Most self-hosting horror stories don't start with a hacker. They start with a beginner clicking "deploy" before reading anything. Here are the five mistakes that bite almost everyone in week one — and how to skip them.
1. Running everything as root
You spin up a fresh server, log in as root, and never look back. Bad idea. If one app gets compromised, the attacker owns the whole machine.
Fix: Create a normal user on day one.
adduser yourname
usermod -aG sudo yourname
Then log in as that user and use sudo only when needed. Two minutes of work, huge payoff.
2. Reusing the default admin password
That shiny new dashboard ships with admin / admin or admin / changeme. People genuinely forget to change it. Bots scan the internet for these exact logins around the clock.
Fix: Change every default password before the app ever touches the internet. Use a password manager so you don't reuse one. While you're at it, rename the default admin account if the app allows it.
3. Exposing a port to the whole internet "just to test"
You open port 8080 to check if your app works from your phone. It works. You forget. Now anyone can reach it.
Fix: Keep services on your home network and reach them with a VPN like Tailscale or WireGuard. You install it once, and your phone connects as if it's home. No open ports, no exposure. If you genuinely need public access, put a reverse proxy with HTTPS in front — never raw ports.
4. No backups (or backups on the same machine)
"I'll set up backups later" is how people lose their photo library. Storing backups on the same drive as the data is just as useless — one dead disk and both are gone.
Fix: Follow a simple rule: keep at least one copy somewhere else. An external USB drive plus a weekly copy to a second location covers most beginners. Test that you can actually restore a file. A backup you've never restored is a hope, not a backup.
5. Skipping updates because "it's working"
The scariest server is the one nobody has touched in eight months. Old software is full of known holes that attackers already have scripts for.
Fix: Schedule updates. On most Linux systems:
sudo apt update && sudo apt upgrade
Do this weekly, or enable unattended security updates. For Docker apps, pull new images on a regular schedule. Set a calendar reminder if you have to.
The pattern behind all five
Every mistake here comes from the same place: doing the fun part first and the boring part "later." Later never comes. Flip the order. Lock the door before you decorate the room.
Your one action today: Pick the service you're most proud of running. Confirm it has a unique password, isn't exposed to the open internet, and has at least one backup somewhere else. If any of those three fails, fix it before you build anything new.