The small business server security checklist
Eight things that actually protect a small business server, what each one prevents, and which ones a good hosting platform should already have done for you.
Server security advice tends to arrive in two unhelpful forms: a 200-item enterprise hardening standard, or a blog post that says "use a strong password" and stops. Neither helps someone running a business website who just wants to know if they are exposed.
This is the middle version — eight controls that prevent the attacks that actually happen to small business servers, in rough order of importance. For each one, we note whether it is something you configure or something the platform should already have handled.
1. Close every port you are not using
Prevents: automated scanning, exposed databases, forgotten admin panels.
Every server on the public internet is port-scanned within minutes of coming online. Not by a person — by bots continuously sweeping the entire address space. What they are looking for is an open database port, an admin interface, or a service with a known vulnerability.
The fix is a default-deny firewall: block everything, then open only 22 (SSH), 80 (HTTP), and 443 (HTTPS). Databases should never be directly exposed; if you need remote access, it should go through a tunnel or a restricted proxy route.
On Simplewala: UFW is configured with default-deny on every server at provisioning. Database ports stay closed unless you explicitly enable remote access through the Front Door proxy.
2. Disable password authentication for SSH
Prevents: brute-force login attacks, credential stuffing.
Password-based SSH is the single most attacked surface on a Linux server. Bots try common username and password combinations thousands of times per day. Key-based authentication removes the attack entirely — there is no password to guess.
On Simplewala: servers ship with SSH key authentication only. Password login is disabled from the start, not as an optional hardening step.
3. Ban repeat offenders automatically
Prevents: sustained brute-force attempts, resource exhaustion from attack traffic.
fail2ban watches your logs and temporarily blocks IP addresses that fail authentication repeatedly. It will not stop a targeted attacker, but it eliminates the constant background noise of automated attacks and keeps your logs readable.
On Simplewala: installed and enabled by default.
4. Apply security updates without thinking about it
Prevents: exploitation of known, already-patched vulnerabilities.
The overwhelming majority of successful server compromises exploit a vulnerability that was patched months earlier. The attacker did not find something new; they found someone who had not updated. Unattended security upgrades close this gap while you sleep.
This applies to your application too. An out-of-date WordPress plugin is a far more common entry point than anything at the operating system level.
On Simplewala: unattended-upgrades is enabled for OS security patches. Application updates — WordPress core, plugins, your own code — remain yours to manage.
5. Serve everything over HTTPS, with HSTS
Prevents: credential interception, session hijacking, content injection on hostile networks.
HTTPS is not just for checkout pages. Any login form sent over plain HTTP can be read on the network path. HSTS goes one step further and tells browsers never to attempt an unencrypted connection to your domain at all.
Certificates should renew automatically. A certificate that expires because a cron job broke is a self-inflicted outage. SSL/TLS explained covers the mechanics.
On Simplewala: Let's Encrypt certificates are issued when you add a domain and renew automatically 30 days before expiry. The Front Door proxy adds HSTS and other security headers.
6. Isolate applications from each other
Prevents: one compromised app becoming a compromised server.
If you run three sites on one server and they share a user account and filesystem, a vulnerability in the least important one gives an attacker access to all three. Container isolation means a compromised app is contained to its own environment.
On Simplewala: every app, database, and service runs in its own Docker container with resource limits. See Docker hosting.
7. Take backups — and restore one
Prevents: ransomware, accidental deletion, a bad plugin update becoming permanent.
Backups are the control that turns a catastrophe into an inconvenience. But an untested backup is not a backup. The single most valuable hour you can spend on security is restoring a backup to confirm it works, before you need it.
Keep backups somewhere the server cannot reach with its own credentials. Ransomware that gets root will happily encrypt the backups sitting on the same disk.
On Simplewala: daily snapshots of files and databases with one-click restore. The full approach is in the backup and restore guide.
8. Know when something changes
Prevents: a small problem running unnoticed for weeks.
Most small business outages are not dramatic. A disk fills up, a container restarts in a loop, memory climbs steadily until something is killed. You want to find out from a dashboard, not from a customer.
On Simplewala: per-container CPU, memory, network, and disk I/O metrics, plus per-domain request statistics from nginx logs, are available on every server.
What is left for you
A well-configured platform covers most of the list above. Four things stay yours no matter what you host on:
- Keeping your application and its plugins updated
- Using strong, unique passwords for your admin accounts, in a password manager
- Enabling two-factor authentication wherever it is offered
- Removing accounts and access for people who no longer need them
Those four are unglamorous and they account for a large share of real-world incidents. No amount of firewall configuration compensates for a reused admin password.
If you are setting up a new server, the getting started guide walks through the first hour, and the features page lists what is configured for you by default.
Keep reading
Ready to simplify your hosting?
Deploy your first server in 90 seconds. All features included.
Start free