Or: Why "Just get a VPS" is dangerously incomplete advice
The deployment illusion
The VPS market has exploded from $2.4 billion in 2018 to over $5 billion in 2024. What was once the guarded domain of seasoned sysadmins is now a playground for anyone with a credit card. But here's what nobody talks about: we've made deployment easy while security remains hard.
According to Cloudflare's Q1 2023 DDoS Threat Report, attackers have shifted from compromising IoT devices to enslaving vulnerable and misconfigured VPS servers, building botnets that are up to 5,000 times more powerful than IoT-based ones. Meanwhile, security research consistently shows that misconfiguration is a top security threat, with OWASP ranking Security Misconfiguration in their Top 10, noting that 90% of applications were tested for some form of misconfiguration.
A cautionary tale (mine)
In 2014, I spun up a VPS for a company project. I knew enough to deploy but not enough to know what I didn't know. Password authentication was left enabled on SSH; a single configuration line: PasswordAuthentication no.
I discovered the breach when the company owner asked about a CPU spike. Not through monitoring or alerts, through the bill.
This wasn't sophisticated. Attackers simply scanned for port 22, tried common usernames, and brute-forced passwords. It still works today because we're creating vulnerable servers faster than ever.
That experience is what makes me twitchy about VPS recommendations. One checkbox. One config line. That's all it took.
The confidence gap
Developers believe they're doing it right:
- "I disabled root login!" (but left password auth enabled)
- "I have a firewall!" (allowing 0.0.0.0/0 on port 22)
- "I keep things updated!" (manually, when remembered)
Unlike code that crashes immediately, a poorly secured server might run fine for months until compromised. By then, you're part of a botnet and don't know it. And unlike a failing test suite, your VPS won't warn you when it's compromised. It'll just start sending spam for someone else.
The social dynamics: Nobody admits they're bad at security. Can't ask without looking incompetent. Can't tell your boss you shouldn't be doing this. Can't admit to peers you're winging it.
The tools that could help (but often don't get mentioned)
Modern defaults are better. Ubuntu Cloud Images disable password SSH by default. Infrastructure as Code (Ansible, Terraform, OpenTofu) can codify security into reusable scripts. Automation tools exist for updates and monitoring.
Immutable infrastructure offers another path: Container-based operating systems like Flatcar, CoreOS, or Bottlerocket shift the paradigm entirely. Instead of securing a mutable server, you deploy immutable images, use declarative configuration, and replace rather than update. This reduces the security surface significantly but it's a different mental model that requires learning container orchestration.
Here's the problem: When someone says "just get a VPS," they don't follow with "but first spend 40 hours learning Terraform/OpenTofu" or "consider if immutable infrastructure fits your use case."
The responsible advice is: Learn IaC, script everything, automate from day one, or use immutable infrastructure. That's honest. But it's not what people mean by "just get a VPS."
The true cost of "$5/Month"
Initial setup: 4-8 hours
- SSH keys, firewall, fail2ban, automatic updates, SSH hardening, web server, SSL certificates, monitoring, backups.
Ongoing maintenance: 2-4 hours/month
- Security patches, kernel updates, certificate renewals, log analysis, dealing with attacks, backup verification.
When things break: 4-48 hours
- Server unresponsive at 2 AM, failed certificate renewals, kernel panics, compromised servers.
Annual time investment:
- First year: 28-80 hours (setup + 12 months maintenance)
- Subsequent years: 24-48 hours minimum
- Plus incidents (unpredictable)
- Add 20-40 hours if you learn IaC to do it properly
That "$5/month VPS" costs 48-120 hours in year one if you do it right. Price your time accordingly.
Required knowledge domains
Baseline Survival Skills:
- Linux system administration (packages, processes, permissions)
- Basic firewall configuration
- SSH key management and hardening
- SSL/TLS certificate management
Professional Security Skills:
- Network security (attack vectors, DDoS mitigation, intrusion detection)
- Log analysis and forensics
- Backup strategies and disaster recovery testing
- Incident response procedures
Even the "baseline" assumes significant systems knowledge most developers don't have. And "just get a VPS" rarely distinguishes between a hobby blog and a production system. People often use the same casual advice for both.
The tool that disappeared
Debian had a harden package to help secure servers. It was removed in 2015 due to poor maintainability. Ironically, right as the VPS market exploded and first-time server operators skyrocketed. Today there's no simple apt install debian-hardening. You must manually configure everything or use third-party scripts of varying trustworthiness.
The gap between VPS accessibility and available hardening tools has grown wider every year.
Modern tools still miss the mark
"AI-managed VPS" gives you a chatbot that answers questions. You still configure everything. It's "Stack Overflow in chat form," not automatic security.
Coolify and Dokploy simplify application deployment (SSL, reverse proxy, orchestration) but don't handle underlying server security. You still need to harden SSH, configure firewalls, manage updates, and set up intrusion detection.
The alternative: shared hosting
For $5-10/month, shared hosting handles security updates, SSL, backups, DDoS mitigation, and monitoring. Quality varies, and most providers don't publish security audit results.
The advantage isn't superior security, it's transferred responsibility. When something breaks, it's their problem. You're paying for peace of mind, not necessarily better security.
For personal blogs, portfolios, and side projects, these constraints often beat the burden of VPS management.
The vendor lock-in paradox
Here's the irony: while everyone warns about PaaS vendor lock-in, VPS creates its own lock-in through accumulated complexity.
PaaS lock-in (what everyone fears): Proprietary APIs, platform-specific configs, migration effort.
VPS lock-in (what nobody mentions): Years of accumulated server configuration, custom security hardening, tribal knowledge, undocumented tweaks, and the dread of recreating it all.
The escape hatch: Infrastructure as Code. Script everything with Terraform/Ansible from day one and migration becomes trivial. But most people don't do this. Instead, they SSH in, make manual changes, and accumulate state.
Try migrating a two-year-old manually-configured VPS. You'll spend days recreating everything, assuming you even documented it.
VPS flexibility is real. But how many times have you actually migrated providers? Or has "flexibility" just meant "freedom to accumulate technical debt"?
What should exist (and why it doesn't yet)
The most comprehensive solutions are debian-cis by OVH and harbian-audit by HardenedLinux. Both are production-grade hardening frameworks based on CIS benchmarks. OVH uses debian-cis for their PCI-DSS infrastructure; harbian-audit extends this with STIG compliance checks and supports Debian 9-12, CentOS 8, and Ubuntu 22.
They include 230-270+ automated checks, audit and apply modes, and can achieve 80-85% compliance on a blank system. HardenedLinux even provides pre-hardened AMI images.
But: Even these require significant systems knowledge. They're professional tools for people who already understand server hardening—not one-click solutions for beginners.
What about managed services? AWS Lightsail, managed Kubernetes nodes, and similar offerings do provide better defaults and handle much of the security burden. But they're managed services with less flexibility, not bare VPS with root access. Moreover, they're typically much more expensive than a regular VPS.
The missing product: A bare-metal VPS with full root access that's simultaneously secure by default:
- SSH: keys only, non-standard port, fail2ban configured
- Firewall: sensible defaults
- Automatic security updates: enabled
- Monitoring: basic alerting configured
- And still: full root access to break anything
Why it doesn't exist: This is a support trade-off, not just a technical failing. The core value proposition of a traditional VPS is flexibility, which is often mutually exclusive with enforced security defaults. If a provider enforces a non-standard SSH port or disables password auth, they risk breaking beginners' custom setups and generating support tickets. It's easier to provide a blank slate and let users break their own servers.
The tools exist. The product incentives don't align with creating it.
Responsible Advice
If recommending VPS, include:
- The reality: "You're responsible for security, updates, backups, monitoring—not trivial"
- Actual resources: Complete hardening checklists, not just "use fail2ban"
- Time expectations: "4-8 hours initially, 2-4 hours monthly, plus emergencies"
- Consider alternatives: "Would managed hosting or PaaS work better?"
- Real consequences: Compromised data, crypto mining, DDoS participation, legal liability
Conclusion
We've solved deployment. We haven't solved responsibility.
The VPS boom democratized deployment but not security. We've created an ecosystem where "just get a VPS" is common advice, but "learn IaC first" isn't.
The result? Growing numbers of vulnerable servers maintained by well-meaning developers who don't know what they don't know.
"Just get a VPS" is incomplete advice. The complete version is: "Get a VPS, learn Infrastructure as Code, automate everything, and accept the time investment." That's honest yet rarely said.
Your $5 VPS isn't cheap. It's a subscription to either anxiety or learning.
If you choose VPS: learn IaC properly, use established security configurations (debian-cis, Ansible roles), distinguish between hobby and production risk, and budget 48-120 hours in year one.
Or recognize that managed infrastructure might be more pragmatic. Infrastructure isn't your product. It's the foundation that should be stable enough to forget about.
Until "learn IaC first" becomes as common as "just get a VPS," we'll keep creating the problem we're trying to solve.
Can you really forget about that $5/month VPS?
Resources
If you do choose the VPS path, start here:
- CIS Debian Linux Benchmark - Industry-standard hardening guidelines
- debian-cis by OVH - Automated CIS benchmark hardening (used in OVH production)
- harbian-audit by HardenedLinux - Extended hardening with STIG compliance (includes pre-hardened images)
- Mozilla Server Side TLS Guidelines - SSL/TLS configuration best practices
Have you been burned by VPS management? Share your stories in the comments. No judgment.
Top comments (0)