# Setting up SSL, backups and a firewall on your server

> How to set up SSL, backups and a firewall on your VPS step by step: a free Let's Encrypt certificate, UFW and automatic backups for a secure server.

URL: https://codegea.com/en/setting-up-ssl-backups-and-a-firewall-on-your-server
Servers · 2026-06-27 · Derian Pinto

Having your own server is freedom, but it is also responsibility. Three things separate a well-kept VPS from an accident waiting to happen: the SSL certificate, backups and the firewall. They are not optional or for "later": they are the foundation everything else rests on. And the good news is that getting them ready takes less than you think.

> SSL protects your visitors, backups protect you and the firewall keeps out whoever should not get in. All three, always.

## SSL: encrypt traffic, and it is free

An SSL certificate enables HTTPS: it encrypts what travels between the browser and your server, shows the trust padlock and is a requirement both for SEO and for browsers not to flag your site as "not secure". With Let's Encrypt it is free and renews itself.

```bash
# Install Certbot and issue the certificate for Nginx
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d mydomain.com -d www.mydomain.com
```

## Firewall: close the doors you do not use

A firewall defines which ports are open. The golden rule: close everything and open only what is necessary, usually SSH and web traffic. On Ubuntu, UFW makes it simple.

```bash
# Allow SSH and web traffic, and enable the firewall
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
```

## Backups: your safety net

A backup that does not exist the day you need it is the most expensive mistake of all. Three rules: make them automatic, store them outside the server (in another location) and test them, because a backup you never restored is not a backup, it is an illusion. A simple script and a daily cron are enough to start.

```bash
#!/bin/bash
# Daily backup of files and database
date=$(date +%F)
tar -czf /backups/site-$date.tar.gz /var/www/mydomain
mysqldump mydb | gzip > /backups/db-$date.sql.gz
```

## Minimum checklist

| Area | Bare minimum |
| --- | --- |
| SSL | HTTPS active and automatic renewal |
| Firewall | Only SSH and web open |
| Backups | Daily, off-site and tested |
| Access | SSH with a key, not a password; no direct root login |
| Updates | System and software up to date |

This is the foundation, but a healthy server is maintained over time: I detailed it in the [monthly VPS server maintenance checklist](/en/vps-server-maintenance-essential-monthly-checklist). And remember that security and performance go together; also review your [performance optimization](/en/supercharge-your-website-key-tips-for-web-performance-optimization).

## Order matters, and so does restoring

On a new VPS the order is always the same: first the firewall, because it is better to close before you expose; then SSH with a key and no password; then SSL; and finally automatic backups to another place. It seems like a detail, but it keeps the server from being open, even for a few minutes, while you configure it.

Of the three, the backup is the only one you do not notice until it fails. So it is not enough that it runs: every quarter restore a copy on another server and open the site. If you cannot bring it up from the backup, you do not have a backup, you have files.

A compromised server or a dying disk is solved with a recent, tested copy. Without it, it is solved with a lost weekend.

---

Do you have a VPS and are not sure it is properly protected? At [Codegea](/en/contact) we set up SSL, firewall and automatic backups, and maintain your server so you can sleep well. Write to me and let's secure it.