Every server on the public internet gets scanned within minutes of coming online. Not maybe, not eventually, minutes. We watch it happen from the hosting side: a fresh IP starts collecting SSH login attempts before the OS has finished its first round of updates. Security isn't something you bolt on later, it's the foundation everything else sits on.
The first hour of a server's life matters most. Before a new box does anything useful, it gets SSH keys instead of passwords (with password login switched off entirely), a default-deny firewall opening only the ports it actually serves, automatic security patches, and fail2ban or an equivalent watching the front door. That's maybe twenty minutes of work, and it shuts out the overwhelming majority of what those scanners are probing for.
Because here's the thing: most compromises aren't clever. Nobody is burning a zero-day on your Valheim server. It's a bot trying ten thousand passwords against port 22, or an exploit for a bug that was patched months ago, fired at every machine that never updated. Patch early and automatically, and you've opted out of the most common way servers die. Two smaller habits pay off at the same time: run each service as its own unprivileged user so a compromised app doesn't own the whole machine, and turn on MFA everywhere it's offered, because the day a password leaks you'll be glad there's a second lock. Moving SSH off port 22 isn't security, it's noise reduction, but quieter logs are easier to read, so do it anyway.
The part almost everyone skips is actually looking at the machine afterwards. Logs are only useful if something reads them. Ship them somewhere central and set alerts on the boring signals that precede every bad day: authentication failures spiking, a disk quietly filling, a service restarting in a loop, outbound traffic from a box that should only ever receive. And know your own attack surface. Take an honest inventory of every port you have open and every service you're exposing, then close what you can't justify, because the tools attackers use to find forgotten services are free and you can use them on yourself first.
The industry surveys on detection are grim reading. Breaches routinely sit undiscovered for months, and the bill grows the whole time. The intrusion you don't notice is the expensive kind.
Backups are a security control, not just an ops chore. Ransomware crews know your first move after an incident is to restore, so finding and destroying backups is part of their playbook now. Keep at least one copy offline or otherwise out of reach of the machines it protects, follow something like 3-2-1 (three copies, two kinds of storage, one offsite), and actually test the restores. A backup you've never restored is a hope, not a plan.
Then there's DDoS, which deserves a special mention if you host anything game-shaped. Game servers attract this constantly, and the barrier to entry is embarrassingly low: an annoyed teenager with twenty dollars and a booter site can knock an unprotected server offline from their phone. Sort out mitigation before it happens. Know what your provider or upstream will actually do during an attack, because the middle of one is the worst possible time to find out the answer is "null-route you and wish you luck".
One more that's specific to our corner of the internet: mods and plugins are a supply chain, and they run with the server's full privileges. That cool economy plugin from a forum post is code you're choosing to execute, so get plugins from the official repositories or well-known authors, be suspicious of anything that arrives as a bare download link in a Discord message, and remember that plugins need patching just like the OS underneath them. An abandoned plugin with a known hole is one of the most common ways game servers specifically get popped. While you're at it, expose only the game port to the world. The admin panel, RCON, SSH and the database have no business being reachable by everyone on earth, and putting them behind a VPN like WireGuard takes an evening and removes them from the attack surface entirely.
The part that gets missed: security is a habit, not a checklist. Threats change, software rots, and that firewall rule from two years ago probably doesn't do what you think it does anymore. Accounts accumulate, old services linger, and the machine you set up so carefully has been drifting ever since. Put a regular review on the calendar, walk through what's running, what's exposed and who still has access, and treat the whole thing like maintenance, because that's exactly what it is.