Server Hardening: Complete Checklist 2026

Server Hardening Checklist 2026: Complete Guide

Server hardening is not a one-time task. It is an ongoing process that starts the moment your server activates and never stops. In 2026, attacks are more sophisticated: automated bots target servers within minutes of deployment, and malware exploits unpatched vulnerabilities.

This checklist is based on CIS Benchmarks and National Cybersecurity Authority (NCA) requirements, with practical applications for Saudi server environments.

Phase 1: Immediately After Activation (First 30 Minutes)

Update the System

# Ubuntu/Debian
apt update && apt upgrade -y

# AlmaLinux/Rocky
dnf update -y

This is the first step before any other configuration. A new server may contain known vulnerabilities in pre-installed packages.

Change SSH Port

# /etc/ssh/sshd_config
Port 2222 # Any number between 1024-65535

The default port (22) receives thousands of brute-force attempts daily. Changing it reduces automated attacks by 95%.

Create a Non-Root User

adduser cloudadmin
usermod -aG sudo cloudadmin

Never use root for daily operations. Create a user with sudo privileges and use it instead.

Disable Root SSH Login

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no

After configuring SSH keys, disable password authentication entirely.

Phase 2: Firewall (First Hour)

Configure UFW (Ubuntu)

ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp # SSH (new port)
ufw allow 80/tcp # HTTP
ufw allow 443/tcp # HTTPS
ufw enable

Configure firewalld (AlmaLinux/Rocky)

firewall-cmd --permanent --remove-service=ssh
firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Rule: Open only the ports you need. Every open port is a potential entry point.

Phase 3: Intrusion Prevention

Install Fail2Ban

apt install fail2ban -y

Configure Fail2Ban to block IPs after failed login attempts:

# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600
findtime = 600

After 3 failed attempts within 10 minutes, the IP is banned for one hour.

Install ClamAV (Virus Scanning)

apt install clamav clamav-daemon -y
freshclam # Update database

Schedule daily scans:

# crontab -e
0 3 * * * clamscan -r /var/www --log=/var/log/clamav/daily.log

Phase 4: Application Security

Secure Nginx

# Hide server version
server_tokens off;

# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'" always;

Secure MySQL/MariaDB

mysql_secure_installation

This command removes anonymous users, disables remote root login, and deletes the test database.

Secure PHP

# php.ini
expose_php = Off
display_errors = Off
log_errors = On
allow_url_fopen = Off
disable_functions = exec,passthru,shell_exec,system,proc_open,popen

Phase 5: Monitoring and Alerts

Tool	Function	License
Fail2Ban	Block intrusion attempts	Free
Logwatch	Daily log reports	Free
Netdata	Real-time performance monitoring	Free
OSSEC	Intrusion detection	Free
Lynis	Comprehensive security audit	Free

Enable Email Alerts

apt install mailutils -y

Connect Fail2Ban and Logwatch to your email address for immediate alerts on suspicious activity.

Phase 6: Backups

• Daily: Full backup of databases and application files
• Weekly: Full system backup
• Off-server: Backup on the same server does not protect against hardware failure

At CLOUD (cloud.net.sa), backup service is available as an add-on starting at affordable pricing — pricing and plans per year with 7-day retention, or affordable pricing — pricing and plans with 30-day retention.

Phase 7: Regular Updates

# Enable automatic security updates (Ubuntu)
apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

Recommended Update Schedule

Type	Frequency	Notes
Security updates	Immediate/automatic	Never delay
System updates	Weekly	Test before applying
Application updates	Monthly	With backup before update
Comprehensive review	Quarterly	Full audit with Lynis

Final Checklist

• [ ] System fully updated
• [ ] SSH port changed
• [ ] Root SSH login disabled
• [ ] SSH key authentication only
• [ ] Firewall configured (UFW/firewalld)
• [ ] Fail2Ban installed and configured
• [ ] Web server secured (Nginx/Apache)
• [ ] Database secured
• [ ] PHP secured
• [ ] Backup configured
• [ ] Automatic updates enabled
• [ ] Monitoring and alerts set up
• [ ] Comprehensive security audit with Lynis

Execute this checklist step by step on every new server. At CLOUD, your server is ready within one minute after payment — start hardening immediately.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.