Setting up SSL, backups and a firewall on your server

Having your own server is freedom, but it is also responsibility. Three things separate a well-kept VPS from an accident waiting to happen: the SSL certificate, backups and the firewall. They are not optional or for "later": they are the foundation everything else rests on. And the good news is that getting them ready takes less than you think.

SSL protects your visitors, backups protect you and the firewall keeps out whoever should not get in. All three, always.

SSL: encrypt traffic, and it is free

An SSL certificate enables HTTPS: it encrypts what travels between the browser and your server, shows the trust padlock and is a requirement both for SEO and for browsers not to flag your site as "not secure". With Let's Encrypt it is free and renews itself.

# Install Certbot and issue the certificate for Nginx
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d mydomain.com -d www.mydomain.com

Firewall: close the doors you do not use

A firewall defines which ports are open. The golden rule: close everything and open only what is necessary, usually SSH and web traffic. On Ubuntu, UFW makes it simple.

# Allow SSH and web traffic, and enable the firewall
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

Backups: your safety net

A backup that does not exist the day you need it is the most expensive mistake of all. Three rules: make them automatic, store them outside the server (in another location) and test them, because a backup you never restored is not a backup, it is an illusion. A simple script and a daily cron are enough to start.

#!/bin/bash
# Daily backup of files and database
date=$(date +%F)
tar -czf /backups/site-$date.tar.gz /var/www/mydomain
mysqldump mydb | gzip > /backups/db-$date.sql.gz

Minimum checklist

This is the foundation, but a healthy server is maintained over time: I detailed it in the monthly VPS server maintenance checklist. And remember that security and performance go together; also review your performance optimization.

Order matters, and so does restoring

On a new VPS the order is always the same: first the firewall, because it is better to close before you expose; then SSH with a key and no password; then SSL; and finally automatic backups to another place. It seems like a detail, but it keeps the server from being open, even for a few minutes, while you configure it.

Of the three, the backup is the only one you do not notice until it fails. So it is not enough that it runs: every quarter restore a copy on another server and open the site. If you cannot bring it up from the backup, you do not have a backup, you have files.

A compromised server or a dying disk is solved with a recent, tested copy. Without it, it is solved with a lost weekend.

Do you have a VPS and are not sure it is properly protected? At Codegea we set up SSL, firewall and automatic backups, and maintain your server so you can sleep well. Write to me and let's secure it.