How to Secure Your UK VPS in 10 Minutes

Spoiler: 90% of VPS compromises are preventable with these 5 steps.

You've just spun up a new VPS. Before you deploy your application, there are five non-negotiable security steps that every UK hosting setup needs. Here's the 10-minute checklist we use internally at Hostingowy.

---

Why VPS Security Matters — Especially for UK Businesses

Under UK GDPR, you are legally responsible for securing any personal data you process. A compromised VPS isn't just an operational headache — it's a regulatory risk. The ICO can fine up to £17.5 million or 4% of global turnover for inadequate security measures.

The good news? Most VPS compromises come from basic misconfigurations, not sophisticated attacks. Fixing these five areas eliminates 90%+ of common attack vectors.

---

Step 1: SSH Key Authentication Only (2 Minutes)

Password-based SSH is the #1 attack vector for Linux VPS. Automated bots scan the internet 24/7 for port 22, trying common username/password combinations.

Generate an SSH Key Pair

# On your local machine
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/hostingowy

Copy the Public Key to Your Server

ssh-copy-id -i ~/.ssh/hostingowy.pub root@your-server-ip

Alternatively, on most VPS control panels (including Hostingowy's), you can paste your public key during provisioning.

Disable Password Authentication

# Edit SSH config
sudo nano /etc/ssh/sshd_config
Set these values:
PasswordAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes
Restart SSH
sudo systemctl restart sshd

Verify: Try to SSH with a password. If it rejects you, you're safe.

---

Step 2: Configure a Basic Firewall (2 Minutes)

UFW (Uncomplicated Firewall) makes this trivial:

# Install UFW
sudo apt update && sudo apt install ufw -y
Default deny incoming
sudo ufw default deny incoming
sudo ufw default allow outgoing
Allow SSH (change the port if you've moved from 22)
sudo ufw allow 22/tcp
Allow HTTP/HTTPS for your web app
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
Enable the firewall
sudo ufw enable
sudo ufw status verbose

Pro tip: If you're using Docker, don't expose port 2375/2376 to the internet. Only expose ports your application actually needs.

---

Step 3: Automatic Security Updates (1 Minute)

Unpatched software is how 60% of breaches happen. Configure automatic updates:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

This automatically installs security patches nightly. You'll get email notifications for any changes.

For an extra layer, enable automatic reboot for critical kernel updates:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
Find and uncomment:
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

---

Step 4: Install and Configure Fail2ban (3 Minutes)

Fail2ban monitors log files for repeated failed login attempts and temporarily bans offending IPs:

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Check the status:

sudo fail2ban-client status
sudo fail2ban-client status sshd

This alone stops 99% of brute-force attacks. We use a hardened version of this at Hostingowy for all managed VPS plans.

---

Step 5: Harden System-Wide Settings (2 Minutes)

Disable IPv6 if Not Using It

If your application doesn't use IPv6, disable it:

sudo nano /etc/sysctl.conf
Add these lines:
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
Apply
sudo sysctl -p

Harden Kernel Parameters

sudo nano /etc/sysctl.d/99-security.conf
Add:
Prevent IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
Ignore source-routed packets
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
Enable TCP SYN cookie protection
net.ipv4.tcp_syncookies = 1
Apply
sudo sysctl --system

Remove Unnecessary Services

# List all listening services
sudo ss -tulpn
Disable anything you don't need
sudo systemctl disable 
sudo systemctl stop 

---

Bonus: Set Up Basic Monitoring (1 Minute)

Install and configure a simple monitoring agent:

# Install netdata for real-time monitoring
bash <(curl -Ss https://my-netdata.io/kickstart.sh)
Or use Hostingowy's built-in Grafana dashboard
Every VPS comes with free Grafana + Prometheus monitoring

---

The 10-Minute Security Checklist

Print this. Save it. Use it for every new server:

• [ ] SSH: Key-based auth only, password auth disabled
• [ ] Firewall: UFW deny incoming, allow only needed ports
• [ ] Updates: Unattended-upgrades enabled
• [ ] Fail2ban: Installed and monitoring SSH
• [ ] IPv6: Disabled if not needed
• [ ] Kernel: rp_filter, SYN cookies, redirect protection
• [ ] Services: Only necessary services running
• [ ] Monitoring: Netdata or Grafana installed

That's it. 10 minutes, five steps, and your VPS is in the top 10% of secure configurations.

---

What About Managed Security?

If all of this sounds like too much maintenance, Hostingowy's Managed VPS plans include:

• ✅ Automated security patching
• ✅ Pre-configured firewall rules (customisable)
• ✅ Fail2ban with tuned jail configurations
• ✅ Daily off-site backups with ZFS snapshots
• ✅ Real-time Grafana monitoring dashboard
• ✅ UK-based support team (not outsourced)

You get the control of a VPS with the peace of mind of managed security.

---

Ready to deploy a secure UK VPS? Get started at hostingowy.com — your first month is free with code LAUNCH100.

This guide is for educational purposes. Always test security configurations in a staging environment first.