A security checklist for a new server
Everything worth doing in the first hour, in priority order, with the reason for each.
Run this once per new server. It takes under an hour and prevents the great majority of incidents.
Access
SSH keys only, password authentication disabled — guide.
Root login disabled (or key-only) and a sudo user created.
Two-factor on your HostingSwift account — guide.
SSH port moved off 22 only if you understand it is obscurity, not security (it reduces log noise; keys are the real fix).
Network
Default-deny firewall, only served ports allowed — guide.
Services that need not be public bound to loopback or the private mesh — guide.
fail2ban with your own infrastructure whitelisted — guide.
Patching
Automatic security updates enabled.
A reboot policy (kernel updates need a restart) — schedule one.
Third-party software has a known update path.
Services
Everything runs as an unprivileged user.
Only needed services are running —
ss -tulpnto confirm.Databases are not exposed publicly.
Default passwords changed everywhere (databases, panels, apps).
Secrets
No secrets in git or world-readable files.
Env files are
chmod 600.API keys are scoped and rotated — guide.
TLS
Resilience
Backups running, off-site, and tested — guide.
Monitoring on availability and resources — guide.
A rescue path (console/snapshot) confirmed to work before you need it.
Ongoing
Review the activity log and failed logins occasionally.
Rotate credentials on a schedule.
Read the release notes when you upgrade something security-relevant.
Going further
For higher-value hosts, add host intrusion detection (Wazuh) and crowd-sourced blocking (CrowdSec). Both are documented under app hosting.
Related reading