1. SSH with Password Authentication

2. No Firewall Rules

3. Unattended Upgrades Disabled

4. Running Services as Root

5. No Backups (or Untested Backups)

Take Action Today Every server I audit has at least three of these issues. They're simple to fix, yet consistently overlooked. A single breach can cost a small business thousands of dollars in downtime, data loss, and reputation damage. If your server accepts SSH passwords, it's being brute-forced right now. Check your /var/log/auth.log — you'll see hundreds of failed login attempts daily from bots around the world. Fix: Switch to SSH key authentication and disable password login: This single change eliminates 99% of brute-force attacks. Takes 5 minutes. I regularly find servers with all ports open to the internet. Database ports (3306, 5432), Redis (6379), admin panels — all accessible from anywhere. Fix: Use ufw to allow only what's needed: Security patches are released weekly. If your server isn't automatically installing them, you're running known-vulnerable software. The Equifax breach happened because of an unpatched vulnerability — the fix had been available for months. Fix: Enable automatic security updates on Ubuntu: If your web application runs as root and gets compromised, the attacker has full control of your server. Running services as unprivileged users limits the blast radius of any vulnerability. Fix: Create dedicated users for each service. With Docker, don't run containers with --privileged unless absolutely necessary. Having backups is step one. Testing them is step two — and most people skip it. I've seen companies discover their backups were corrupted only when they needed to restore. Fix: Automate daily backups to an external location (S3, another server). Set up a monthly restore test. If you can't restore it, it's not a backup — it's a hope. These five fixes take less than an hour total and dramatically improve your security posture. Not sure about your server's security? I offer comprehensive server audits with a detailed report and remediation plan. Contact me for a security review. Templates let you quickly answer FAQs or store snippets for re-use. Hide child comments as well For further actions, you may consider blocking this person and/or reporting abuse