VPS · Learn

The first-day checklist for a new VPS

A freshly created VPS is a server open to the internet with nobody looking after it. These are the steps we recommend on day one, before uploading any website: update, create a non-privileged user, enable the firewall, protect access, set up swap and decide where backups go.

Updated 2026-11-10 · By Rómulo Felizola · Leer en español

1. Update the system and create a normal user

apt update && apt upgrade -y
adduser youruser
usermod -aG sudo youruser

Working as administrator (root) turns every mistake into a disaster. Use a normal user and sudo only when needed.

2. Firewall: open only what you need

ufw allow OpenSSH
ufw allow 80
ufw allow 443
ufw enable

That leaves only SSH access and the web (80 and 443) open. Internal applications (a database, a Node server) should listen only on localhost and reach the world through nginx.

3. Stop login attempts with fail2ban

apt install fail2ban -y
systemctl enable --now fail2ban

As soon as a server has a public IP, password guessing begins. fail2ban blocks the addresses that fail several times. It is what we use and it is running on our server.

4. SSH key access

Logging in with an SSH key is much safer than with a password. Create your key on your computer, copy the public part to the server and, once you have checked you can log in with it, turn off password login in the SSH configuration. Do that last step with a second session open: if you get it wrong and close the only one, you are locked out.

5. Swap: a cushion for peaks

fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

Our server has 4 GB of swap and uses 1.3 GB. It keeps a memory spike from killing an application, although it does not replace having enough RAM.

6. Watch the disk: the lesson that cost us an outage

df -h /
du -xh / --max-depth=2 | sort -h | tail -15

On October 23, 2026 our server's disk reached 99% and several sites stopped responding for hours. Logs, old builds and piled-up copies eat the disk without making noise. Since then a weekly automatic cleanup runs and the disk is at 41%. Schedule something similar, or at least an alert when it passes 80%. Details in VPS out of disk space.

7. Backups outside the server

A copy stored on the same server does not protect you if the server fails. Keep at least one encrypted copy somewhere else (your computer or external storage) and test a restore from time to time: a copy you have never restored is a hope, not a copy.

If you don't have a server yet:KVM 2 VPS at Hostinger

Frequently asked questions

Does this make my VPS secure?

It leaves it much better than a freshly created one, but security is a process: keep the system updated, review the logs and do not leave unused services open. This list is the minimum, not the maximum.

Do I need the firewall if I already use fail2ban?

Yes, they do different things: the firewall decides which ports are reachable and fail2ban reacts to failed attempts on the ones that are.

And if I don't want to run a server?

That is a reasonable decision. With managed hosting the provider takes care of all this. We offer website maintenance (in Spanish) for people who have a site and do not want to look after the server.