Any data that crosses a network unencrypted can be read or modified along the way. On a VPS, that includes more than website traffic: database connections between servers, admin panels, backups, monitoring agents and API calls. Here’s how to encrypt each of them.

1. HTTPS for every website

Let’s Encrypt certificates are free and renew automatically:

apt install -y certbot python3-certbot-nginx
certbot --nginx -d example.com -d www.example.com
systemctl list-timers | grep certbot     # auto-renewal timer

Redirect HTTP to HTTPS (Certbot can do this for you) and add HSTS once everything works:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

2. Use modern TLS settings

In Nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_stapling on;
ssl_stapling_verify on;

Mozilla’s SSL Configuration Generator gives up-to-date settings for Nginx, Apache, HAProxy and others. Test your site with an online TLS checker afterwards.

3. Encrypt database connections between servers

If the database is on the same server, connect over localhost or a Unix socket — no network traffic, nothing to encrypt.

If it’s on another server, either use a private encrypted network (step 5) or enable TLS in the database:

MariaDB/MySQL

[mysqld]
ssl_cert = /etc/mysql/ssl/server-cert.pem
ssl_key  = /etc/mysql/ssl/server-key.pem
ssl_ca   = /etc/mysql/ssl/ca.pem
require_secure_transport = ON

PostgreSQL

# postgresql.conf
ssl = on
# pg_hba.conf — require TLS for remote clients
hostssl  appdb  appuser  10.0.0.0/8  scram-sha-256

4. SSH tunnels for admin tools

Instead of exposing phpMyAdmin, Grafana, or a database port to the internet, keep them on 127.0.0.1 and reach them through SSH:

# Forward local port 8080 to the server's localhost:8080
ssh -L 8080:127.0.0.1:8080 deploy@YOUR_SERVER_IP
# Then open http://localhost:8080 in your browser

Same for a database GUI: ssh -L 3307:127.0.0.1:3306 …, then connect your client to localhost:3307.

5. WireGuard between servers

For ongoing server-to-server traffic (app ↔ database, replication, monitoring, backups), a WireGuard tunnel encrypts everything at once and lets you firewall services to private addresses. See site-to-site VPN tunnel.

6. Encrypted backups and file transfers

7. Email

If your server sends mail, enable STARTTLS on your mail server and use SPF, DKIM and DMARC so receiving servers trust your messages. Outbound mail ports are open on our USA VPS (with rDNS) — see Email VPS.

8. Encrypted DNS (optional)

systemd-resolved supports DNS-over-TLS:

# /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net
DNSOverTLS=yes

Check what’s still plain text

ss -tnp state established

Look for connections to ports like 21 (FTP), 80 (HTTP to other servers), 3306/5432 to remote IPs, or 6379 (Redis) that aren’t on a tunnel interface.

Summary

HTTPS everywhere, modern TLS settings, TLS or tunnels for databases, SSH port forwarding for admin tools, WireGuard between servers and encrypted backups. Together these cover nearly all traffic a typical VPS handles. Related: secure web hosting on Linux and WireGuard VPN on a VPS.

  • Security
  • TLS
  • Encryption