A new VPS arrives as a blank machine with root access. A few minutes of setup now saves a lot of trouble later.
- Connect over SSH using the credentials delivered to your client area.
- Apply all pending system updates before installing anything else.
- Create a non-root user with sudo access and use it for day-to-day work.
- Add your SSH public key, then disable password authentication.
- Enable a firewall and open only the ports you actually need.
- Change the root password from the delivered one.
Disabling password SSH login and using keys instead removes the overwhelming majority of automated attacks against a public server.
Then, before you build anything
Decide where your backups are going to live — somewhere other than this server — and set that up while the machine is still simple.