--- title: "How to secure RDP on a Windows VPS against attacks | StreetHosting" description: "Cut the risk on your Windows VPS: strong password, firewall IP restriction, a port other than 3389, network level authentication, lockout and log monitoring." url: "https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps" type: "page" language: "en-US" --- VPS · 4 min · Intermediate Published on Jul 22, 2026 · Updated on Jul 22, 2026 # Secure RDP on a Windows VPS against attacks Port 3389 open to the internet gets automated login attempts every single day. Here are the layers of protection that actually make a difference. By [Equipe StreetHosting](https://streethosting.com.br/en/autores#equipe-streethosting) · StreetHosting infrastructure and support team [Windows and RDP](https://streethosting.com.br/en/guides/topics/windows) [Security and hardening](https://streethosting.com.br/en/guides/topics/security) Summarize with: [](https://chat.openai.com/?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "ChatGPT") [](https://claude.ai/new?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Claude") [](https://www.google.com/search?udm=50&aep=11&q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Google AI Mode") [](https://x.com/i/grok?text=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Grok") [](https://www.perplexity.ai/search/new?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Perplexity") Share: [](https://x.com/intent/tweet?text=How%20to%20secure%20RDP%20on%20a%20Windows%20VPS%20against%20attacks&url=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps "Share on X") [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps "Share on Facebook") [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps "Share on LinkedIn") [](https://wa.me/?text=How%20to%20secure%20RDP%20on%20a%20Windows%20VPS%20against%20attacks%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Fsecure-rdp-windows-vps "Share on WhatsApp") For agents: Copy as Markdown [.md](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps.md) [Previous How to change the Administrator password on a Windows VPS](https://streethosting.com.br/en/guides/vps/change-administrator-password-windows-vps) [Next VPS graphical console: access your Windows VPS when RDP fails](https://streethosting.com.br/en/guides/vps/windows-vps-console-without-rdp) In this guide 6 sections * [The real risk](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#o-risco) * [The layers of protection](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#camadas) * [Restricting by IP](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#restringir-ip) * [Changing the default port](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#trocar-porta) * [Account lockout and logs](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#bloqueio-e-logs) * [Final checklist](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#checklist) Quick answer To **secure RDP on a Windows VPS**, combine layers: a long, unique password on `Administrator`, a firewall rule allowing the port only from your IP, a change of the default port `3389`, network level authentication turned on, a temporary account lockout after wrong attempts and Windows Update kept current. No single measure is enough. ## The real risk[](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#o-risco) As soon as a VPS goes online with a public IP, bots start scanning it for well-known ports. Port 3389 is one of the most targeted, because whoever gets in through it gets a whole Windows machine, with graphical access and a broadband connection in the data center. The goal of these attacks is almost never you. It is the machine. Hijacked servers become a base for crypto mining, spam, resold access and attacks on third parties. That is why the defense doesn't depend on you being an interesting target. A compromised VPS can generate abusive traffic in the account holder's name, with consequences ranging from suspension to legal liability. Security on a Windows VPS is not optional. ## The layers of protection[](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#camadas) | Layer | What it prevents | Effort | | ---------------------------- | ------------------------------------- | ------ | | Strong password | Guessing and brute force | Low | | Firewall by IP | Any access from outside your network | Low | | Changed port | Mass automated scanning | Medium | | Network level authentication | Connections without valid credentials | Low | | Account lockout | Long sequences of attempts | Medium | | Updates kept current | Exploitation of known flaws | Low | Start with the low-effort ones. A strong password and a restricted firewall already eliminate the overwhelming majority of real incidents on a Windows VPS. ## Restricting by IP[](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#restringir-ip) This is the most effective measure of all when your IP is fixed. Instead of leaving RDP open to the world, you allow the port only from the addresses you actually connect from. 1. Find your current public IP on any lookup site. 2. On the VPS, open Windows Firewall with Advanced Security and find the inbound remote desktop rule. 3. In the rule properties, go to the scope and set the allowed remote address. 4. Add your IP and save. 5. Test the connection before ending the current session. If you get the scope wrong, you lock yourself out. Before applying it, make sure you know how to use the control panel's graphical console to undo the rule. ## Changing the default port[](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#trocar-porta) Changing the RDP port doesn't stop a targeted attack, but it greatly cuts the noise from automated scanning. The change is made in the Windows registry and requires restarting the remote desktop service. * Pick a high, uncommon port, avoiding ports already used by other services on the machine. * Create the firewall rule allowing the new port first, while the old one still works. * Change the port in the registry and restart the service. * Test the connection by entering the IP followed by a colon and the new port. * Only after confirming access, remove the rule for the old port. Write down the port you chose along with your credentials. Forgetting the number is one of the most common causes of lost access after this change. ## Account lockout and logs[](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#bloqueio-e-logs) The account lockout policy temporarily suspends login after a set number of wrong attempts. That makes brute force impractical, because the attacker only gets a few tries per period. Event Viewer, in turn, shows what is going on. In the security logs you will find the failed logon events, with time and source. Seeing dozens of attempts a day from unknown addresses is normal on a public IP and works as a thermometer of your exposure. An overly aggressive account lockout can be used against you: deliberate wrong attempts keep the account locked. Combine the lockout with IP restriction to avoid that effect. ## Final checklist[](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#checklist) * Administrator password changed, long and unique * RDP firewall rule restricted to your IP when possible * Default port changed and written down with the credentials * Network level authentication turned on * Temporary account lockout configured * Windows Update current and restarts applied * Recent backup or snapshot of the VPS Once that is done, follow up with [changing the Administrator password](https://streethosting.com.br/en/guides/vps/change-administrator-password-windows-vps) and learn about the [control panel's rescue console](https://streethosting.com.br/en/guides/vps/windows-vps-console-without-rdp), which is your safety net if a rule goes wrong. In this guide * [The real risk](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#o-risco) * [The layers of protection](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#camadas) * [Restricting by IP](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#restringir-ip) * [Changing the default port](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#trocar-porta) * [Account lockout and logs](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#bloqueio-e-logs) * [Final checklist](https://streethosting.com.br/en/guides/vps/secure-rdp-windows-vps#checklist) ## Frequently asked questions Does changing the RDP port solve it on its own? No. Changing the port greatly reduces the volume of automated scanning, because most bots only look for port 3389. But anyone running a full scan will find the new port. It is a useful layer, not enough protection on its own. What is network level authentication? It is the feature that requires valid credentials before the server loads the sign-in screen. That saves VPS resources and reduces exposure, since anyone without credentials never even sees the interface. My IP is dynamic. How do I restrict access? With a dynamic IP you can't pin a rule to an address. In that case, put more effort into the other layers: a long password, a changed port, account lockout after failed attempts and updates kept current. How do I know if someone is trying to break in? In the Windows Event Viewer, the security logs show failed logins. Lots of events from unknown addresses point to automated scanning, which is common on any public IP. Next step See VPS plans Root VPS in Brazil with NVMe and Anti-DDoS. [See VPS plans](https://streethosting.com.br/en/vps) [See Ryzen VPS Ryzen 9 9950X VPS in São Paulo with root access, NVMe and gamer Anti-DDoS.](https://streethosting.com.br/en/vps/ryzen) [See Xeon VPS Xeon VPS for steady workloads, automation and long-running projects.](https://streethosting.com.br/en/vps/xeon) ## Related guides [VPS Beginner How to change the Administrator password on a Windows VPS The password generated at install is meant for your first login, not for good. Here is how to change it safely and what to do if you lost access. 4 min Read guide](https://streethosting.com.br/en/guides/vps/change-administrator-password-windows-vps) [VPS Intermediate RDP won't connect to a Windows VPS: how to fix it The screen keeps loading and then drops, or you get a credentials error. Before opening a ticket, follow the checking order that solves most cases. 4 min Read guide](https://streethosting.com.br/en/guides/vps/rdp-not-connecting-to-windows-vps) [VPS Intermediate VPS graphical console: access your Windows VPS when RDP fails You locked yourself out with the firewall, or forgot the port you changed. The panel console shows the machine's screen by another route and saves the day. 3 min Read guide](https://streethosting.com.br/en/guides/vps/windows-vps-console-without-rdp) [← Back to the Guide Center](https://streethosting.com.br/en/guides)