How to Secure Freqtrade on a VPS
The highest-impact rule is separation: the public website should not control the trading server and should never receive exchange secrets.
Threat model: what are we protecting?
Security improves when each component has only the access it actually needs. The website should be able to display metrics without being able to trade.
Reduce credential risk
Use dedicated exchange API credentials, minimum permissions and no withdrawal permission. Keep secrets out of Git repositories, public logs, dashboards and exported experiment files.
Reduce server exposure
Use SSH keys instead of reusable passwords where practical, patch the operating system, expose only required network services and avoid publishing databases or internal bot APIs directly to the internet.
Separate publishing from trading
A safer research architecture is outbound-only reporting: the trading server produces sanitized metrics and pushes them over HTTPS to a separate website. Compromise of the public site then does not automatically provide control of the bot.
Operational checklist
Protect secret files with restrictive permissions, run processes with the least privileges available, configure automatic restart, inspect logs for repeated failures, keep recoverable configuration backups and rotate credentials if exposure is suspected.
VPS deployment guide →