We have the choice of engaging services like Forge and ServerPilot, or rolling our own.

Besides pricing, the opacity of what the services are actually providing can be a question -- just how well do they protect?

Would it be equal or better to provide our own securing when using VPS?

To decide, it would be good to understand an apparent baseline for server security.

1 Answer 1


This morning a couple of postings on Craft Slack #devops area linked good descriptions of basic server security, led by @merlingore there.

Their instructions are tilted towards Ubuntu as far as specifics, but should fit for any Linux VPS.

Recording the links here so we don't lose the patterns. I agree with them because they're actually the same as what I came up with personally in arranging VPS security, and they say what's needed clearly and concisely.


and to complete on automatic security updates,


IT's quite worth reading the comments also on each of these, particularly the second. I like the so-often Germanic completeness there, if would suggest that auto-reboot is not just for personal servers.

You can control time-of-day via the auto-cron setting, and if you need 100% uptime, this is very likely better managed (and likely only actually possible for many scenarios) by providing more than one load-balanced server, updating them in a sequence, which again the cron portion could be one way of handling.

  • While both of those links are very interesting, they deal specifically with setting up security manually on your VPS. Does anyone have any comments on whether those articles would work on a server managed by serverpilot? Or indeed whether Serverpilot negates the need to do some of those things? Commented Nov 16, 2016 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.