Whether you're setting up your first web server or simply building another one, it's amazing how many people still run unsecured servers. Just running an old, out-of-date version of PHP can put your web server (and everyone on it) at risk. I previously wrote "Installed Ubuntu 20.04 server? Follow this simple guide for better security", which is a great baseline if you're just getting started.

With that out of the way, let's get into my 5 great ways to secure your web server.

1. Use public key authentication for SSH

Using FTP, HTTP, Telnet or any other unencrypted access is a big no-no. Stick to encrypted protocols: SSH and SFTP for administration and file transfers (or FTPS if you must use FTP), and HTTPS with an SSL/TLS certificate for websites and control panels. These should be your first consideration when administering your server.

Removing password authentication for SSH and using only SSH keys is a great way to prevent unwanted access. SSH keys come in pairs: a private key that stays on your computer and a public key that you place on the server. When you log in, the server checks that you hold the private key matching its public key and only then allows access. Since there's no password to guess, this protects you against brute-force attacks.

To set it up, create a key pair on your computer and copy the public key to the server:

ssh-keygen -t ed25519
ssh-copy-id user@your-server-ip

Some hosting control panels also let you add your public key from the panel. Once you can log in with your key, disable password logins by setting the following in /etc/ssh/sshd_config:

PasswordAuthentication no

Then restart SSH (the service is called sshd on CentOS and AlmaLinux):

sudo systemctl restart ssh

Keep your current session open and test the key login from a new terminal before you log out, so you don't lock yourself out. For extra protection, you can also install Fail2ban to block IP addresses that repeatedly fail to log in.

2. Install ModSecurity

ModSecurity (ModSec for short) is an open-source web application firewall (WAF) for Apache, and it's also available for Nginx. If you already run a server firewall, great: ModSecurity adds another layer on top of it by inspecting web traffic before it reaches your applications. I highly recommend it if you're running any kind of eCommerce script or CMS (content management system), such as WordPress. Pair it with the OWASP Core Rule Set for a solid set of protections out of the box.

3. Make regular backups

Backups are often overlooked: a surprising number of people don't keep regular backups at all. Most server control panels, like cPanel or Plesk, have a simple feature that lets you schedule backups and download them. Store copies somewhere other than the server itself, such as your own computer, an inexpensive external SSD or HDD, or cloud storage. Something as simple as clicking a few buttons can save you hours, sometimes days or weeks, of work.

4. Install a malware scanner like ClamAV

Periodically scanning your server for malware is a great way to keep your server healthy. ClamAV is one of my favorites. If you use Plesk, its extensions catalog also offers malware scanners that you can install in one click.

5. Keep an eye on server logs

Your server logs everything, including who and what connects to it. Checking these logs can reveal key signs that something malicious is going on. A good practice is to install a log analyzer like Graylog and check the results regularly for patterns.

Those are 5 simple tips to keep your server safe from the clutches of evil server pirates.

Also, this should go without saying, but please… use strong passwords. Accounts are most often compromised because of a weak password, and you can avoid that by taking a few seconds to create a strong one.