First 30 minutes on a new VPS

Your first 30 minutes on a new VPS should cover basic hardening before you install anything else. Patch the system, create a named user with SSH keys, set a simple firewall, and sync the clock. After that, you can install the app or panel you actually need. Scanners reach a fresh public server quickly, so this short sequence matters more than rushing into software.

Log in with the credentials we emailed you and change the root password right away. Install your public key, open a second SSH session that uses the key, and only then turn off password login. Keep the first session open until the key-based login works. If you disable passwords too early and lock yourself out, open a console ticket and we will help you back in.

Why you harden before the application

Leaving password root enabled while you build the site is a common mistake. Automated attacks do not wait for your schedule. Get security patches in place once the time is correct. Unattended security upgrades are fine later; avoid unattended reboots until you have watched the box through at least one kernel update.

A control panel is optional. Many workloads run fine over SSH alone. If you want cPanel or another panel, install it only after the system is patched, the firewall is up, and key login works. Putting a panel on a default-password server is an easy win for attackers.

A simple order that holds up

1. Set the timezone or UTC with timedatectl so logs and certificates stay consistent.
2. Run a full apt or dnf upgrade. Reboot if the kernel requires it while you still have the mailed password.
3. Add a named sudo user and place your key in authorized_keys. Confirm a second SSH session before you continue.
4. Allow SSH from your address and ports 80 and 443 from the world. Close everything else at the firewall.
5. Disable password SSH. Install your application or panel only after that step succeeds.

What shared hosting already handled for you

On shared hosting, isolation and basic lockdown are already in place. On a VPS you have root, so you own these early choices. Our VPS plans are KVM with full root access in New York, London, Frankfurt, Singapore, Tel Aviv, and Tokyo. For the detailed steps, use SSH first login and keys and firewall in the first hour, then move on to WordPress or your stack.