Whoever can sign in to your VPS can use the trading terminals running on it. That makes the VPS as valuable as your broker login. These steps protect it without making daily use harder.
1. One person, one login
- Never share your RDP username and password, not with signal providers, EA sellers or "account managers". Anyone with RDP access can place trades, change your EAs or copy your files.
- If someone genuinely needs to look, share read-only access to the trading account instead: MetaTrader supports an investor password that can view the account but not trade.
- If a second person must use the server, give them their own Windows account: Create Windows users with Remote Desktop access.
2. Strong, unique passwords everywhere
Use different long passwords for the VPS, the MdmHost client area, your email and your broker account, and keep them in a password manager. See Change your Windows server password safely.
3. Turn on two-factor authentication where it is offered
Two-factor authentication (2FA) is set up with each service, not on the VPS. Turn it on for your email account (it can reset everything else) and for your broker's client portal if your broker offers it.
4. Lock down Remote Desktop
Follow Secure Remote Desktop on Windows Server: keep Network Level Authentication on, set an account lockout policy, and limit RDP to your own IP addresses if they are stable.
Warning: If your home IP address changes often, an IP restriction can lock you out at an awkward moment. You can always get back in through the browser console in the control panel, but test the process before you rely on it.
5. Be careful what you install
- Download MetaTrader from your broker or MetaQuotes, and EAs only from sources you trust.
- Never run "cracked" EAs or indicators. They are a common way to hide malware that steals logins.
- Keep Microsoft Defender on (guide) and Windows updated (guide).
6. Keep the server for trading
Avoid using the trading VPS for general browsing, email attachments or downloads. The less you do on it, the less can go wrong. If you also want a desktop for everyday work, keep that separate.
7. Protect the devices you connect from
Your laptop and phone hold saved RDP connections. Use a screen lock on each, keep them updated, and do not save the RDP password on shared computers.
If you think someone got in
- Change the Windows password from a session you control:
net user Administrator *. - Change your broker password and check recent trades and withdrawals with your broker.
- Check Event Viewer → Security for successful logins (event ID 4624, logon type 10 is Remote Desktop).
- Open a support ticket with the times you noticed anything unusual.