A complete breakdown of every security measure baked into your ShieldHost server. Nothing optional, nothing left to chance — these protections are active from the moment your server comes online.
8 security layers • Active from first boot • Zero manual configuration
Most VPS providers hand you a raw Linux image and wish you luck. You get root, a public IP, and an open SSH port — and from that point, security is your problem. You're expected to harden the OS, configure the firewall, set up key auth, install intrusion detection, keep packages updated, and do it all before someone finds your server on Shodan.
We think that's backwards. Security shouldn't be a post-deployment checklist. It should be the foundation you build on.
Every ShieldHost server ships with a hardened base image, a locked-down firewall, Tailscale mesh networking, ClamAV malware scanning, and automatic security updates — all configured before you ever log in. We don't offer these as add-ons or premium features. They're the default. They're non-negotiable.
This is what we mean by "opinionated." We made the security decisions so you can focus on what you're actually building.
Traditional VPS networking exposes your server to the entire internet. ShieldHost flips that model — your server lives on a private Tailscale mesh and has no public-facing ports.
Your device
Tailscale client installed
WireGuard tunnel
End-to-end encrypted
ShieldHost server
Private interface only
Every layer below is applied automatically when your server is provisioned. There's nothing to enable, nothing to configure. This is what's running on your server from minute one.
Every ShieldHost server joins your Tailscale mesh network at boot. There are no public-facing admin ports — no SSH on port 22, no control panels exposed to the internet. The only way to reach your server is through your authenticated tailnet. This eliminates the single biggest attack vector on any VPS: the exposed management interface.
We configure the firewall with a deny-all inbound policy. The only exceptions are Tailscale mesh traffic and any ports explicitly opened for optional packages you install (like PostgreSQL). Every firewall rule is scoped to the Tailscale interface — nothing is exposed to the public network.
When you provide an SSH public key during server creation, it's configured on the server automatically. We strongly recommend key-based authentication over passwords. Key auth is cryptographically stronger, immune to brute-force, and eliminates the most common way attackers get into servers.
ClamAV is installed and enabled on every server from the start. Virus definitions are kept up to date automatically, and the scanning daemon runs continuously for on-demand and scheduled malware detection. This gives you a baseline defense against malware that lands on your server through application code, uploads, or dependencies.
Our base image ships with the minimum packages needed to run a secure server. No web servers, no mail daemons, no monitoring agents, no package managers you didn't ask for. Every additional package is a potential vulnerability. We install what you need and nothing more.
Every ShieldHost server runs with full hardware-level virtualization — not a container, not a shared-kernel VPS. You get your own kernel, your own memory space, your own network stack. A compromise on one server cannot escape to affect another.
Provisioning requires sensitive data like your Tailscale auth key. We automatically scrub provisioning data from disk after setup completes. Sensitive credentials aren't left sitting in plaintext waiting to be found.
Your server is configured to apply security patches automatically. You don't need to SSH in at 2 AM to patch a kernel vulnerability. The system handles it, and if a reboot is needed, it happens during a safe maintenance window.
We handle the infrastructure security — the base image, the network configuration, the firewall, the malware scanning, the automatic updates. That's our job, and we take it seriously.
You handle the application layer — what you deploy, how you configure it, who you give access to, and what your Tailscale ACL policies look like. We give you a clean, hardened substrate. What you build on it is up to you.