Self-Managed Server Security Basics

A self-managed virtual server gives you administrative control, which also makes operating-system and application security your responsibility unless a separate managed service says otherwise.

Maintained documentation Last reviewed 28 September 2026

Patch the operating system

Install security updates promptly and reboot when an update requires it. Keep a maintenance process appropriate to the workload rather than leaving the server indefinitely unpatched.

Protect administrative access

Use unique credentials.
Prefer key-based SSH authentication where appropriate.
Restrict administrative interfaces by firewall or trusted source where practical.
Do not publish private keys, API tokens or passwords in tickets or public repositories.

Minimise exposed services

Remove or disable services you do not use.
Expose only the application ports that are required.
Do not bind administrative databases or internal services publicly unless the application design explicitly requires it and access is protected.

Keep applications current

Operating-system patching does not update every application. Keep web applications, frameworks, control panels, plugins and dependencies on supported versions and follow their security advisories.

Backups and recovery

Maintain recoverable backups outside the single production filesystem.
Test a restore procedure before an emergency.
Protect backup credentials separately from the production server where practical.

If compromise is suspected

Preserve evidence before making destructive changes where possible, rotate exposed credentials from a trusted device, isolate affected services when necessary, and rebuild from a known-good source if integrity can no longer be trusted.