VPS hardening, by the numbers.
What we typically find on a fresh VPS, what we change, and the before/after numbers across providers — DigitalOcean, Hetzner, Vultr, AWS Lightsail, OVH and Contabo.
Hardened a fresh DigitalOcean droplet for a Laravel SaaS launch
Fresh droplet, two days from launch, no time to learn UFW.
Locked down a Hetzner CX22 hosting 12 WordPress sites for a small agency
One server, twelve client sites, one shared user. We isolated everything.
Rescued a compromised Vultr VPS from a cryptominer and rebuilt it clean
CPU pegged at 100%, outbound traffic spiking. Forensics, then a clean rebuild.
Hardened an AWS Lightsail box for a Django consultancy before client handover
They build Django apps for a living and still wanted a second pair of eyes.
Locked down an OVH VPS hosting a privacy-focused self-hosted stack
A self-hosted analytics + recipes stack about to be pointed at customer-facing subdomains.
Hardened a Contabo Cloud VPS running a Discord bot at scale
A bot reaching 40k Discord servers, running as root, with the token in a world-readable config.
Get a discount in exchange for a published case study.
For our first three published case studies — the ones with real names, real numbers, and a link to verify — we'll knock 25% off any plan in exchange for permission to write up the engagement and quote you. We always show you the draft before it goes live, and we'll redact anything sensitive.
Apply for case-study slotA real VPS to harden, and a willingness to be quoted by name (or anonymised role) and provider.
25% off your order, plus a copy of the case study you can use in your own marketing if you want.
Nothing is published before you sign off. Anything sensitive (creds, IPs, internal hostnames) stays redacted.
About 30 minutes of your time across two short calls — kickoff and final review.
The case studies above are sample engagements with role-based attribution. We won't claim a named customer endorsed us until they have, in writing. When real, named case studies land, you'll see the customer's name, the provider, the date, and the actual numbers.