Reseller ops · Advanced · one hour
How to secure a new VPS — Whose Reputation Is on the Line at Three in the Morning
The client's server was compromised, and the client is describing it to their insurer as a failure of the company they pay to manage it.
Straight answer first
Do the first hour before the box does anything else, and write it down as a script the first time so the next twenty client servers take five minutes each: full patch, default-deny firewall, key-only SSH with root login disabled, fail2ban, and unattended updates on the security channel. Internet-wide scanners find a new address within hours of boot, so the gap between provisioning and hardening is the riskiest period that machine will ever live through.
What follows is costed in your time as well as described, because the difference between a profitable account and merely a busy one is usually a job like this being done twice.
Written by the Hosting Seller staff · Checked 24 August 2026
Advanced
Bench skill
5
Stages to sign-off
Free
Escalation, included
Tested
Proven on the platform you resell
Budget one hour for the first account and considerably less for the fortieth, because most of what follows belongs in a template rather than in your afternoon.
The runbook stays inside what a reseller actually controls: the panel, the account, the package, and the note you leave behind for whoever picks it up next.
The compromise is your brand's problem
A client does not experience a compromised server as bad luck. They experience it as a failure of the company they pay to manage it, and they describe it that way to their insurer, their customers and the next person who asks them for a recommendation.
That is the real argument for the first hour. Not that attackers are sophisticated — they are mechanical and impersonal, targeting addresses rather than reputations — but that the mechanical basics stop very nearly all of them, so skipping them is a decision you will have to defend.
Write it once, run it twenty times
The first time you harden a server, do it slowly and keep a record of every command. Turn that record into a script, put it in your own repository, and every future client box gets an identical first hour in about five minutes.
Consistency is itself a security property. Twenty boxes configured the same way can be audited, patched and reasoned about as a set; twenty boxes each hardened from memory on a different evening cannot.
The window between provisioning and hardening
Scanners find a new public address within hours. The default-configured week between the client approving the VPS and you securing it at the weekend is not a small risk taken briefly, it is the largest exposure that machine will ever have, taken at the moment nobody is watching it.
So provision when you have the hour, not when the invoice clears. Where that is impossible, put the firewall up and lock SSH within the first ten minutes and leave the rest for later, because those two alone remove most of the surface.
When a managed account is the cheaper answer
Every hardened box you run is an hour a month of patches, log review and backup verification, indefinitely. Multiply that across your client list and compare it honestly against a reseller account where Imunify360 stands on every site and the platform is patched underneath you.
There are client applications that genuinely need root, and for those the hour is worth spending. For a client website it usually is not, and the professional answer is to say so rather than to bill for the maintenance.
Where the platform does the work instead of you
Client-account caps run 100, 250 and 500 across the reseller tiers, with 30 GB, 60 GB and 100 GB of NVMe behind them and 300 GB, 600 GB or 1.5 TB of bandwidth. You know the ceiling before you sell up to it.
Upgrades apply to the account in place, so outgrowing a tier is a line change rather than a migration weekend you have to explain to a client list.
- WHM for you, cPanel for every client
- Private nameservers under your own brand
- Packages you build and name yourself
- Support that answers you and them
Why Hosting Seller
On every plan, as standard
Written as a script, not a lesson
The first hour becomes a file in your repository, because the twenty-first client box should not cost what the first one did.
Figures you can safely repeat to a client
Uptime targets, guarantee windows and account limits are stated as they actually are, so nothing you quote comes back at you later.
Built to survive a growing client list
Where a job repeats once per account, the runbook says so and gives you the version worth templating.
The honest build-or-buy comparison
An hour a month per server, indefinitely, is weighed against a managed account rather than quietly absorbed.
Failure modes, with the cost attached
The mistake in each job is named next to what unpicking it takes, which is usually an evening and usually unbilled.
Costed in your time, not just described
Each stage says what it takes out of your week, so the job can be quoted before it is agreed.
First Steps
From choosing to live
- 1
Patch before anything else touches the network
A full package upgrade on first login. The provisioned image predates today's patches, and that gap is exactly what the scanners are probing for.
- 2
Put the firewall up early, not last
Default deny inbound with explicit allows for SSH and the ports this client's application actually serves. Everything you did not list becomes unreachable, which is the whole point.
- 3
Lock SSH to keys and named users
Key-only authentication, root login disabled, a sudo-capable user per person. Those three together end the credential-guessing game permanently.
- 4
Add fail2ban and unattended security updates
fail2ban bans addresses that keep failing authentication, and unattended upgrades keep the security channel current through the weeks this box is nowhere near front of mind.
- 5
Commit the script and diarise the review
Put the whole sequence in your own repository so box twenty-one is identical to box one. Then diarise the monthly hour for patches, logs and backup verification, and price it into the retainer.
In the Box
Packed with every plan
- Webmail plus IMAP, POP and SMTP on every mailbox you create
- WHM for you, a cPanel of their own for every client
- You set the limits every client account gets
- Setup free, with nothing due before you start selling
- NVMe SSD underneath, LiteSpeed cache in front
- Real people on the counter, for you and for them
- 300 GB, 600 GB or 1.5 TB of bandwidth by tier
- Site migration done for you by our staff, at no charge
- Staging copies, so changes get tested before clients see them
- DDoS filtering handled out at the network edge
Across the Counter
Things people ask us all the time
Is a managed reseller account cheaper than hardening a VPS myself?
Usually, once you count your own time. A hardened box needs roughly an hour a month of patches, log review and backup checks, indefinitely. A reseller account gives you WHM and cPanel with Imunify360 on every site and the platform patched underneath, and that hour goes back into selling.
How do I keep twenty client boxes configured the same way?
Write the first hour as a script the first time and run it everywhere. Consistency is a security property in its own right: identical boxes can be audited and patched as a set, while boxes hardened from memory on different evenings cannot.
Who is liable if a client's server is compromised?
That depends on your contract, but the reputational exposure is yours regardless of what the contract says. Decide in advance what you are undertaking to do, write it into the agreement, and then actually do it on a schedule rather than when you remember.
What upkeep should I put in the retainer?
About an hour a month for a stable server: patches, a look at the logs, and a backup verification. The first-hour hardening is what buys that quiet, and pricing the hour honestly is what stops it silently becoming free work.
Read next
VPS Hosting
KVM virtual servers with root access and DDoS filtering, on one flat price.
Reseller Hosting
White-label hosting with WHM: sell under your own name and bill monthly.
Moving your site to another host? Start with this checklist.
A step-by-step order of work for a move your visitors never spot: which files to copy first, how to carry email across without losing one message, the right moment to repoint DNS, and the two mistakes behind nearly every hour of downtime people ring us about.
Reseller hosting that survives account forty.
Setup free, SSL free on every site you host, and the one control panel the whole trade already knows.
See VPS Hosting plans