Changing the SSH port is not a plan

Changing the SSH port moves the service off the default and cuts noise from simple scanners. It does not replace key-based login, a disabled root password, or a console you can already reach. On a LogicWeb VPS or dedicated server you control the daemon; shared hosting does not offer a custom SSH port as the product. Treat the port change as optional after the real controls work.

What actually protects SSH

Use public-key authentication and turn password login off only after keys work from a second session. Set PermitRootLogin to no or prohibit-password, and log in as a normal user. Keep a tested break-glass path: IPMI on dedicated hardware, or the provider console on a KVM VPS. fail2ban or your distro equivalent should watch the port you actually use. A non-standard port with a password is still a password that can leak. Keys on port 22 behind a tight allow-list are already a solid baseline.

How lockouts usually happen

People set Port 2222, reload sshd, and leave the cloud security group open only on 22. Others close 22 in the firewall before the new port answers from another network. Either way you need console access to recover. Changing the port without telling the team also breaks deploys at the worst time. Record the port in sshd_config, the firewall or security group, and the runbook before you rely on it.

If you still want a different port

Do this only on a VPS or dedicated server you own, and only after keys and console already work on 22.

1. Confirm key login works on 22 and that console or IPMI still opens a shell.
2. Allow the new port from your addresses in the firewall or security group.
3. Add the Port line in sshd_config, reload sshd, and connect from a second session while the first stays open.
4. Only then close 22, and tell everyone who deploys or supports the box.

The running daemon is the source of truth, not the file you think you saved. Check it with:

sshd -T | grep -E ‘^port |^passwordauthentication|^permitrootlogin|^pubkeyauthentication’

Paste that output if something looks wrong. A panel screenshot is not the same as sshd -T. High ports are quieter; keys are what make the login safe. A password on 2222 is still a password. PHP disable_functions and similar web tweaks are a separate topic, so do not retune sshd because a generic harden list bundled them together.