The first day on a VPS: what to do right away

A new VPS already answers over SSH, and it is tempting to install the site at once. Close the basics first: a day later, a server with the original password and no updates is interesting to more people than you.

Write down how you log in

Save the IP address, the username, and the way you sign in somewhere other than a chat thread. If access disappears, those three lines will matter before you remember where you put them. Change the password from the welcome email after the first login.

Install updates

On Ubuntu and Debian that is apt update and apt upgrade. On Alma and Rocky it is dnf upgrade. This closes known holes in a system you have not configured yet. A reboot after a kernel update is a normal step while the server is not serving a live site.

Do not live as root

Create a separate user and give that user sudo. Sign in as that user from then on. Keep root for the cases that actually need it. A slip from a normal account does not wipe the whole system, and the login log is easier to read.

A key instead of a password

An SSH key is not guessed by brute force, and it is easier to live with than a long password. Generate a pair on your own computer, put the public half on the server, confirm that key login works, and only then turn password login off. If you disable the password first, you will have to open the server through the console in the panel.

Do not open extra ports

A site usually needs ports 80 and 443. SSH needs 22, or the port you chose yourself. Leave the database on localhost if only the site on this same server talks to it. Do not expose database admin panels and mail ports until you actually need them.

After that, install the web server and move the project. Undoing these steps later is harder than doing them on day one.