This list will help you safely launch a website or small online service on your own VPS without unnecessary technical complexity.
The steps are suitable for popular Linux distributions (Debian/Ubuntu, AlmaLinux/Rocky).
How to use: First, read the short explanation of each step, and then, if necessary, open the “Example/where to do it” section below.
If something seems difficult, contact your provider’s support or your system administrator.
1. Get access to your server
After payment, save your IP address, username, and login method (SSH/panel). Do not share them with third parties.
Example / where to find it:
In the provider’s welcome email or in your Client Area. For Windows — open PuTTY, enter the IP in the Host Name field, and click Open.
2. Update the system
Updates close known vulnerabilities and prepare the server for installing applications.
Example / safe command:
# For Debian/Ubuntu:
sudo apt update && sudo apt upgrade -y
# For AlmaLinux/Rocky:
sudo dnf upgrade -y
3. Create a separate administrative user
Do not work under the “root” user all the time. A separate user reduces the risk of accidental system damage.
Example:
# Create a user and add them to the admin group:
sudo adduser myadmin
sudo usermod -aG sudo myadmin # Debian/Ubuntu
sudo usermod -aG wheel myadmin # AlmaLinux/Rocky
4. Secure server login
We recommend using SSH keys and disabling password login. If this is too complicated for now, use a long, unique password.
Example:
# Generate keys on your PC:
ssh-keygen -t ed25519 -C "your email"
# Upload the public key to the server:
ssh-copy-id myadmin@YOUR_VPS_IP
5. Set correct time and timezone
Correct time is important for logs, certificates, and scheduled tasks.
Example:
sudo timedatectl set-timezone Europe/Kyiv
sudo timedatectl set-ntp true
6. Allow only necessary connections (firewall)
Open only SSH and web ports (80/443), block everything else.
Example (UFW, Debian/Ubuntu):
sudo ufw allow OpenSSH
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable
sudo ufw status
7. Add your domain
Create A/AAAA records in your registrar’s or DNS panel so the domain “points” to your VPS.
Example:
Create an A record: @ → your_IP, and (if needed) www → your_IP. DNS propagation can take up to 24 hours.
8. Get a free SSL certificate
Use Let’s Encrypt for https://. In most panels, it’s done with one click.
Example (without panel):
# Install Certbot (example for Ubuntu):
sudo apt install -y certbot
# Get a certificate for Nginx or Apache:
sudo certbot --nginx -d example.com -d www.example.com
# or
sudo certbot --apache -d example.com -d www.example.com
9. Install web server and PHP
For WordPress or similar CMS, use Nginx or Apache with PHP.
Example:
# Ubuntu:
sudo apt install -y nginx php-fpm
# AlmaLinux/Rocky:
sudo dnf install -y nginx php-fpm
# Start and enable on boot
sudo systemctl enable --now nginx php-fpm
10. Prepare the database
Create a separate user and database for your site. This is safer than working as “root”.
Example (MySQL/MariaDB):
sudo mysql_secure_installation
mysql -u root -p
CREATE DATABASE site_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'site_user'@'localhost' IDENTIFIED BY 'long_password';
GRANT ALL PRIVILEGES ON site_db.* TO 'site_user'@'localhost';
FLUSH PRIVILEGES;
11. Enable backups
Set up daily backups of your website and database. Store copies off-server if possible.
Example:
# Simple DB dump (cron, daily):
mysqldump -u site_user -p'password' site_db > /var/backups/site_db_$(date +%F).sql
# Backup site directory:
tar -czf /var/backups/site_files_$(date +%F).tar.gz /var/www/example.com
12. Enable automatic security updates
Enable automatic updates for security packages so you don’t miss important patches.
Example:
# Ubuntu (unattended-upgrades):
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
13. Basic protection against brute-force attacks
Enable account lockout after several failed login attempts (where supported) or ask support to assist.
Example (Fail2Ban for SSH):
# Ubuntu:
sudo apt install -y fail2ban
# Start the service:
sudo systemctl enable --now fail2ban
14. Configure website email sending
It’s better to use an external SMTP service (or your provider’s mail) and add SPF/DKIM records in DNS for better deliverability.
Example:
In your CMS/plugin, specify your SMTP account details (server, port, username/password, TLS). Add an SPF record (TXT type) in DNS that allows sending via your SMTP service.
15. Create short documentation
Describe where credentials are stored, how to make/restore backups, how to update the system, and whom to contact in case of issues.
Quick template:
• Access: IP, SSH user, SSH key location, panel access
• Domain & DNS: registrar, where records are edited
• Certificates: expiration date, issued by (Let’s Encrypt)
• Backups: where they’re stored, how to restore
• Updates: frequency, responsible person
• Contacts: provider support, administrator
Final self-check: the site opens via https, the domain correctly “points” to the server, backups are created, there are no errors in the panel, and the firewall allows only necessary services.