Your First VPS: A Practical Setup Guide

Moving from shared hosting to a VPS means you gain control and inherit responsibility. Here is the order we recommend doing things in, and the steps people most often skip.

1. Secure SSH before anything else

The moment your server has a public IP, automated bots start trying to log in. Before you install anything, do these three things:

• Disable root login over SSH and create a normal user with sudo access
• Switch to key-based authentication and disable password login entirely
• Change the SSH port from 22 to something non-standard — this alone stops the majority of automated attempts

If you are on a managed plan with us, tell us and we configure this for you before handover.

2. Set up the firewall

Open only the ports you actually use: SSH on your chosen port, 80 and 443 for web, and 25/587/993 if you run mail. Everything else stays closed. CSF (ConfigServer Security & Firewall) is what we install by default and it is worth learning the basics of.

3. Install a control panel — or deliberately don't

cPanel or DirectAdmin makes day-to-day management far easier and is what most people want. But a control panel also consumes memory that could go to your application. If you are running a single application and are comfortable on the command line, going without frees up meaningful RAM on smaller plans.

4. Configure backups before you need them

This is the step people skip, and it is the one that matters most. A VPS snapshot is not a backup — if the host node fails, the snapshot may fail with it. You want backups stored off the server itself.

Set up: daily automated backups, offsite storage, and — critically — actually test a restore once. A backup you have never restored is a hypothesis, not a backup.

5. Set up monitoring

You want to know your server is struggling before your customers tell you. At minimum, monitor disk space (a full disk takes everything down and is entirely preventable), memory usage, and an external uptime check that alerts you if the site stops responding.

6. Keep it updated

Enable automatic security updates for your OS packages. For everything else, set a monthly reminder to review and apply updates. An unpatched server is the single most common cause of compromise we see when people migrate to us after an incident.

The one thing worth paying for

If you do not want to do any of the above, buy managed support. There is no shame in it — most businesses should be spending their time on their business rather than on server administration. The mistake is buying an unmanaged VPS, not doing this configuration, and assuming it is fine because nothing has broken yet.