[✓ gaizi, 2026-10-31]Automatic, encrypted backups to Amazon S3
DNS
[✓ shenmedouxing, 2026-09-27]Delete invalid "zombie" SSHFS and DANE records from DNS (difficult, can't be deleted due to a DNS panel bug, the only solution is to rollback to the fresh AXFR and readd all DNS records.
Publish SSH fingerprints via DNS.
[✓ shenmedouxing, 2026-09-26]Enable CAA with pinned Let's Encrypt account key.
[✓ shenmedouxing, 2026-09-27]Advertise Alt-Svc support for HTTP/2 and HTTP/3.
TCP
[✓ shenmedouxing, 2026-09-21]Enable ECN (Explicit Congestion Notification) and TCP BBR in Git repo.
Enable Firewall using the VPS provider's settings (not nftables, to save CPU)
HTTP
[✓ shenmedouxing, 2026-09-21]Add all server names used by ACME challenges to Nginx in Git
[✓ shenmedouxing, 2026-09-21]Fix Nginx's missing 80/443 port listens in Git
[✓ shenmedouxing, 2026-09-21]Fix a TLS certificate renewal script bug.
[✓ shenmedouxing, 2026-09-21]Enable HTTP/2 and HTTP/3 (QUIC)
Encrypted Client Hello (ECH)
Test classical Diffie-Hellman for DoS Resistance (DHEat Attack)
Update outdated Tor hidden services
PHP
[✓ shenmedouxing, 2026-10-14]Completely reinstall WordPress as a Trojan precaution.
[✓ shenmedouxing, 2026-10-14]Run WordPress with read-only/var/www (wordpress:www-data with mode 750 and 640), with out-of-band auto upgrade via wp-clivia cron. This simulates W^X at the PHP level with Unix permissions to harden WordPress from PHP Trojans.
Separate the webroot and PHP basepath of WordPress and DokuWiki, with no symlinks between them.
[✓ shenmedouxing, 2026-09-26]WordPress should use a Unix domain socket to talk MariaDB, disable TCP/IP on MariaDB.
[✓ shenmedouxing, 2026-10-14]WordPress's MySQL user should have reduced privileges, not a "allow everything for this database".
[✓ gaizi, 2026-10-31]WordPress and DokuWiki accounts should have password resets.
[✓ shenmedouxing, 2026-10-21]Inactive historical accounts should be disabled or deleted.
[✓ gaizi, 2026-10-31]Abuse of superuser accounts should be avoided.
WordPress should deploy caching to prevent the "Slashdot" effect, this is especially important in the era of crawlers, benchmark needed via Apache <code>ab</code>.
[✓ shenmedouxing, 2026-10-20]Audit Web pages for cookies and 3rd-party resources, proxy or remove them.
[✓ shenmedouxing, 2026-10-20]DokuWiki needs to implement anti-spam, spambots are already flooding in within a day after the server goes back online.
[✓ shenmedouxing, 2026-10-20]Delete over 1000 spam accounts in DokuWiki, without affecting legitimate accounts.
[✓ shenmedouxing, 2026-09-22]Rate-limit CPU intensive WordPress PHP pages
IRC
Forwarding between LiberaChat and OFTC should be restored.
Forwarding should be hosted on the server on a system daemon.
SMTP
[✓ shenmedouxing, 2026-10-18]Outgoing port 25 traffic is blocked, circumvent SMTP blocking by hosting provider through a commercial or self-hosted relay
[✓ shenmedouxing, 2026-10-18]OpenSMTPD standard compliance (rDNS, DKIM, SPF, DMARC).
[✓ shenmedouxing, 2026-10-24]SMTP forwarding test (root/webmaster/abuse/security) to maintainers.
[✓ shenmedouxing, 2026-10-18]SMTP sending test (needed for PHP registration, password resets)