After purchasing a new VDS server, there are several important checks and security configurations you should complete before using it for production workloads.
Because your server may be accessible over the internet, using strong authentication, keeping the operating system updated, configuring the firewall, and establishing a reliable backup strategy should be among your first priorities.
In this guide, we cover the essential steps recommended after purchasing a Windows or Linux VDS server.
Once your VDS service is activated, you will receive the information required to access the server.
This generally includes:
Server IP address
Username
Initial server password
Connection port
Operating system information
Windows VDS servers are generally accessed through RDP, while Linux servers are commonly managed through SSH.
Windows Server systems typically use an Administrator account.
Linux systems may use root or another user account with sudo privileges, depending on the configuration.
Never share your server credentials with unauthorized people.
After receiving your credentials, verify that your server is accessible.
Windows servers can generally be accessed using Remote Desktop Protocol (RDP).
On a Windows computer, open Run and enter:
mstsc
Enter the IP address of your VDS and start the connection.
Linux servers are commonly accessed via SSH.
For example:
ssh root@SERVER_IP_ADDRESS
If your server uses another account, replace root with the username provided to you.
If your VDS was delivered with a temporary or automatically generated password, changing it should be one of your first tasks.
Your new password should be:
Long
Difficult to guess
Unique
Not reused on other accounts
Avoid predictable passwords containing your name, company name, phone number, or simple combinations such as 123456.
On many Linux systems, the current user's password can be changed with:
passwd
The exact procedure may vary depending on your permissions and server configuration.
A newly deployed server image may contain packages or security updates that are not fully up to date.
Check for updates before deploying your applications.
Update the package list with:
sudo apt update
Upgrade available packages with:
sudo apt upgrade
Depending on your distribution version, you can use:
sudo dnf update
On Windows Server, check:
Settings → Windows Update
Some updates may require the server to restart.
A firewall is one of the fundamental security layers controlling which services and ports can be reached over the network.
Instead of completely disabling your firewall, configure it to allow only the connections required by your applications.
Depending on your use case, these may include:
SSH
RDP
HTTP
HTTPS
DNS
Email services
Application-specific ports
Avoid exposing unnecessary services to the public internet.
Every open port may represent a network-accessible service.
Only expose services that are actually required.
For web servers, common ports include:
80 — HTTP
443 — HTTPS
The default Linux SSH port is:
22
The default Windows RDP port is:
3389
Changing a default port alone should not be considered a complete security solution.
Firewall rules, strong authentication, and access restrictions should be used together.
Remote management services exposed to the internet may receive automated login attempts.
Depending on your server configuration, you can:
Use SSH key authentication.
Restrict password-based authentication.
Restrict direct root SSH access.
Limit SSH access to trusted IP addresses.
SSH key authentication can be an effective way to strengthen remote access security.
For RDP access:
Use a strong Administrator password.
Keep Network Level Authentication (NLA) enabled.
Consider restricting access through firewall rules.
Disable unused user accounts.
Keep Windows security updates installed.
Correct date, time, and time-zone configuration is important for reliable server operation.
Incorrect system time can cause problems with:
Log records
Scheduled tasks
Backups
SSL/TLS operations
Applications
Database records
Use an appropriate time zone for your project and ensure that system time synchronization is working correctly.
Review the hostname assigned to your server.
If you manage multiple servers, descriptive hostnames can make administration easier.
For example:
web01
database01
app01
Remember that changing a hostname may affect certain applications and services. Always check existing configurations before changing the hostname of a production server.
After completing the initial security and update procedures, you can prepare the server for your project.
Depending on your requirements, a web server may use:
Nginx
Apache
PHP
MySQL
MariaDB
PostgreSQL
If you prefer not to manage everything manually, you can use a compatible server control panel.
Popular examples include:
cPanel/WHM
Plesk
DirectAdmin
Check licensing costs and system requirements before installing a control panel.
If you plan to host a website or internet-accessible application, your domain must point to your VDS.
This is commonly done by creating an A record that points the domain to the IPv4 address of your server.
For example:
example.com → SERVER_IP_ADDRESS
www.example.com → SERVER_IP_ADDRESS
DNS changes may take some time to propagate across the internet.
If you are hosting a website, HTTPS should generally be used.
SSL/TLS certificates allow traffic between visitors and your web server to be encrypted.
Depending on your requirements, you can use free certificates such as Let's Encrypt or commercial certificate options.
Make sure certificates are correctly installed and renewed before they expire.
Regular backups are one of the most important parts of running a VDS server.
The fact that your server is operational does not automatically mean that your data is being backed up.
Depending on your use case, backups may include:
Website files
Databases
Email data
Application files
Important configuration files
Whenever possible, avoid storing your only backup on the same VDS server.
Keeping additional backups in an independent storage location can provide protection against hardware, software, or user-related failures.
Snapshots and regular backups serve different purposes.
A snapshot generally captures the state of a virtual server at a particular point in time.
A backup strategy typically stores important data at different points in time and preferably in a location independent of the original server.
For critical projects, snapshots should not necessarily be treated as a complete replacement for a proper backup strategy.
Monitoring server resources can help you identify performance problems before they become critical.
You should monitor:
CPU usage
RAM usage
Disk space
Disk performance
Network traffic
Consistently high resource usage may indicate that the server requires additional resources or that an application is consuming more resources than expected.
Server logs provide valuable information about system errors and security events.
You may need to review logs for:
Failed login attempts
Web server errors
Application errors
System services
Disk-related issues
When a problem occurs, reviewing logs rather than simply restarting a service can help identify the underlying cause.
Unnecessary services may consume system resources and increase the server's attack surface.
Run only the services required by your applications.
Before disabling any service, make sure other applications do not depend on it.
Server security is an ongoing process rather than a one-time configuration.
The operating system and installed software should be regularly updated.
Pay particular attention to security updates for internet-facing components such as:
Web servers
Control panels
CMS platforms
Databases
Remote access services
After deploying a new VDS server, review the following:
Test server connectivity.
Change the initial password.
Update the operating system.
Review firewall settings.
Close unnecessary ports.
Secure SSH or RDP access.
Verify date and time settings.
Install required software.
Configure domain and DNS records.
Install an SSL certificate.
Create a backup strategy.
Monitor resource usage.
Review server logs regularly.
Install security updates.
Once the VDS is activated and connection details are available, you can access it. However, basic security, updates, and backup configurations should be completed before using the server for production workloads.
If the server uses an initial or temporary password, changing it is recommended. Use a strong and unique password that is not reused elsewhere.
This depends on the service package you purchased. Check whether backup services are included with your VDS plan.
Completely disabling the firewall may expose your server to unnecessary security risks. It is better to create the appropriate firewall rule for the required service or port.
Both can be operated securely when properly configured. Security depends heavily on updates, access controls, service configuration, and administration practices.
This depends on the operating system, workload, and security policy. Antivirus or malware scanning solutions may be part of a broader security strategy, but they should not be treated as the only security measure.
After purchasing a new VDS server, it is important to review its system and security configuration before immediately deploying websites or applications.
Strong authentication, operating system updates, properly configured firewall rules, reliable backups, and resource monitoring all contribute to a more secure and stable server environment.
After activating your İde Bilişim VDS service, you can use the provided connection details to access your server and configure it according to the requirements of your project.v
Copyright © 2026 All Rights Reserved
Turkey (Türkçe)
Worldwide (English)