Disclosure: this page contains affiliate links. If you buy through them we may earn a commission at no extra cost to you.

The moment a VPS is online, bots start guessing SSH passwords. Fail2ban watches logs and bans IPs after repeated failures.

Step 1: Install Fail2ban

sudo apt update
sudo apt install -y fail2ban

Step 2: Create a local config

sudo nano /etc/fail2ban/jail.local

[sshd]
enabled = true
maxretry = 3
bantime = 1h
findtime = 10m

This bans an IP for one hour after 3 failures in 10 minutes.

Step 3: Start and verify

sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

Make it effective

  • Combine with SSH keys — disable password login entirely.
  • Whitelist your own IP with ignoreip in jail.local so you never ban yourself.
  • Add jails for Nginx or WordPress login pages, not just SSH.

Fail2ban uses almost no resources, so even the cheapest VPS runs it. RackNerd’s 1 GB plan at $21.99/yr with full root is all you need to lock down a new server.

See RackNerd's current deals