8 reasons a VPS makes your website more secure

A VPS can make your website more secure than shared hosting. Your server is kept apart from other customers' servers, and you decide every security setting yourself. On a VPS you manage yourself, that only works once you set up the protection and keep the server updated.

Many threats to website security can compromise a Linux server and its data, from malware to DDoS attacks. Unlike shared hosting, a virtual private server (VPS) gives you full control over how you deal with them.

How a VPS protects your website

A VPS protects your website in eight ways:

• Isolation from other customers: your server's resources and problems stay separate from theirs.
• Full control over security settings: you get root access to the whole server.
• Your own firewall rules: you decide which addresses can reach your server.
• Updates on your schedule: you install security fixes as soon as they come out.
• Encryption with SSL certificates: you choose and install the certificate that protects your visitors' details.
• Snapshots and backups: you can roll back to an earlier copy of your server.
• Malware protection you choose: you pick the scanner and the layers around it.
• Certified data centres: your server runs in our ISO 27001 certified European data centres.

1. Your server is kept apart from other customers

On shared web hosting, many websites run on the same server and share its resources. Our VPS gives you a fixed share of processor power, memory and storage that other customers on the same hardware can't use. It also keeps their problems away from you: performance issues or security weaknesses on one VPS don't affect the others on the same server.

2. You decide the security settings

With full root access on our VPS, meaning admin rights over the whole server, you set every rule yourself. You choose the operating system and install the software you need. You can block addresses you don't trust, switch off services you don't use and limit who can reach the admin areas of your site.

Locking a server down like this is called hardening. On a new VPS, installing and configuring the security is up to you.

3. You set your own firewall rules

A firewall decides which connections can reach your server. On our VPS, you add firewall rules in the control panel that only let in the IP addresses you trust, on the protocols and ports you choose. Traffic from every other address is blocked. A port is the numbered entry point a service listens on, such as your website or SSH.

Your website has to stay open to every visitor, so make sure your rules leave the ports it uses open to all addresses. Limit admin access, such as SSH, to the addresses you trust. That cuts down unauthorised access, brute-force attempts and the automated scanning that runs across the whole internet.

The rules only cover incoming connections, so your server can still connect out as normal. Add your own IP address before you save a rule that limits admin access, so you don't lock yourself out. If a rule does lock you out, you can change it in the control panel. If you can't get in at all, our support team can reset your firewall rules.

4. You install updates as soon as they come out

Security updates close weaknesses in software once they're known. On a VPS, you install them yourself, for the operating system, the web server, the database and your content management system (CMS). When a weakness turns up in software you use, you can install the fix straight away, without waiting for a hosting provider's schedule.

On a VPS you manage yourself, keeping the server updated with your Linux distribution's package manager is your job, so set a routine and stick to it. Ubuntu, for example, applies security updates automatically, but that's only part of the routine: your CMS still needs you to update it. If you'd rather have security patches installed for you, a Managed VPS does that automatically.

5. You control the encryption on your website

SSL (Secure Sockets Layer) certificates encrypt the connection between your server and your visitors, so passwords and payment details can't be read by anyone in between. That matters if your website takes payments or collects personal details. In Chrome, your visitors can see that the connection is secure from the symbol to the left of the web address.

On a VPS, you choose the certificate, install it yourself and make sure it renews before it expires. On a Managed VPS, your website is secured automatically with a certificate from Let's Encrypt.

6. You can roll back with snapshots and backups

If an attack or a failed update breaks your server, a recent copy gets you back. On our VPS, you can keep a copy with VPS backups and snapshots, and each suits a different job. A snapshot captures the whole server, with its configuration, software and data, in a few seconds. You can keep one snapshot at a time, and it's stored for 24 hours, so take one just before an update or another big change.

For a longer safety net, keep regular backups of your server as well. You add it in your VPS dashboard. Restoring a snapshot or a backup overwrites everything on the server, so save anything newer somewhere else first.

7. You choose your own malware protection

On a VPS, you choose your own protection against malware. That gives you more say than shared hosting, and it also means installing that protection is up to you. Use several layers rather than one tool. Run a malware scanner made for Linux servers and limit access to the people who need it. Each layer gives you another chance to spot malware and stop it before it does harm.

8. Your server runs in certified data centres

Some security is out of your hands, like who can get into the building where your server stands. Our VPS runs in our European data centres, which are ISO 27001 certified. We run our own OpenStack platform there, so your data doesn't pass through a third-party cloud provider.

Who looks after VPS security?

On our VPS, you do. It's an unmanaged server, so you're responsible for software updates and security patches, backups of your data and monitoring the server. Our support team can help with access problems and point you in the right direction when you need it, but can't configure or manage an unmanaged server for you.

How to secure a VPS: the first steps

Do these on a new VPS before you put your website on it. You work on the server over SSH, an encrypted connection from your own computer. Switch off a way of logging in only after you've checked that the new one works, or you can lock yourself out. Your Linux distribution's own guide gives the commands.

1. Connect to your server over SSH with the IP address from your VPS dashboard and the administrator login you created when you completed the setup there.
2. Change the root password to a strong password you don't use anywhere else.
3. Create a new user with admin rights for everyday work.
4. Check that you can log in as the new user, then switch off direct root login and restart SSH.
5. Set up an SSH key, a pair of key files that lets your own computer log in without typing a password, test that you can log in with it, then switch off password login and restart SSH.
6. Install the latest system updates, and keep installing them as they come out.

Once these steps are done, add your firewall rules, and take a snapshot before you install your website, so you have a copy to go back to for the next 24 hours.

VPS or Managed VPS: which is safer for you?

Which is safer for you depends on who does the security work, as both give you your own server in our European data centres. Who does it is one of the differences between a VPS and a Managed VPS: on a VPS, you do it yourself, and on a Managed VPS, we do it for you. The table shows how that work is split.

Our advice: choose a VPS if you're comfortable managing a server and keeping it updated, or have someone on your team who is. You keep full control over your security. If nobody wants that job, choose a Managed VPS. You get the same separate server, and we keep it patched, monitored and backed up. Because we set it up and maintain it, you may have less say in how it's configured.

Your own server with full root access, your choice of Linux distribution and NVMe SSD storage. Set firewall rules in the control panel, take snapshots and run it all in our ISO 27001 certified European data centres. Pay monthly and cancel at any time.

If you've chosen to do the security work yourself, install the software your website needs next, then point your domain to your VPS by updating its DNS records to your server's IP address. If you'd rather hand the server work over from the start, choose a Managed VPS and we'll look after the server for you.