A self-hosted server exposed to the internet attracts automated attacks within minutes. A short checklist done before launch prevents most compromises.

Lock down access first: a non-root user, SSH key-only login, a firewall allowing only needed ports, and automatic security updates.

Backups matter more than any other item. Automate them, store a copy off the server, and test a restore once before you rely on it.

Secure the application too: updates, strong unique passwords, secrets out of code, HTTPS everywhere, and basic monitoring with alerts.