Here is something that surprises a lot of people the first time they hear it: within minutes of a new server going online, it starts getting knocked on. Not by a person sitting somewhere typing your address in by hand. By automated scripts that scan the entire internet, all day, every day, looking for anything that answers.
If that sounds alarming, take a breath. It is not a sign that you are being personally targeted, and it is not a sign that something has already gone wrong. It is just what the internet is like. Once you understand that, it stops being scary and starts being something you plan for.
You will be hammered by spurious requests
The moment a server has a public IP address, it becomes visible to everyone, including the automated tools that criminals run to find easy targets. These scripts do not care who you are or what you are running. They simply try thousands of addresses an hour, checking which ones respond.
So from day one, your server's logs will fill up with connection attempts you never invited. Requests for pages that do not exist. Probes on ports you never opened. This is background noise, and it never really stops.
They will try a host of different passwords
Alongside that scanning, there is a specific and much more direct threat: automated password guessing against anything that accepts a login, most commonly SSH, the remote access system almost every server uses.
These tools do not guess randomly. They work through lists of the most common usernames, things like root, admin, and ubuntu, paired with lists of the most common passwords, the same weak and reused passwords that show up in data breaches year after year. It is a numbers game. Try enough combinations against enough servers, and eventually a few will get in.
This is not a hypothetical risk that might apply to you one day. It is happening to every internet-connected server, right now, including the one you are about to set up. The only question is whether it can actually get in.
You must protect yourself: hardening your VPS
The good news is that the vast majority of these automated attempts are looking for the easy cases. A default password. A root account left open to the internet. An old piece of software with a known hole in it. None of these are hard to avoid once you know they matter, and none of them require you to become a security expert.
Making an attacker's job harder is mostly about closing the easy paths in, one at a time:
- Turn off password login over SSH and use key-based authentication instead. A password can be guessed. A properly generated key effectively cannot.
- Disable direct root login. Attackers already know that username. Taking it off the table removes half their guesswork immediately.
- Put a firewall in place that blocks everything by default and only opens the specific doors your server actually needs.
- Add automatic blocking for anything that repeatedly tries and fails to log in, so a scanner gets shut out after a handful of attempts instead of getting unlimited tries.
- Keep the software up to date. Most break-ins exploit a known, already-patched hole in something the owner never got round to updating.
None of this makes a server invincible. Nothing does, and anyone who tells you otherwise is not being straight with you. What it does is take you out of the "easy target" pile, which is where almost all of these automated attempts actually succeed.
Hardening reduces risk. It does not remove it.
This is the part that is easy to skip past, so it is worth saying plainly: even a well hardened server can still have a bad day. Hardware fails. Mistakes happen. Nothing in security is ever "job done, never think about it again."
Which is why the other half of this conversation is backups. Not a folder copied to the same disk it came from, but a proper, tested, offsite copy of anything you cannot afford to lose. Hardening is about making an incident much less likely. A backup strategy is what makes an incident, if it ever happens, an inconvenience rather than a disaster.
The steps above are a starting point, not a complete checklist for your specific setup. See our disclaimer for how to read blog content like this.
How we help
This is exactly where Techster Consulting comes in. We will guide you through hardening your server properly, from your first login onward, explaining each step so you understand why it matters, not just what to type. We will also help you put a real backup strategy in place, so your data is protected as well as your server.
You stay in control of your own server the whole way through. We advise, explain, and point you in the right direction. You implement it, at your own pace, and end up with something you actually understand rather than a black box someone else quietly manages for you.
If you are setting up a new VPS and the idea of it being "attacked" from day one feels daunting, that feeling is exactly why we exist. Have a look at our free guide on securing SSH on a new VPS to see the kind of thing we mean, or get in touch and we will talk through where your setup currently stands.