A server hardening checklist for small businesses.

Why does server hardening matter for small businesses?

Servers connected to the internet are scanned by automated tools all the time, regardless of how big the business is. A default installation is built to work, not to be locked down. Hardening is the routine work of tightening it: changing defaults, removing what isn’t used and making sure the important protections stay in place.

The goal isn’t perfection. It’s to focus on what can actually be reached from outside, close the common gaps, and make sure that if something does go wrong, you notice quickly and can recover.

How should you keep a server patched?

• Apply security updates for the operating system and software on a regular schedule.
• Treat urgent fixes for internet-facing software as same-day work.
• Use live kernel patching where available, so kernel security fixes don’t always wait for a reboot.
• Remove software you no longer use — it can’t be exploited if it isn’t there.
• Run supported versions; an operating system past end of life stops receiving fixes.

How do you control who can log in?

• Use SSH keys instead of passwords for server logins, and disable password login.
• Disable direct root login; give each person their own named account.
• Grant admin rights only to people who need them, and remove access promptly when someone leaves.
• Turn on two-factor authentication for control panels, cloud consoles and hosting accounts.
• Where practical, allow admin access only from your office or VPN.

Which firewall rules does a server need?

• Default to deny, then open only the ports your services need (for a web server, usually just web traffic and a restricted admin port).
• Keep databases and internal services off the public internet.
• Use a web application firewall in front of websites to filter common malicious requests.
• Rate-limit logins so repeated failed attempts are blocked automatically.
• Consider a service like Cloudflare in front of public sites.

What configuration changes reduce risk?

• Change default usernames, passwords and settings that come with installed software.
• Isolate websites and applications from each other, so one compromised site can’t reach the rest.
• Run services with the least privileges they need.
• Enforce HTTPS with valid certificates.
• Keep file permissions tight, especially on configuration files that contain credentials.

How do backups fit into hardening?

Hardening lowers the chance of an incident; backups limit the damage if one happens. Keep automatic, encrypted backups off the server — following the 3-2-1 backup rule — and test restores. A backup that sits on the same server can be lost along with it.

What should you monitor on a server?

• Uptime of your sites and services, with alerts that reach a person.
• Disk space, memory and CPU — full disks cause many outages.
• Login activity, especially new admin logins and repeated failures.
• Malware scans of website files.
• Backup success or failure, every time.

Can you over-harden a server?

Yes. Rules that make daily work painful — forced password changes every month, blocking tools your team relies on — tend to get worked around. Recognized guidance such as the CIS Benchmarks and NIST publications is a good reference; apply what fits your setup, prioritizing anything reachable from the internet. Our security audits and hardening service applies a tested baseline and documents every change.