Server hardening is not optional for self-managed VPS — it's what separates operators who run affiliate proper

Server hardening is not optional for self-managed VPS — it's what separates operators who run affiliate properties for years from those who get compromised in months.

Minimum security baseline for every new VPS:

1. Disable root SSH login. Create a non-root user with sudo privileges.
2. SSH key authentication only. Disable password authentication entirely.
3. Change default SSH port (from 22 to anything 1024-65535). Reduces automated scan noise by 95%.
4. UFW firewall: allow only SSH, HTTP, HTTPS. Block everything else.
5. Fail2ban: automatically ban IPs after repeated failed SSH attempts.
6. Unattended-upgrades: auto-apply security patches to the OS.
7. Disable unused services. Check `systemctl list-units --type=service --state=running` after initial setup.

What most people skip and shouldn't:
— Regular log review. `auth.log` shows who's probing your server.
— SSH access auditing. Limit which users can SSH and from which IPs if possible.

Setting this up takes 45 minutes once. Not doing it is how you lose a site you've spent years building.