the public key to your VPS. On systems where ssh-copy-id is available:

ssh-copy-id adminuser@YOUR_SERVER_IP

Test key-based authentication in a separate terminal before changing the SSH server configuration.

Keep your private SSH key secure and never upload or share it publicly.

5. Restrict Root and Password-Based SSH Login

Once your administrative user and SSH key have been tested, you can harden the SSH configuration.

Open:

/etc/ssh/sshd_config

A common configuration is:

PermitRootLogin no
PasswordAuthentication no

Validate the SSH configuration before reloading the service. The exact service name and commands can vary between Linux distributions.

It is also a good idea to keep your current SSH session open until you have successfully connected again from a second terminal.

6. Configure a Firewall

A VPS connected to the public internet should expose only the services you actually need.

Ubuntu users commonly use UFW. For a basic server that currently needs SSH access:

ufw allow OpenSSH
ufw enable
ufw status

If you later install a web server, you can allow HTTP and HTTPS as required:

ufw allow 80/tcp
ufw allow 443/tcp

Your hosting provider may also offer an external or network-level firewall. Using it alongside the VPS firewall can provide another layer of protection.

7. Check Which Ports Are Open

After configuring the firewall, check which services are listening for incoming connections.

ss -tulpn

Review the output and ask a simple question about every listening service: does this actually need to be reachable?

For a basic web server, you would normally expect services such as SSH, HTTP, and HTTPS. Unexpected database servers, development tools, dashboards, or other network services deserve investigation.

The fewer unnecessary services exposed to the internet, the smaller the server’s attack surface.

8. Enable Automatic Security Updates

Manually updating your VPS is useful, but it is easy to forget.

On Ubuntu and Debian systems, unattended security upgrades can be configured with the unattended-upgrades package:

apt install unattended-upgrades

Automatic updates are particularly useful for security fixes, although production servers may require a more controlled update policy to avoid unexpected application compatibility problems.

Whatever approach you choose, make sure patching is a routine process rather than something you remember only after a vulnerability is announced.

9. Set Up Backups

A VPS is not a backup.

Servers can fail, files can be deleted accidentally, applications can break during upgrades, and accounts can be compromised. You should therefore maintain copies of important data outside the VPS itself.

Depending on your workload, this could include:

• application files;
• databases;
• configuration files;
• user-generated content;
• encryption keys or other essential recovery material stored securely.

Provider snapshots can be useful, but they should not automatically be treated as your only backup strategy.

Most importantly, test the restoration process. A backup that has never been successfully restored is not something you should blindly rely on.

10. Start Monitoring CPU, RAM, Disk and Availability

You do not need an enterprise monitoring platform for your first VPS, but you should know what is happening on the server.

Useful built-in commands include:

top

For memory usage:

free -h

For disk space:

df -h

Disk usage deserves particular attention. A full filesystem can cause databases, websites, package managers, and other services to fail unexpectedly.

For an internet-facing service, external uptime monitoring is also useful because it can alert you when the server becomes unreachable.