Install Redis on a Linux VPS and Secure It

Redis is an in-memory data store used as a cache, session store and message queue. Putting it in front of MySQL can cut page times sharply for WordPress, Laravel and Node.js apps. This guide shows how to install Redis on a Linux VPS and lock it down, because an exposed Redis is one of the most common ways servers get compromised.

Before you start

Root or sudo access to an Ubuntu, Debian, AlmaLinux or Rocky Linux VPS.
Some free RAM: Redis keeps all data in memory.

Install Redis

Ubuntu/Debian:

apt update && apt install redis-server

AlmaLinux/Rocky:

dnf install redis

Enable it at boot and start it. The service is redis-server on Debian/Ubuntu and redis on RHEL-based systems:

systemctl enable --now redis-server

Test with redis-cli ping; it should answer PONG.

Secure the configuration

Edit the config file: /etc/redis/redis.conf (Debian/Ubuntu) or /etc/redis/redis.conf / /etc/redis.conf (RHEL). Set:

bind 127.0.0.1 ::1
protected-mode yes
port 6379
requirepass a-long-random-password
maxmemory 256mb
maxmemory-policy allkeys-lru

bind 127.0.0.1 keeps Redis off the public network. Only open it to other servers over a private network or VPN, never the internet.
requirepass adds a password. Generate one with openssl rand -base64 32. Redis 6+ also supports ACL users.
maxmemory with allkeys-lru makes Redis evict the least-used keys instead of eating all RAM, the right choice for a cache.

On Ubuntu, also set supervised systemd. Restart afterwards:

systemctl restart redis-server

Danger: never expose port 6379 to the internet. Attackers scan for open Redis instances and use them to write SSH keys or cron jobs onto servers. Block the port in your firewall as a second layer.

Choose persistence

Mode	Setting	Use when
None	`save ""`, `appendonly no`	Pure cache, data can be rebuilt
RDB snapshots	`save 900 1` (default style)	Sessions or queues where losing a few minutes is OK
AOF	`appendonly yes`, `appendfsync everysec`	Data you cannot easily lose

Connect your application

PHP: install the extension (apt install php-redis or the matching php8.x-redis) and restart PHP-FPM.
WordPress: install an object cache plugin such as Redis Object Cache and add to wp-config.php:
```
define('WP_REDIS_PASSWORD', 'a-long-random-password');
```
Laravel: set REDIS_PASSWORD in .env and CACHE_STORE=redis.

Check that it works

redis-cli -a 'a-long-random-password' info stats | grep keyspace

Rising keyspace_hits means the cache is being used. redis-cli info memory shows memory use. Confirm Redis only listens locally with ss -ltnp | grep 6379.

Troubleshooting

NOAUTH Authentication required: the client is not sending the password; add it to the app config.
OOM command not allowed: maxmemory is reached with a noeviction policy. Raise the limit or use allkeys-lru.
WARNING overcommit_memory is set to 0: add vm.overcommit_memory = 1 to /etc/sysctl.d/99-redis.conf and run sysctl --system.

Redis FAQ

Redis or Memcached?

Both cache well. Redis adds persistence, data types and queues; Memcached is simpler and multi-threaded for plain key-value caching.

How much memory does Redis need?

As much as your cached data. For a typical WordPress object cache, 128–512 MB is plenty.

Is Valkey the same as Redis?

Valkey is an open-source fork of Redis 7.2 and works as a drop-in replacement; some distributions now ship it instead.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket