Short answer: Open only the ports you actually serve on, keep Windows updated, use a long unique administrator password, and confirm in writing what is backed up before you rely on it. A VPS is reachable from the whole internet, and automated scanning finds new servers within hours.
Applies to: Infosaic VPS · Windows Server
A cloud desktop is something you connect to. A VPS is something the world connects to — and that changes the housekeeping. None of this is difficult, but skipping it is how a perfectly good server ends up in trouble.
Half an hour in the first week covers everything below.
Open only the ports you serve on
Every open port is a door. Windows Firewall is on by default, and the discipline is simply to keep it that way and open the minimum.
- 80 and 443 if you serve a website — see adding a website to IIS.
- 3389 for RDP, ideally restricted to the IP addresses you actually connect from rather than open to everyone.
- Nothing else unless something specific needs it. In particular, do not expose a database port to the internet — let the application on the same server reach it locally.
Windows Firewall rules are per-port and easy to review. Look at the inbound list once a quarter and remove anything you no longer recognise.
The account and password basics
- A long, unique administrator password. Servers with RDP exposed are subjected to continuous automated password guessing. Length matters more than punctuation; a password manager makes this free.
- One account per person if several of you administer it, so the event log tells you who did what.
- Remove accounts when people leave. Obvious, routinely forgotten.
- Run services under their own limited account rather than as the administrator, where the software allows it.
Confirm your backups in writing, and test a restore. Ask us exactly what is backed up, how often, and how far back it goes — then actually restore one file and check it opens. A backup nobody has ever restored from is a hope, not a backup.
Keep it patched, and watch the disk
The two maintenance jobs that actually matter:
- Windows updates. Set active hours outside any period the site must be up, and plan restarts rather than being surprised by them — see Windows updates. Do not switch updates off on an internet-facing machine.
- Disk space. Web servers generate logs steadily and quietly. A full disk takes a website down as effectively as anything else — see checking disk space. Set yourself a monthly reminder.
- Also update what you installed. The application, the runtime and the database have their own security updates, and Windows Update will not handle them.
Questions and answers
Which ports should be open on a VPS?
Only the ones you serve on — typically 80 and 443 for a website, and 3389 for RDP, ideally restricted to your own IP addresses.
Should I expose my database port to the internet?
No. Let the application on the same server reach the database locally. An exposed database port is one of the most commonly exploited mistakes.
How strong does the administrator password need to be?
Long and unique. Servers with RDP exposed face continuous automated guessing, and length protects against that better than complexity rules.
Is my VPS backed up?
Ask and get it in writing, including frequency and retention. Then restore one file as a test, because an untested backup is only a hope.
Can I turn off Windows updates on a server?
No. An internet-facing unpatched Windows machine is found quickly by automated scanning. Schedule updates instead of disabling them.
Why did my website suddenly stop?
Check disk space first. Web server logs grow steadily and a full disk stops a site as surely as any other fault.
Does Windows Update patch my applications too?
No. Your application, its runtime and any database have their own updates that you need to apply separately.
Should each administrator have their own account?
Yes. Shared logins make the event log useless, and removing one person’s access becomes impossible without disrupting everyone.
Related articles
- What is a VPS, and how is it different from a cloud desktop?
- How to add a website to IIS on your VPS
- How to add an SSL certificate in IIS
- How to check disk space and free it up safely
Want your backup arrangement in writing?
Open a support request from your control panel and ask what is backed up, how often and how far back — that is the fastest route, because it reaches the team who can already see your server. You can also email [email protected].