Linux server hardening checklist

Updated October 28, 2026

This is the baseline we apply to every managed server, written so you can apply it yourself on an unmanaged one. It starts where the first hour stops.

Access

• SSH keys only; PasswordAuthentication no; PermitRootLogin prohibit-password.
• One named account per person. No shared logins. Remove accounts the day someone leaves.
• sudo with a password for humans; passwordless sudo only for specific automation commands.
• fail2ban (or CSF on cPanel servers) watching SSH and any control panel login.

Network

• Default-deny inbound firewall. Open only what the server serves.
• Bind databases, Redis and admin interfaces to 127.0.0.1 or a private network, never the public IP.
• Review ss -tlnp after every new install; anything listening that you cannot explain gets turned off.

Updates

• Automatic installation of distribution security updates.
• A monthly window for everything else, including kernel updates and the reboot they need.
• Software installed outside the package manager (language runtimes, panels, apps) gets its own update schedule. Write it down.

Logging and time

• NTP enabled so log timestamps line up across systems.
• journald persistent storage, with a size cap.
• Authentication logs copied off the server, so an intruder cannot quietly erase them.

Services

• Disable what you do not use: systemctl list-unit-files --state=enabled.
• Web servers: TLS 1.2 and 1.3 only, HSTS on HTTPS-only sites, server version banners off.
• PHP: expose_php = Off, disable_functions set for shared-tenant servers, sessions over HTTPS only.

Recovery

• Encrypted, offsite, versioned backups; see backups that actually restore.
• Monitoring for disk space, RAID/SMART health and service uptime, alerting a person.
• A written list of what runs on the server and how to rebuild it.