Disable unused services

Disabling unused services means stopping daemons you do not need and keeping them from listening again after reboot. Every open port is another place someone can probe, and every extra package can bring its own flaws. On shared hosting this is already handled for you. On a VPS with root, you decide what stays running.

List what is listening first

ss -lntup

This shows TCP and UDP listeners on IPv4 and IPv6, plus the process behind each port. You should recognize sshd and your web server right away. You may also see mail if you send from the box, or a database bound only to localhost. Printer discovery and similar helpers rarely belong on a public VPS.

Name each listener before you change anything. If Redis or MySQL is bound to all interfaces because a container published the port, treat that as a problem to fix, not a default to keep.

Stop, confirm, then disable for real

1. Take a snapshot or write down what is running so you can reverse a mistake later.
2. Stop the service you are not using, then confirm SSH, the site, and mail still work.
3. Run systemctl disable --now on that unit so it does not return after reboot.
4. Run ss again and confirm the port is gone. If it comes back, something else is starting it.

Shared hosting and cPanel VPS notes

On shared hosting you cannot turn off FTP for the whole node, and you should not try. You can stop using FTP and prefer SFTP instead. On a VPS, if SFTP is enough, a separate FTP daemon does not need to run. If you send mail through an external provider, a local mail server may not be required at all.

On a cPanel VPS, WHM’s service manager is usually safer than raw systemctl for FTP, CalDAV, or an unused nameserver-related service. If you disable Postfix, WordPress outbound mail needs another provider or messages will sit in the queue. Keep a short note next to the ss output you saved so the next person knows why that service is off.

Once the listening list is short, you can focus on SSH keys and other hardening instead of extra daemons. A quiet ss output is the goal.