Most Linux servers we’re handed were set up correctly once and then never touched again. Root login over SSH is still on, the firewall allows everything because someone opened a port in 2023 and forgot, there’s no fail2ban, and unattended-upgrades was never enabled so the box is three kernel versions behind. None of that is exotic. It’s the ordinary drift that turns a working server into an easy target. We go through it against the CIS benchmarks, but pragmatically: we harden a server you actually run in production, not a checkbox for an auditor. You get a ranked report of what’s wrong, then we fix the parts that matter.
Full scope, one pass
We run the same scope on every server. It's informed by the CIS benchmarks but trimmed to what matters on a real production web server, not a compliance attestation. Here's what we go through.
- SSH locked to key-only auth, root login disabled, and the daemon scoped to known addresses where that's practical
- Firewall ruleset rebuilt from what's actually running, with everything else closed by default (ufw, firewalld, or nftables)
- fail2ban or CrowdSec configured for SSH and any exposed web logins, with sane ban windows
- Automatic security updates enabled and tested, plus a one-time catch-up on outstanding patches
- Kernel and network sysctl settings reviewed and tightened (IP forwarding, redirects, SYN handling)
- Unnecessary services and packages identified and disabled to cut the attack surface
- sudoers and user accounts reviewed, stale logins removed, password policy set
- auditd or journald configured so security-relevant events are actually logged and kept
- File and directory permissions checked on web roots, config, and secrets
- A full snapshot or backup confirmed before any change, and a rollback path written down
A report and a hardened box
You get a findings report ranked by risk, plus the actual changes applied on the harden tier. Everything we change is written down so your team knows exactly what's different.
Ranked findings report
Every issue sorted by how exploitable it is, in plain English, with the config file or service named.
Change log
A line-by-line record of what we changed, why, and how to roll it back if something downstream breaks.
Firewall and SSH config
The rebuilt rulesets and SSH config, documented, so a future admin understands the intent and not just the syntax.
Patch and update setup
Automatic security updates configured and verified, with a note on which packages need a manual eye.
Monitoring pointers
What to watch and where the logs are, so the hardening doesn't quietly rot the first time someone opens a port.
Walkthrough call
A 30-minute call to hand over the change log and answer questions from whoever runs the box day to day.
Three steps, three days
Three business days from access to a hardened server. We snapshot first, stage the changes, and test that the site still works before we call it done.
Access and snapshot
You give us SSH with sudo. We take a snapshot or full backup and confirm we can roll back before touching anything.
Same dayAudit and hardening
We work through access, network, and OS, applying changes and testing as we go so nothing goes dark.
Days 1-2Report and handover
We write up the findings and the change log, then walk your team through what changed and what to watch.
Day 3Fixed price, no subscription
Hardening a single server starts at $290 and includes the full scope, the changes applied, the change log, and the handover call. Multiple servers or a custom build (a load-balanced pair, a database host with its own profile) are quoted after a quick look. There’s no monthly fee attached; if you want ongoing monitoring afterward we’ll point you at it, but the hardening is a one-time fixed job.
Already breached? Restoration comes first.
If the server is already compromised, mining crypto, or sending spam, hardening it in place just locks the attacker in with you. You need to find how they got in and rebuild clean first. Our server restoration service handles that, and we roll the hardening in once the box is known-clean.
- Full three-layer hardening
- Ranked findings report
- Change log and configs
- Handover call
- Multiple servers or roles
- Per-host hardening profiles
- Shared firewall and access policy
- Consolidated report
Tooling we lean on
How this connects to the rest of the stack
Server hardening is the foundation layer of our website security services, the box underneath everything else. If you run a control panel on top, the panel has its own attack surface, so most clients pair this with CyberPanel hardening or cPanel hardening depending on what they run. Mail is the other common gap; a hardened server still leaks if SPF and DKIM aren’t set, which is why we often follow up with mail server setup. For the day-to-day side (updates, monitoring, the occasional 2am page), see our Linux server support overview. We don’t do compliance attestations or SOC 2 paperwork; if that’s what you need, we’ll harden the box and hand you clean evidence, but the audit letter comes from your assessor, not us. We also handle server-side integrations and automation on the same box. Want it kept that way after the audit? Our Linux server support retainer takes over the patching and monitoring from there. Not sure whether you need one yet? Here are five signs your VPS needs an audit you can check yourself.
Need security for Linux Server sorted?
We'll triage the same day. Send context, screenshots, error messages — whatever you have. No sales calls, no chatbots.