1. Use SSH Keys (Never Passwords)
SSH keys are significantly more secure than passwords. They're immune to brute-force attacks.
ssh-keygen -t ed25519 -C "[email protected]"
# Copy to your Droplet
ssh-copy-id root@your_droplet_ip
# Disable password authentication
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd
2. Create a Non-Root User
Never run services as root. Create a dedicated user with sudo privileges.
usermod -aG sudo deploy
# Copy SSH keys to new user
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy
3. Configure the Firewall (UFW)
Only open ports you actually need.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
# Verify
sudo ufw status verbose
Also enable DigitalOcean Cloud Firewalls in the dashboard for an extra layer of protection (free).
4. Keep Your System Updated
sudo apt update && sudo apt upgrade -y
# Enable automatic security updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades
5. Change the Default SSH Port
Moving SSH off port 22 reduces automated brute-force attempts by 90%+.
sudo nano /etc/ssh/sshd_config
# Change: Port 22 → Port 2222
# Update firewall BEFORE restarting SSH
sudo ufw allow 2222/tcp
sudo systemctl restart sshd
# Test new port, then remove old
sudo ufw delete allow 22/tcp
6. Install Fail2Ban
Automatically ban IPs that show malicious behavior.
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
# Check banned IPs
sudo fail2ban-client status sshd
7. Enable Backups
DigitalOcean offers automated weekly backups for 20% of your Droplet cost. Enable them in the dashboard under your Droplet → Backups.
For more frequent backups, use Snapshots (on-demand, $0.06/GB/mo).
8. Set Up Monitoring & Alerts
- Enable DigitalOcean Monitoring (free) in the dashboard
- Set alerts for CPU > 80%, disk > 90%, memory > 85%
- Monitor bandwidth for unusual spikes (potential DDoS)
9. Use DigitalOcean VPC
Place your Droplets in a Virtual Private Cloud (free) to isolate internal traffic. Database servers should only be accessible via VPC, never the public internet.
Security Checklist
| Task | Priority | Time |
|---|---|---|
| SSH keys only | 🔴 Critical | 5 min |
| Non-root user | 🔴 Critical | 2 min |
| UFW firewall | 🔴 Critical | 3 min |
| System updates | 🔴 Critical | 5 min |
| Change SSH port | 🟡 Recommended | 3 min |
| Fail2Ban | 🟡 Recommended | 2 min |
| Enable backups | 🟡 Recommended | 1 min |
| Monitoring alerts | 🟢 Nice to have | 5 min |
| VPC setup | 🟢 Nice to have | 5 min |
🎁 Secure Cloud Hosting from $6/mo
Get $200 free credit and deploy a secure Droplet today.
Claim Free Credit →