Security checklist for a new PHP server
Ten simple steps to take on a fresh Ubuntu or Debian server before you put a website on it.
1. Install updates first
Run apt update && apt upgrade right away, then turn on automatic security updates with the unattended-upgrades package.
2. Use SSH keys, not passwords
Log in with an SSH key and set PasswordAuthentication no in /etc/ssh/sshd_config. Keep one working session open while you test, so you don't lock yourself out.
3. Don't work as root
Create a normal user with sudo rights and use that for daily work.
4. Turn on a firewall
Allow only what you need — usually SSH (22), HTTP (80) and HTTPS (443). On Ubuntu, ufw makes this easy.
5. Block repeated login attempts
Tools like Fail2ban or CrowdSec block IP addresses that keep guessing passwords.
6. Give each website its own user
Run each site's PHP under a separate Linux user with its own PHP-FPM pool. If one site is hacked, the others stay safe.
7. Use a supported PHP version
See which PHP versions still get security fixes.
8. Always use HTTPS
Free certificates from Let's Encrypt renew automatically. Redirect all HTTP traffic to HTTPS.
9. Keep databases private
MySQL or MariaDB should listen on localhost only, with a separate database user — and a strong password — for each site.
10. Take backups — and test them
Back up files and databases to a different location every day. A backup you've never restored is only a hope.
ServerNest is being built to do many of these steps for you, with safe defaults. Join early access to try it first.