Ubuntu Server Hardening Checklist for Web Hosting (2026)

Short answer: most break-ins on web servers come through guessed SSH passwords, unpatched software or one compromised site reaching the others. Use SSH keys only, close every port except 22, 80 and 443, install security updates automatically, give each site its own Linux user, and keep backups off the server.

Access

1. 1Log in with SSH keys and turn password login off: PasswordAuthentication no in /etc/ssh/sshd_config.
2. 2Disable direct root login: PermitRootLogin no. Use a named user with sudo.
3. 3Remove accounts and keys for people who no longer need access.

Network

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

sudo apt install fail2ban   # bans IPs that keep failing to log in

1. 1Firewall: only SSH, HTTP and HTTPS open. Databases listen on 127.0.0.1, never the internet.
2. 2Fail2Ban for SSH and web logins.
3. 3A web application firewall in front of PHP sites to stop injection and known exploit patterns.

Updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

1. 1Security updates install automatically; check /var/log/unattended-upgrades/ weekly.
2. 2Reboot for kernel updates on a schedule; needrestart tells you when.
3. 3Keep PHP on a version that still receives security fixes.

Sites

1. 1One Linux user and one PHP-FPM pool per site, so a hacked site cannot read the others.
2. 2Folders 755, files 644, wp-config.php 600, owned by the site user.
3. 3disable_functions for exec, shell_exec, system and passthru where sites don't need them.
4. 4Limit outbound connections from PHP so a backdoor cannot download more malware or send spam.

Recovery

1. 1Daily backups stored off the server, with a restore actually tested.
2. 2Uptime and disk alerts, so you learn about problems before customers do.

On GHP Cloud

All of the above is how GHP servers are built: per-site Linux users and PHP pools with CPU, memory and disk-I/O ceilings, a Caddy edge running the Coraza web application firewall with the OWASP Core Rule Set, five Fail2Ban jails, the Spamhaus DROP list, automatic security updates, an outbound firewall per site, malware scanning with quarantine, and daily backups stored away from the server.

Frequently asked questions

Should I change the SSH port?

It cuts log noise but adds little security. Keys-only login and Fail2Ban matter far more.

Is UFW enough as a firewall?

For which ports are open, yes. It does not inspect web requests; that is the web application firewall's job.

How often should I review a hardened server?

Check update logs and user accounts monthly, and re-run the whole checklist after any major upgrade.