You can reach them via the ‘ Contact Us’ button at the bottom of this page. Should you have any questions left regarding this article, do not hesitate to contact our support department. You have set up solid security for your VPS to keep out pesky bots with the above steps! Click here to continue to Part 3: Updating your VPS. We get back to this in part 5 of this tutorial series, in which you upload your website and database. In this article we also explain how you secure your website. How you do this is explained in our article ‘ Installing an SSL certificate in Plesk’. In the SSL system trust in a self-signed certificate is therefore more limited.Īs such, we recommend using Let's Encrypt or your own SSL certificate.
Self-signed certificates are less suitable than Let's Encrypt, or your own SSL certificate, since there is no CA authority issuing the certificate. Your localhost and mail are automatically protected with a self-signed SSL certificate that uses TLS v1.2. Securing localhost / e-mail with Let's Encrypt or your own certificate Select the option ' Forbid users to create DNS subzones in other users' DNS superzones' and click on ' OK'. Log in to Plesk as administrator and go to ' Tools & Settings'> ' Server Settings'. We strongly recommend that you disable this option to prevent, for example, a user from sending phishing on behalf of another user. This means that users can create websites and email addresses on subdomains and domain aliases of other users. the DNS settings of others) of other users, even without access to the relevant account. Prevent access to DNS zones belonging to other usersīy default, all users in Plesk can create subdomains and domain aliases in the DNS zones (i.e. Secure FTP: Allow only secure FTPS connections.We recommend using the following settings: Log in to Plesk and navigate to ' Tools & Settings'> ' Security Policy'.Įnhanced security mode must be enabled (green checkmark) to use this functionality. We recommend being strict in this and not to allow unsafe connections.
#Plesk for vps password#
Plesk offers the possibility to set how strict the FTP(S) and password protection is.
#Plesk for vps how to#
In our ClamAV tutorial for CentOS 7, 8 and AlmaLinux 8 we show you how to install ClamAV, ensure that ClamAV starts automatically, and ClamAV scans your VPS daily Plesk security policy Do this only when you are very certain, for example if an IP attacks a specific port.Īnti-vius / Malware protection with ClamAVĬlamAV is a free, open source anti-virus program for the detection of trojans, viruses and malware on your VPS.
Select all jails and click on ' Switch On'.įinally, click on ' Trusted IP Addresses'> ' Add Trusted IP' to protect your IP address from which you connect to your VPS. A jail can be viewed as a piece of additional configuration within the general configuration of Fail2Ban, in which the security of a service is specified.
#Plesk for vps free#
We recommend setting this to one hour as in the screenshot below, but you are free to adjust this as you wish. By default, attacking IPs are banned from your VPS for ten minutes. You enable Fail2Ban by ticking ' Enable intrusion detection'. You will see that a new option has been added under ' Security' called ' IP Address Banning (Fail2Ban)'. Now return to ' Tools & Settings'> ' Updates and Upgrades'. You will see a confirmation of the installation. Click on ' Continue' to install Fail2Ban. Select the dropdown icon for Fail2Ban and select ' Install'. Log in to Plesk and navigate to ' Tools & Settings'> ' Updates'. You can as such skip this part if you're using Obsidian. In Plesk Obsidian (18.0 and newer) Fail2Ban is installed by default.