Once a VPS is hardened the usual way, keys only, firewalled, patched, there is a bigger move you can make: stop exposing SSH to the public internet at all. Instead of trusting that a strong key holds up against constant scanning, you put SSH on a private network the rest of the world cannot even see, and close port 22 to everyone else. This is my favorite upgrade for a small server in 2026, and it is genuinely less fragile than it sounds, as long as you keep one escape hatch.
This guide picks up where Setting Up Your Own VPS leaves off. If you have not done the baseline (non-root user, SSH keys, UFW), start there first.
Key takeaways
Tailscale gives your server a private address that only your own devices can reach.
Disable key expiry on the server in the admin console, or Tailscale logs you out in 180 days and you cannot reauth remotely.
