Tutorials

How to install Nginx on Ubuntu VPS – web server setup illustration

How to Install Nginx on Ubuntu VPS: A Beginner’s Guide

If you just bought your first VPS, learning to install Nginx on Ubuntu is one of the most useful first skills you can pick up. This guide shows you how to install Nginx on an Ubuntu VPS from start to finish. Nginx is fast, lightweight, and powers a huge share of the world’s busiest websites, which makes it an excellent choice for beginners and experienced users alike. Prerequisites Before you begin, make sure you have the following: If you have not connected to your VPS yet, open your terminal and run: Replace your-server-ip with the actual IP address your hosting provider gave you. Accept the security prompt if this is your first connection. Step 1: Update Your Package Lists It is good practice to update your package lists before installing anything. This ensures you get the latest available version of Nginx from Ubuntu’s repositories. You can also upgrade already-installed packages while you are at it, though this is optional: Step 2: Install Nginx Installing Nginx on Ubuntu is a single command: The -y flag tells the installer to answer “yes” to any confirmation prompts automatically. The installation usually takes less than a minute. Ubuntu will also start the Nginx service automatically once the installation finishes. Step 3: Start and Enable the Nginx Service Even though Nginx usually starts on its own, it is worth confirming it is running and making sure it starts automatically whenever your server reboots: Now check the service status: You should see the word active (running) in green. Press q to exit the status view and return to your command prompt. Step 4: Allow Web Traffic Through the Firewall Ubuntu’s built-in firewall, UFW, blocks incoming connections by default on many VPS images. If your provider enabled UFW, you need to open the HTTP (port 80) and HTTPS (port 443) ports so visitors can reach your site. First, check whether UFW is active: If it says inactive, you can skip this step or enable the firewall later. If it is active, allow Nginx traffic with: This single rule opens both port 80 and port 443. If you only want plain HTTP for now, use sudo ufw allow ‘Nginx HTTP’ instead. Then reload the firewall: Step 5: Verify Nginx Is Working Open your web browser and visit your server’s IP address: You should see the default Nginx welcome page with the message “Welcome to nginx!”. If the page loads, congratulations — your web server is up and running. You can also verify from the command line: A response starting with HTTP/1.1 200 OK confirms Nginx is serving pages correctly. Step 6: Learn the Basic Nginx Management Commands You will use these commands constantly as you manage your server, so it is worth memorizing them: The reload command is especially handy. Whenever you change a configuration file, run sudo nginx -t first to check for errors, then sudo systemctl reload nginx to apply the changes without any downtime. Step 7 (Optional): Set Up a Simple Server Block Nginx uses “server blocks” (similar to Apache’s virtual hosts) to host multiple websites on one server. Here is how to create one for a practice domain: Replace example.com with your real domain name and point your domain’s DNS records at your server’s IP address, and your site will go live. Troubleshooting Common Problems The welcome page does not load. Double-check that Nginx is running (sudo systemctl status nginx) and that your firewall allows HTTP traffic. Some providers also have an external firewall or security group in their control panel — make sure port 80 is open there too. “403 Forbidden” error. This usually means a file permission problem. Your web files should be readable by the www-data user that Nginx runs as. A quick fix for a standard site directory is: “Address already in use” error. Another program (often Apache) may already be listening on port 80. Check with sudo ss -tlnp | grep :80 and stop the conflicting service before starting Nginx. Conclusion: Install Nginx on Ubuntu in Minutes You now know how to install Nginx on an Ubuntu VPS, open the firewall, verify the installation, and manage the service with basic commands. From here, the natural next steps are pointing a domain name at your server, setting up additional server blocks, and adding free HTTPS encryption with a certificate. Nginx is a solid foundation — take your time exploring its configuration, and always test with sudo nginx -t before reloading. Frequently Asked Questions Is Nginx better than Apache? Neither is universally better — it depends on your needs. Nginx generally handles high numbers of simultaneous connections with lower memory usage, which is why it is popular for busy sites and as a reverse proxy. Apache is known for its flexibility and extensive module system. For a beginner hosting a typical website on a VPS, Nginx is an excellent and simple choice. Do I need a domain name to use Nginx? No. You can access your server directly through its IP address, which is perfect for learning and testing. You only need a domain name when you want visitors to reach your site through a memorable address instead of a raw IP. Where are Nginx configuration files stored? The main configuration file is /etc/nginx/nginx.conf. Individual site configurations live in /etc/nginx/sites-available/ and are activated by linking them into /etc/nginx/sites-enabled/. The default website files are served from /var/www/html/. How do I add HTTPS to my Nginx site? The most common free option is Let’s Encrypt, which you can set up with the Certbot tool. After installing Certbot’s Nginx plugin, a single command can obtain a certificate and configure Nginx to use it automatically. Always back up your working configuration before making HTTPS changes for the first time.

How to Install Nginx on Ubuntu VPS: A Beginner’s Guide Read More »

How to secure your VPS – server hardening illustration

How to Secure Your VPS: 12 Essential Steps for Beginners

The moment your VPS goes online, automated bots start probing it. They scan for open ports, guess passwords, and hunt for unpatched software — thousands of attempts per day, on every server, everywhere. This is not personal; it is just how the internet works. The good news: basic server hardening stops the vast majority of these attacks, and none of it is difficult. Follow these 12 essential steps to secure your VPS and your server will be dramatically safer than the average unprotected machine. Before you begin: You will need root or sudo access over SSH. Work through the steps in order, and never lock yourself out — when changing SSH settings (steps 4–5), always keep your current session open and test a new login before closing it. If your provider offers snapshots, take one before you start. Step 1: Update Your System Fresh VPS images are often weeks or months behind on security patches. Update everything first: (On RHEL-based systems like AlmaLinux or Rocky Linux, use sudo dnf update -y instead.) Reboot afterward if the kernel was updated: sudo reboot. Step 2: Create a Non-Root User With Sudo Access You should not do daily work as root — one typo as root can destroy the system, and attackers specifically target the root account. Create your own user: (On RHEL-based systems, use usermod -aG wheel deploy.) Log in as this user from now on and use sudo when you need elevated privileges. Step 3: Set Up SSH Key Authentication Passwords can be guessed; cryptographic keys effectively cannot. Generate a key pair on your own computer (not the server): Then copy the public key to your server: Enter your password one last time, and from then on you can log in with the key. If ssh-copy-id is not available, manually append the contents of ~/.ssh/id_ed25519.pub to ~/.ssh/authorized_keys on the server and set permissions with chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys. Step 4: Disable Root Login and Password Authentication Once key-based login works, shut the two biggest attack doors. Edit the SSH configuration: Find (or add) these lines and set them as shown: Save, then restart SSH: (On RHEL-based systems the service is called sshd.) Critical: before closing your current session, open a new terminal and verify you can still log in with your key. If something is wrong, your existing session lets you fix it. Step 5: Consider Changing the Default SSH Port (Optional) Moving SSH from port 22 to something like 2222 does not make you truly more secure, but it eliminates nearly all automated scanning noise from your logs. If you do it: Skip this step if it feels risky — steps 1–4 provide the real protection. Step 6: Enable a Firewall Ubuntu ships with UFW (Uncomplicated Firewall). Allow SSH before turning it on: (If you changed the SSH port in step 5, use sudo ufw allow 2222/tcp instead.) Then open only the ports your services need — for a web server, that is typically sudo ufw allow 80,443/tcp. Every closed port is an attack surface you do not have. Step 7: Install and Configure Fail2Ban Fail2Ban watches your logs and temporarily bans IP addresses that show malicious patterns, like repeated failed logins: The default configuration protects SSH out of the box, which is enough for most beginners. You can check banned IPs anytime with sudo fail2ban-client status sshd. Step 8: Enable Automatic Security Updates You will not always remember to patch manually. On Ubuntu/Debian, install unattended upgrades: This automatically installs security patches. It does not replace occasional manual apt upgrade runs for non-security updates, but it closes the most dangerous window — the gap between a vulnerability’s disclosure and your next manual update. Step 9: Use Strong, Unique Passwords Everywhere With password authentication disabled for SSH, this mainly applies to application logins: database passwords, admin panels, and any web software you install. Use a password manager to generate and store long random passwords. Never reuse the password from another service — credential-stuffing attacks try leaked username/password pairs against every server they find. Step 10: Set Up Regular Backups Security is not only about keeping attackers out — it is about recovering when something goes wrong. Set up two layers of backups: And the step everyone skips: test your restore process at least once. A backup you have never restored is a hope, not a plan. Step 11: Harden Remote Desktop (Windows VPS Only) If you run Windows Server instead of Linux: Step 12: Monitor Logs and Set Up Alerts Finally, keep an eye on your server. You do not need an enterprise monitoring stack on day one: The goal is to notice problems early: a full disk, a crashed service, or a sudden spike in traffic. Keeping It Secure Over Time Hardening is not a one-time event. Build these habits: Conclusion: Secure Your VPS in Under an Hour Securing your VPS comes down to a handful of fundamentals: patch promptly, stop logging in as root, use SSH keys, close what you do not need behind a firewall, ban the bots automatically, and keep backups you have actually tested. None of these 12 steps takes more than a few minutes, and together they put your server ahead of the vast majority of machines on the internet. Do them once, maintain the habits, and you can stop worrying about the background noise of automated attacks. If you are setting up a server from scratch, our new VPS setup checklist walks through the full initial setup — updates, users, firewall, backups, and monitoring — in the right order. Frequently Asked Questions How long does it take to secure a VPS? About 30–60 minutes for all 12 steps if you are following along for the first time. Most of that is waiting for updates to install. It is one of the highest-value hours you can spend on a new server. Is changing the SSH port enough to secure my server? No. Changing the port only reduces log noise from automated

How to Secure Your VPS: 12 Essential Steps for Beginners Read More »