A new server is scanned by bots within minutes. These steps remove the most common risks.
1. Update everything
Debian/Ubuntu: apt update && apt full-upgrade -y. AlmaLinux/Rocky: dnf upgrade -y.
2. Use SSH keys, not passwords
Run ssh-keygen -t ed25519 on your computer, copy the key with ssh-copy-id user@server, then set PasswordAuthentication no in /etc/ssh/sshd_config and restart sshd. Keep a second session open while testing.
3. Create a non-root user
Add a user with sudo rights and set PermitRootLogin no once you have verified it works.
4. Enable a firewall
On Ubuntu: ufw allow OpenSSH && ufw allow 80,443/tcp && ufw enable. Only open ports you actually use.
5. Add fail2ban
Install fail2ban to temporarily ban IPs with repeated failed logins.
6. Back up
Keep backups off the server and test restoring them.