An unmanaged VPS gives you full root control — which also means you’re responsible for securing it. These steps cover the essentials that stop the vast majority of automated attacks.
1. Change the default SSH port
Most automated attacks scan port 22 by default. Editing /etc/ssh/sshd_config to use a non-standard port (then restarting the SSH service) filters out a large share of untargeted scanning immediately. This isn’t a substitute for real security, but it does cut down noise in your logs significantly.
2. Disable root password login
In the same config file, set PermitRootLogin prohibit-password (or no if you use a separate sudo user) and PasswordAuthentication no once you’ve set up SSH key authentication. This makes brute-force password attacks against root impossible regardless of password strength.
3. Set up SSH key authentication
Generate a key pair on your local machine (ssh-keygen), then copy the public key to the server with ssh-copy-id user@your-server-ip. Confirm you can log in with the key before disabling password auth, so you don’t lock yourself out.
4. Configure a firewall
Use CSF (ConfigServer Firewall, included with CyberPanel and commonly installed on cPanel servers) or plain ufw/firewalld to allow only the ports you actually need — typically your custom SSH port, 80/443 for web, and your control panel’s port. Deny everything else by default.
5. Install Fail2Ban
Fail2Ban watches log files for repeated failed login attempts and temporarily (or permanently) bans the offending IP at the firewall level. Enable jails for SSH at minimum, and for your web server/control panel login if a jail is available for it.
6. Keep everything updated
Run OS security updates regularly (or enable unattended-upgrades on Ubuntu/Debian for security patches specifically), and keep your control panel, PHP version, and any installed applications current — most VPS compromises exploit known, already-patched vulnerabilities rather than anything novel.