Some links may earn us a commission at no added cost to you. Providers do not approve our conclusions.
Secure a VPS by starting with CISA’s Cyber Essentials: enforce MFA, automate backups, keep systems patched, control network access with firewall rules, and prepare an incident response plan. Use provider tools like Vultr firewall groups for centralized rule management.
Start with multi-factor authentication for every account that can reach the VPS
CISA Cyber Essentials directs small organizations to require multi-factor authentication (MFA) for all users, beginning with privileged, administrative, and remote access accounts. This applies to the VPS control panel, SSH logins, and any web application backends.
MFA blocks the most common credential attacks. Even if a password is stolen, the attacker cannot authenticate without the second factor. For a small business or freelance operator, enabling MFA on the VPS provider account and on the operating-system level is the single highest-impact control after turning on automatic updates.
- Require MFA for your VPS provider account (e.g., Vultr, BandwagonHost).
- Enforce MFA on SSH by integrating a TOTP or FIDO2 module.
- Apply MFA to any CMS or admin panel that controls business data.
Sources: [1] CISA Cyber Essentials
Configure a cloud firewall group with default-deny rules before exposing any service
Vultr allows you to create a firewall group and link it to multiple compute instances for centralized, scalable network security. A firewall group defines inbound and outbound rules that control traffic before it reaches the instance OS.
Following the CISA principle of knowing who is on your network, build a firewall ruleset that denies all inbound traffic by default, then allow only the ports and sources your business needs. This limits the attack surface and prevents unauthorized services from being accidentally exposed.
- Create a firewall group in the Vultr control panel.
- Set a default-deny inbound policy and allow only required ports (e.g., 80/443 for web, 22 from a static office IP).
- Attach the firewall group to every new VPS instance before installation.
Sources: [1] Vultr firewall documentation[2] CISA Cyber Essentials
Enable automatic updates and remove unsupported software immediately
CISA Cyber Essentials states: "Leverage automatic updates for all operating systems and third-party software" and "remove unsupported or unauthorized hardware and software from systems." On a VPS, this means enabling unattended-upgrades for the OS packages and setting a regular schedule for application dependency updates.
Running an end-of-life operating system (e.g., CentOS 8) or outdated WordPress plugin creates a known-exploited vulnerability. Small businesses should audit installed software quarterly and replace anything no longer receiving security patches. If a provider image is deprecated, migrate before the end-of-support date.
- Enable unattended security upgrades in your Linux or Windows VPS.
- Define an allow list of approved software based on CISA guidance.
- Inventory installed packages quarterly and remove anything unsupported.
Sources: [1] CISA Cyber Essentials
Set up automated, encrypted, and offline backups that you can restore without the production network
CISA recommends "regular automated backups and redundancies of key systems" and "protections for backups, including physical security, encryption and offline copies." For a VPS, this translates to scheduled snapshots or block-storage backups that are encrypted and stored independently of the running instance.
A snapshot alone is not a tested recovery. Operators should periodically restore a backup to an isolated test VPS to confirm that data integrity is intact and that the restoration process does not depend on production services. This exercise directly supports the Cyber Essentials element of protecting data and ensuring crisis response readiness.
- Use provider snapshot tools or an agent-based backup system.
- Encrypt backups at rest and store at least one offline copy outside the provider account.
- Monthly: restore a backup to a fresh, network-isolated VPS to validate recovery steps.
Sources: [1] CISA Cyber Essentials
Build and rehearse an incident response plan that names who to call and which systems to recover first
CISA Cyber Essentials charges leaders with developing an incident response and disaster recovery plan that outlines roles and responsibilities, and testing it often. It also advises organizations to know who to call for help, including outside partners, vendors, government or industry responders, and law enforcement.
For a solo operator or small team, a one-page document can identify the primary contact for the VPS provider, a trusted IT contractor, the steps to isolate a compromised instance, and the order of system restoration based on a business impact assessment. The plan should not live only on the production VPS; keep a printed copy and a copy in a secure offline location.
- Write down the VPS provider support number and account credentials storage location.
- List critical services ranked by recovery priority.
- Test the isolation step: detach a firewall group or power off an instance and verify you can still reach your backup console.
Sources: [1] CISA Cyber Essentials
Limit access to the least privilege necessary and review network connections regularly
CISA directs organizations to "grant access and admin permissions based on need-to-know and least privilege" and to maintain inventories of network connections, including user accounts, vendors, and business partners. On a VPS, this means creating individual non-root user accounts, disabling password-based SSH login, and using key-based authentication with strong passphrase protection.
Review authorized SSH keys, database users, and API tokens at least every quarter. Remove accounts that belong to former employees or contractors. This practice aligns with the "Your Surroundings" element, ensuring that only those who belong on the digital workplace have access to it.
- Disable root SSH login and use sudo for privileged commands.
- Create a separate, limited-privilege account for each person or service.
- Quarterly: audit all users, SSH keys, and API tokens, and revoke unused entries.
Sources: [1] CISA Cyber Essentials
Primary sources
We use provider documentation for product facts and mark time-sensitive details for rechecking.