The server is only as secure as what runs on it.
WHY THIS MATTERS MORE ON A VPS
On shared hosting, a compromised application is contained by the account boundaries we enforce. On a VPS, a compromised application running with too many privileges can reach the entire machine.
PRACTICAL MEASURES
Run each application as its own unprivileged user
Set file permissions correctly: 755 directories, 644 files, 600 for configuration holding credentials
Keep application files outside the web root where the framework allows it Never run the web server as root Disable PHP execution in upload directories Keep applications and their dependencies updated
ISOLATION BETWEEN SITES
If you host several sites, run each under a separate user so one compromise does not reach the others. Control panels do this by default; manual configurations frequently do not.
DATABASE SEPARATION
A separate database user per application, with privileges only on its own database.
WHAT TO SCAN FOR
Unexpected PHP files in upload folders Recently modified files in directories that should be static Unknown cron jobs Unfamiliar user accounts
