Connect to your VPS over SSH
SSH gives you a secure command line on your server from any computer. You'll log in with the root password from your welcome email, then switch to an SSH key, which is safer and saves typing. Windows 10 and 11, macOS and Linux all have SSH built in; PuTTY is optional.
Before you start
- Your server shows Running in the client area. A new VPS is usually ready within 15 minutes of payment.
- Its IP address and root password, from the welcome email or the client area.
- A Linux image. For Windows Server you connect with Remote Desktop instead (see the note in Step 3).
root, port 22Step 1: Find your server's IP and login
Open the client area, go to Servicesyour VPS and note the IPv4 address. The root password is on the same page and in your welcome email. Copy it rather than typing it: it's long and random on purpose.
We never ask for this password. Our staff won't request it by email, chat or ticket. If something needs doing on your server, we'll agree how with you on the ticket, and you stay in control.
Step 2: Connect for the first time
Pick your computer below. The tabs in Step 3 follow your choice.
Windows 10 and 11 include an OpenSSH client. Open Windows Terminal or PowerShell from the Start menu and run:
ssh root@203.0.113.42If Windows says ssh isn't recognised, add OpenSSH Client under SettingsSystemOptional features (on Windows 10, SettingsAppsOptional features), then open a new terminal window.
Open Terminal (on a Mac, press Cmd + Space and type "Terminal") and run:
ssh root@203.0.113.42
# Over IPv6 instead, using any address in your /64
ssh root@2001:db8:4b::10Download PuTTY only from its official site. In the Session screen, enter the IP, keep port 22 and connection type SSH. Type a name under Saved Sessions and click Save so you don't have to type it again, then click Open and log in as root.
The first time, SSH shows the server's fingerprint and asks Are you sure you want to continue connecting? Type yes. Your computer remembers the key and warns you if it ever changes. Then paste the root password. Nothing appears while you type or paste it; that's normal. Press Enter, and a prompt such as root@vc-app-01:~# means you're in.
Want to verify the fingerprint first? Open the browser Console from the client area, log in there and run ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. If it matches what your terminal shows, you're talking to your own server.
Step 3: Switch to SSH keys
A key pair replaces the password with a file on your computer: the private key stays with you, the public key goes on the server. Keys can't be guessed by the bots that try passwords on every server on the internet, and you won't need to paste a password again.
In PowerShell, create a key (press Enter to accept the location, and set a passphrase), then copy the public half to the server. Windows has no ssh-copy-id, so the second command does the same job:
ssh-keygen -t ed25519 -C "you@laptop"
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.42 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"Create a key (accept the default location and set a passphrase), then install it on the server. You'll type the root password one last time:
ssh-keygen -t ed25519 -C "you@laptop"
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@203.0.113.42On a Mac, run ssh-add --apple-use-keychain ~/.ssh/id_ed25519 once and macOS keeps the passphrase in your Keychain.
- Open PuTTYgen, choose EdDSA (Ed25519) and click Generate, moving the mouse until it finishes.
- Set a passphrase and click Save private key to get a
.ppkfile. - Copy the text in the box labelled Public key for pasting into OpenSSH authorized_keys file.
- Log in with the password, then add it on the server:
mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA…your-key… you@laptop" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keysFinally, in PuTTY, open ConnectionSSHAuthCredentials, choose the .ppk file, and save the session again.
Test it before you rely on it: open a new terminal window and connect again. You should be asked for the key's passphrase, if you set one, but not the server's password. If you still get a password prompt, see Troubleshooting.
Running Windows Server? It doesn't use SSH. Connect with Remote Desktop (mstsc on Windows, the Windows App on Mac and mobile) using the IP and Administrator password from the client area. See Windows VPS for the setup steps.
Optional: Save a shortcut in your SSH config
Instead of remembering IPs, give each server a short name. Add this to ~/.ssh/config on macOS and Linux, or C:\Users\you\.ssh\config on Windows (create the file if it doesn't exist):
Host vc-app
HostName 203.0.113.42
User root
IdentityFile ~/.ssh/id_ed25519
ServerAliveInterval 60Now ssh vc-app is enough. The same file is read by scp, rsync and editors with remote-SSH support, so all of them can use the shortcut too. ServerAliveInterval stops idle sessions from being dropped by home routers.
Next: turn off password logins
Once key login works, password login is just an open door for bots. Disabling it, creating a non-root user, and adding a firewall and fail2ban (already set up on our one-click VPS apps) take about ten minutes; Secure a new Linux VPS walks through every command for Ubuntu, Debian, AlmaLinux and Rocky.
Keep one session open while you change SSH settings. Test every change from a second window before closing the first. If you do lock yourself out, the browser Console in the client area still works, and rescue mode can reset the root password.
SSH connection troubleshooting
Add -v to any SSH command (ssh -v root@203.0.113.42) to see each step of the connection; the last few lines usually name the problem.
"Connection timed out"
Nothing answered on port 22. Check the IP, and that the VPS shows Running. A firewall rule on the server (or fail2ban, after too many failed logins) can drop you silently: open the browser Console, run ufw status or firewall-cmd --list-all, and look for the address our what's my IP tool shows. Some office and hotel networks block outgoing SSH, so try once from mobile data.
"Connection refused"
The server is reachable but nothing is listening on that port. Either the SSH service has stopped, or it was moved to another port. From the Console:
systemctl status ssh # "sshd" on AlmaLinux and Rocky
ss -tlnp | grep ssh # shows the port it listens onIf it listens on another port, connect with ssh -p 2222 root@203.0.113.42.
"Permission denied (publickey)"
The server only accepts keys and didn't accept the one you offered. Check you're using the right user and key (ssh -i ~/.ssh/id_ed25519 user@203.0.113.42). On the server, SSH ignores keys whose files are too open, so reset the permissions from the Console:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!"
The server's host key differs from the one your computer saved. That's expected after you rebuild or reinstall the VPS, which creates new keys. Verify the new fingerprint in the Console (see Step 2), then remove the old entry and connect again:
ssh-keygen -R 203.0.113.42If you haven't rebuilt the server, don't connect. Open a ticket and we'll check it with you.
Windows: "UNPROTECTED PRIVATE KEY FILE"
Other Windows users can read your private key, so OpenSSH refuses to use it. In PowerShell, make it readable by you alone:
icacls $env:USERPROFILE\.ssh\id_ed25519 /inheritance:r
icacls $env:USERPROFILE\.ssh\id_ed25519 /grant:r "$($env:USERNAME):(R)"Was this guide helpful?Your answer stays in this browser; nothing is sent unless you write to us below.
Related guides
All 16 guidesStill stuck? Ask an engineer.
Tickets and email are answered 24/7 in English and Hindi. Include the server's IP and the last lines of ssh -v, never your password.