Please understand that we provide unmanaged access to our servers. Once root access to the server is granted, further configuration and security measures are your responsibility. The steps below are the baseline to keep your server safe.

Security Recommendations 

1. Secure SSH access

• Disable root login: Edit /etc/ssh/sshd_config and set PermitRootLogin no. This is one of the single highest-impact steps you can take.
• Use SSH key authentication: Set PasswordAuthentication no and PubkeyAuthentication yes in sshd_config. Keys are far harder to brute-force than passwords.
• Change the default SSH port: Moving SSH away from port 22 reduces automated scan noise. See How do I change my server's port?

2. Set up a firewall

• Software firewall (UFW): Use UFW (Uncomplicated Firewall) or iptables to enforce a default-deny policy - allow only the ports your services actually need. Allow SSH before enabling the firewall, or you will lock yourself out. 
• Contabo network-level firewall: Every Contabo Cloud VPS and Cloud VDS includes a free hardware-level network firewall managed from the Customer Panel. You can manage it under Network Services -> Firewall in the Customer Panel.  
• If you change a port and need to recover access, use VNC. How to connect to your server using VNC

3. Install anti-brute force software

• Fail2ban and cPHulk monitor login attempts and automatically ban IP addresses after repeated failures. If you're locked out of your server, check Fail2ban for an active SSH ban on your local IP.
  
  

4. Enable two-factor authentication (2FA)

• SSH FA (TOTP): For SSH logins, set up time-based one-time passwords (TOTP) using tools like Google Authenticator or Authy. This takes 5–10 minutes to configure and adds a critical second factor to SSH access.
• cPanel/WHM 2FA: Activate 2FA for all admin-level users in cPanel/WHM. Your Contabo Customer Panel also supports 2FA - enable it in account settings. See How do I change my 2-factor authentication settings?

5. Keep software up-to-date

• Enable automatic/unattended security updates for your OS so critical patches are applied promptly without manual intervention.
• For WordPress: outdated versions are a common attack vector. Use Wordfence for enhanced security and keep WordPress core, themes, and plugins current.
• For other platforms: review available security plugins or add-ons for your specific software stack.

6. Install antivirus software

• Run a server-side antivirus such as ClamAV to detect malware and compromised files. Regular scans complement other defenses. 

7. Use strong passwords

• Use unique, complex passwords for all accounts on the server. A password manager helps generate and store credentials securely. This matters especially for database accounts, control panel logins, and application users, not just SSH. 

8. Enable SSL/TLS for all traffic

• Encrypt all web traffic with a valid SSL/TLS certificate. This protects login credentials, API keys, and user data in transit. Use Let's Encrypt for a free, auto-renewing certificate. How do I install an SSL certificate on my Windows server using Let's Encrypt? · How do I install an SSL certificate on my Linux server using Let's Encrypt?

9. Setup regular backups

• Auto backup add-on: Contabo's Auto Backup add-on creates daily snapshots stored on separate, isolated infrastructure outside your server, providing a clean recovery point if you're compromised. What is the Auto Backup add-on and how do I order it?
• Object storage: Schedule encrypted backups to Contabo Object Storage for an additional off-site copy of critical data. 
• Test your restore process. A backup you've never restored from is an untested assumption.
  
  

10. Be cautious with email and web activity

• Do not click suspicious links or open unknown attachments. Avoid visiting untrusted websites from your server environment. Social engineering and phishing remain common attack entry points. 

What to Do If Your Server Has Been Compromised

A compromised server cannot be fully trusted again, even after removing obvious malware. Attackers routinely install backdoors in locations that are difficult to find without forensic tools. Act quickly and follow these steps: 

1. Isolate: Immediately cut off the affected server from the network if possible to prevent lateral movement or further data exfiltration.

2. Analyze: Review logs, running processes, and recently modified files to understand the scope and entry point of the breach.

3. Contain: Block the attacker's access vectors (close exploited ports, revoke compromised credentials, remove malicious files or processes). 

4. Eradicate: For serious compromises, a full OS reinstallation is the only reliable way to ensure all backdoors are removed. You can reinstall your VPS from the Contabo Control Panel - note this deletes all data on the server, so restore from a known-clean backup afterward. 

5. Change all credentials: After recovery, change every password and SSH key associated with the server, including database passwords, application API keys, and control panel logins.

For detailed guidance, see: VPS Got Hacked: Recovery Steps and How to Secure

Further reading

VPS Security Checklist: 9 Essential Steps Right After Setup (2026)

VPS Got Hacked: Recovery Steps and How to Secure

Web Hosting Security: Best Practices, DDoS Protection & What to Look For

Firewall: What is it and how does it protect my VPS/VDS?

Does my server come with a DDoS protection?