Most compromised VPSs do not fall to a sophisticated attack, but to a weak password, an open port that was not needed or a script downloaded from the wrong place. This is what really matters.
Your panel account
- Turn on two-factor. In Account → Security, click Enable two factor authentication, scan the QR code with an app such as Google Authenticator or Authy and enter the code it gives you. That way, even if someone gets your password, they cannot log in.
- Check open sessions on that same page and log out the ones you do not recognise.
- Look at your activity log now and then.
- Do not give your password to anyone. If someone else has to manage your VPS, share it from the panel.
The server
- A long, unique password you do not use anywhere else. On Linux, better still: log in with an SSH key and add fail2ban.
- On Windows, protect remote desktop and let the updates install.
- On Linux, update often with
apt update && apt upgrade. - Open only the ports you use. Never expose databases (3306), admin panels such as txAdmin (40120), telnet consoles or game web panels to the internet.
- Do not run everything as administrator. In our guides game servers run under their own user: if a plugin has a flaw, the damage stays there.
- Download scripts, mods and plugins only from trustworthy sources. "Leaked" paid resources, especially for FiveM, often carry backdoors that hand control of your server to someone else.
- Take backups, with at least one off the VPS.
If you think you have been broken into
- Change your account password, turn on two-factor and log out sessions that are not yours.
- Change the server password from the panel.
- Check for users you did not create: on Windows, with
net user; on Linux, in/etc/passwdand the~/.ssh/authorized_keysfiles. - If you are not sure you cleaned everything, the safest option is to save your data and reinstall the system. Check that data carefully before uploading it again: if the problem came from a script, it would come back with it.
- Open a ticket if you need help.