The 10-Minute Production VPS Hardening Checklist

Every week, thousands of developers spin up a new cloud instance on Hetzner, Vultr, or DigitalOcean, type apt update, start their Docker container, and leave the server running.

Within 12 hours, your SSH port will be hammered by automated dictionary bots from Eastern Europe and East Asia.

Here is the exact battle-tested hardening checklist I deploy to every production VPS before running any workload.

1. Ditch RSA — Enforce Ed25519 Only

RSA keys with 2048 or 4096 bits are legacy. Ed25519 offers shorter keys, better performance, and superior resistance to side-channel attacks.

On your local workstation:

ssh-keygen -t ed25519 -C "[email protected]"
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@<YOUR_VPS_IP>

2. Lockdown sshd_config

Never leave default SSH settings intact. Edit /etc/ssh/sshd_config.d/99-hardened.conf:

# Enforce modern crypto & disable passwords completely
PermitRootLogin prohibit-password
PasswordAuthentication no
ChallengeResponseAuthentication no
MaxAuthTries 3
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2

Reload SSH daemon safely (never disconnect your current session until tested):

sshd -t && systemctl restart ssh

3. Strict Firewall Rules with UFW Rate Limiting

A simple ufw enable isn't enough. Use UFW's built-in connection rate limiting:

ufw default deny incoming
ufw default allow outgoing

# Rate limit SSH (allows max 6 connections per 30 seconds per IP)
ufw limit 22/tcp comment 'SSH Rate Limited'

# Allow HTTP/HTTPS
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'

ufw --force enable

4. Fix Memory Exhaustion: ZRAM over Traditional Swap

Budget VPS instances (1GB - 2GB RAM) crash frequently during npm build or docker compose up because Linux Out-Of-Memory (OOM) killer kicks in.

Traditional disk swap on cheap VPS introduces severe disk thrashing. The modern solution is ZRAM—compressed memory paging in RAM with zero I/O wait:

apt install -y zram-tools
echo -e "ALGO=zstd\nPERCENT=50" > /etc/default/zramswap
systemctl restart zramswap

Verify with zramctl. You now have a compressed swap layer that handles memory spikes 10x faster than SSD swap.

5. Enable Unattended Security Upgrades

Don't manually patch zero-day kernel exploits. Let Debian/Ubuntu patch security-critical CVEs automatically at 3 AM:

apt install -y unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades

The All-in-One Automated Bash Hardening Script

If you spin up multiple servers, don't type these manually. Use this automated script:

#!/usr/bin/env bash
# Automated Production VPS Hardening Script
set -euo pipefail

echo "==> Updating package indices..."
apt update && apt upgrade -y

echo "==> Configuring UFW firewall..."
ufw default deny incoming
ufw default allow outgoing
ufw limit 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

echo "==> Setting up automated security updates..."
apt install -y unattended-upgrades fail2ban
systemctl enable --now fail2ban

echo "==> System hardening complete!"

Comprehensive Post-Setup Guide

Want to configure automated off-site rsync backups, wire up private WireGuard tunnels, and setup Docker rootless mode?

Check out our full interactive deployment runbook:
👉 VPS Post-Purchase Hardening Guide & Setup Walkthrough

What security rules do you consider mandatory for day-one server setup? Drop your thoughts below.