[✓ shenmedouxing, 2026-09-27]Delete invalid "zombie" SSHFS and DANE records from DNS (difficult, can't be deleted due to a DNS panel bug, the only solution is to rollback to the fresh AXFR and readd all DNS records.
Publish SSH fingerprints via DNS.
[✓ shenmedouxing, 2026-09-26]Enable CAA with pinned Let's Encrypt account key.
[✓ shenmedouxing, 2026-09-27]Advertise Alt-Svc support for HTTP/2 and HTTP/3.
TCP
[✓ shenmedouxing, 2026-09-21]Enable ECN (Explicit Congestion Notification) and TCP BBR in Git repo.
Enable Firewall using the VPS provider's settings (not nftables, to save CPU)
HTTP
[✓ shenmedouxing, 2026-09-21]Add all server names used by ACME challenges to Nginx in Git
[✓ shenmedouxing, 2026-09-21]Fix Nginx's missing 80/443 port listens in Git
[✓ shenmedouxing, 2026-09-21]Fix a TLS certificate renewal script bug.
[✓ shenmedouxing, 2026-09-21]Enable HTTP/2 and HTTP/3 (QUIC)
Encrypted Client Hello (ECH)
Test classical Diffie-Hellman for DoS Resistance (DHEat Attack)
Update outdated Tor hidden services
PHP
[✓ shenmedouxing, 2026-10-14]Completely reinstall WordPress as a Trojan precaution.
[✓ shenmedouxing, 2026-10-14]Run WordPress with read-only/var/www (wordpress:www-data with mode 750 and 640), with out-of-band auto upgrade via wp-clivia cron. This simulates W^X at the PHP level with Unix permissions to harden WordPress from PHP Trojans.
Separate the webroot and PHP basepath of WordPress and DokuWiki, with no symlinks between them.
[✓ shenmedouxing, 2026-09-26]WordPress should use a Unix domain socket to talk MariaDB, disable TCP/IP on MariaDB.
[✓ shenmedouxing, 2026-10-14]WordPress's MySQL user should have reduced privileges, not a "allow everything for this database".
WordPress and DokuWiki accounts should have password resets.
Inactive historical accounts should be disabled or deleted.
Abuse of superuser accounts should be avoided.
WordPress should deploy caching to prevent the "Slashdot" effect, this is especially important in the era of clawers, benchmark needed via Apache <code>ab</code>.
Audit Web pages for cookies and 3rd-party resources, proxy or remove them.
DokuWiki needs to implement anti-spam, spambots are already flooding in within a day after the server goes back online.
Delete over 1000 spam accounts in DokuWiki, without affecting legitimate accounts.
[✓ shenmedouxing, 2026-09-22]Rate-limit CPU intensive WordPress PHP pages
IRC
Forwarding between LiberaChat and OFTC should be restored.
Forwarding should be hosted on the server on a system daemon.
SMTP
Outgoing port 25 traffic is blocked, circumvent SMTP blocking by hosting provider through a commercial or self-hosted relay
OpenSMTPD standard compliance (rDNS, DKIM, SPF, DMARC).
SMTP forwarding test (root/webmaster/abuse/security) to maintainers.
SMTP sending test (needed for PHP registration, password resets)