---
title: "Changing your SSH port with the command line"
source: "https://docs.nexcess.com/hosting/server-administration/linux/changing-your-ssh-port-with-the-command-line/"
description: "Change default ports like SSH (port 22) to enhance server security. This reduces vulnerability to common attacks and deters scanning by malicious programs."
vertical: "Hosting"
date: "2024-03-04"
last_modified: "2026-07-29"
---

# Changing your SSH port with the command line

Firewalls have different ports that allow different services to access your server. There’s a detailed explanation of firewalls and ports in [Opening and Closing Firewall Ports](https://docs.nexcess.com/hosting/security/firewall-management/opening-and-closing-firewall-ports/). Certain services typically run on certain ports. For instance, Secure Shell (SSH) typically runs on port 22. But this predictability makes servers more vulnerable. Malicious programs and people can exploit common ports, especially if a server user has a weak password.

A quick and simple way to avoid some attackers is to change the port you use for SSH. This won’t prevent attacks that are directed specifically at your server, but it will help if malicious programs are scanning port 22 for information: the information won’t be there!

You change the SSH port via command line. The process involves

1. [Opening Your New Port in CSF](#OpeningCSF)
2. [Editing the SSH Configuration File](#EditingSSHConfig)
3. [Closing Port 22](#Closing22)
4. [Reporting Your New SSH Port](#ReportingSSH)

If you’ve used a terminal to log into your server, you’ll be able to change your SSH port.

## Opening Your New Port in CSF

You must open your new firewall port before you edit your SSH configuration files. This ensures you aren’t locked out of your server while you’re making these changes. Follow these instructions for adding your new SSH port to your firewall. If you have a hardware firewall, please contact our Support team so we can make the changes to your hardware.

1. Log into [WHM](https://docs.nexcess.com/hosting/control-panel/whm/getting-started-with-whm/). You can log into WHM through your [Liquid Web account](https://portal.nexcess.com/) or by going to: ```
    mysite.com/whm
    ```
    
    Remember to replace mysite.com with your domain.
2. **ConfigServer Security & Firewall** is under **Plugins** in the left-hand navigation. Or, search for “Firewall” in the search bar. Then, click on **ConfigServer Security & Firewall.  
    ![csf home page](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_NFdDUG.png)**
3. Scroll down to **csf – ConfigServer Firewall** and click on **Firewall Configuration**. This page has all the settings for CSF. This is exactly the same file you’d see if you use the command line interface to edit this configuration file, but laid out graphically.  
    ![firewall configuration](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_mC5LL7.png)
4. Scroll down to **IPv4 Port Settings**.
5. The important settings are **TCP\_IN** and **TCP\_OUT**. 
    - Add your new SSH port number to **TCP\_IN** to allow incoming traffic on that port.
    - Add your new SSH port number to **TCP\_OUT** to allow outgoing traffic through that port.
    
    Separate ports with a comma, but don’t use spaces.  
    ![ivp4 ports](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_DW9nto.png)
6. Once you’ve added your port, scroll all the way to the bottom of the page and click **Change**.
7. Your changes will be confirmed, and the last step is to restart your firewall to put your changes into action. Click **Restart csf+ltd**.  
    ![restart csf and lfd](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_0gKOiW.png)
8. CSF will restart and the changes you made will be live. You can click **Return** at the bottom of the page to go back to the main CSF configuration page.

## Editing the SSH Configuration File

1. SSH into your server. If you haven’t SSHed into your server before, read [Logging into Your Server via Secure Shell (SSH)](https://docs.nexcess.com/hosting/server-administration/linux/logging-into-your-server-via-secure-shell-ssh/) first.
2. The SSH configuration file is called *sshd\_config* and is located at: ```
    /etc/ssh/sshd_config
    ```
    
    Create a backup of this file by using the **cp** command to **c**o**p**y the file’s contents into a new file. Type:
    
    ```
    cp /etc/ssh/ssh_config /etc/ssh/ssh_config_backup
    ```
    
    | ### **Check Your Work** |
    |---|
    | Look in the ssh directory to see if your backup file and your original file are both there: ``` cd /etc/ssh ```  then,  ``` ll ```  You’ll see both the sshd\_config file and the sshd\_config\_backup |
3. Now that you have a backup file, you need to open the *sshd\_config* file in a text editor. Let’s use the Vim editor. Type: ```
    vim /etc/ssh/sshd_config
    ```
4. You’ll see the configuration file open on your screen. Using you keyboard’s arrow keys, find the port setting. If your port is 22, the port setting will have a # at the beginning of the line. This turns the line into a comment: your server will ignore anything on that line.

![ssh port highlighted](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_pg7fEM.png)

5. Press **i** to start **i**nserting text. Then, remove the # in front of the port and change the number 22 to the port number you want to use for SSH.  
    ![editing ssh port](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_SVhvfJ.png)| ### **Choosing an SSH Port** |
    |---|
    | Make sure you don’t pick a port number that another service uses. Check [Wikipedia’s list of port numbers and their uses](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers). Then, use a port number that isn’t listed. |
6. When you’re done editing your file, press the **Esc** key to stop inserting text, then type: ```
    :wq
    ```
    
    to **w**rite (save) your changes and **q**uit the file.
7. Now, you’ll restart the SSH service. If you have a CentOS 7 server, use this command ```
    systemctl restart sshd
    ```
    
    and press **Enter**. If you have a server older than CentOS 7, use the command
    
    ```
    service sshd restart
    ```
    
    and press **Enter**.

## Closing Port 22

You’ve successfully changed your SSH port! Now, you can safely close port 22 in your firewall. It’s best practice to close ports you aren’t using. Follow these instructions for adding your new SSH port to your firewall ([Opening and Closing Firewall Ports](https://docs.nexcess.com/hosting/security/firewall-management/opening-and-closing-firewall-ports/)). If you have a hardware firewall, please contact our Support team so we can make the changes to your hardware.

1. Log into WHM. You can log into WHM through your [Liquid Web account](https://portal.nexcess.com/) or by going to: ```
    mysite.com/whm
    ```
    
    Remember to replace mysite.com with your domain.
2. **ConfigServer Security & Firewall** is under **Plugins** in the left-hand navigation. Or, search for “Firewall” in the search bar. Then, click on **ConfigServer Security & Firewall.  
    ![csf home page](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_rgWqK9.png)**
3. Scroll down to **csf – ConfigServer Firewall** and click on **Firewall Configuration**. This page has all the settings for CSF. This is exactly the same file you’d see if you use the command line interface to edit this configuration file, but laid out graphically.  
    ![firewall configuration](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_MH9gva.png)
4. Scroll down to **IPv4 Port Settings**.
5. The important settings are **TCP\_IN** and **TCP\_OUT**. 
    - Remove “22” from **TCP\_IN** to deny incoming traffic on that port.
    - Remove “22” from **TCP\_OUT** to deny outgoing traffic through that port.
    
    Separate ports with a comma, but don’t use spaces.  
    ![ivp4 ports](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_npFpjZ.png)
6. Once you’ve removed port 22, scroll all the way to the bottom of the page and click **Change**.
7. Your changes will be confirmed, and the last step is to restart your firewall to put your changes into action. Click **Restart csf+ltd**.  
    ![restart lfd and csf](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_hET9iG.png)
8. CSF will restart and the changes you made will be live. You can click **Return** at the bottom of the page to go back to the main CSF configuration page.

## Reporting Your New SSH Port

Now, when you SSH into your server, you’ll type in:

```
ssh root@youripaddress -p##
```

You’ll replace “youripaddress” with your server’s IP address and “**\##”** with your new SSH port. Logging in with:

```
ssh root@youripaddress
```

will no longer work. If you have any problems with your server, Liquid Web will need your new SSH port to log into your server to help you. If you change your SSH port, log into your Liquid Web account and securely tell Liquid Web your new SSH port.

## Using portal.nexcess.com

1. Log into your [Liquid Web account.](https://portal.nexcess.com/)
2. Click on **My Servers** in the left side menu.  
    ![](https://docs.nexcess.com/wp-content/uploads/2026/06/my-servers-link-highlighted-1.png)
3. Click on the name of the server for which you want to update the ssh port.
4. Click on the three dot menu to the right of the servers name and click **Support Access.  
    ![](https://docs.nexcess.com/wp-content/uploads/2026/06/three-dot-menu-support-access-1.png)**
5. Update the current ssh port in the SSH port field. Click **Submit** to save your changes.  
    ![](https://docs.nexcess.com/wp-content/uploads/2026/06/ssh-port-field.png)

Liquid Web takes your security very seriously. We only log into your server when you need help and we’ve authenticated your identity.