How to harden SSH: disable root login and change the port
Updated 7/20/2026
The root account is the number one target of attacks. Best practice: create a normal user with sudo, then forbid direct root login.
1. Create a sudo user
If you do not have one yet, see How to create a sudo user. Make sure you can log in with it before continuing.
2. Disable root login
In /etc/ssh/sshd_config:
PermitRootLogin no3. Change the SSH port (optional)
Moving off port 22 reduces the noise from automated scans:
Port 2222If you use UFW, allow the new port before restarting:
ufw allow 2222/tcp4. Restart SSH
systemctl restart sshDo not close your current session until you have tested in a new terminal that you can connect with the new port and user.
Recommended
Combine with SSH keys and fail2ban for an SSH that is nearly impossible to break.
Put this guide into practice on your own VPS
EU cloud servers, billed hourly, ready in minutes, with one-click installs for dozens of apps.
See pricingRelated tutorials
How to check which ports are open on your server
Find out which services are listening for connections on your server and close what you do not need, for less exposure.
Updated 7/20/2026SecurityHow to scan your server for malware with ClamAV
Install ClamAV, an open-source antivirus, and periodically scan your server for infected files.
Updated 7/20/2026SecurityHow to add security headers to your website
A few HTTP headers protect your visitors from common attacks like clickjacking and content injection.
Updated 7/20/2026