• Automatic, encrypted backups to Amazon S3

• Publish SSH fingerprints via DNS.
• Enable CAA with pinned Let's Encrypt account key.
• Publish HTTPS certificate fingerprints via DNS, implement secure automatic updates (difficult).
• Publish XMPP certificate fingerprints via DNS, implement secure automatic updates (difficult).

• [✓ shenmedouxing, 2026-09-21]Enable ECN (Explicit Congestion Notification) and TCP BBR in Git repo.
• Enable Firewall using the VPS provider's settings (not nftables)

• Add all server names used by ACME challenges to Nginx in Git
• Fix Nginx's missing 80/443 port listens in Git
• Fix a TLS certificate renewal script bug.
• Enable HTTP/2 and HTTP/3 (QUIC)
• Encrypted Client Hello (ECH)
• Test Classical Diffie-Hellman for DoS Resistance (DHEat Attack)
• Update outdated Tor hidden services

• WordPress and DokuWiki accounts should have password resets.
• Inactive historical accounts should be disabled or deleted.
• Abuse of superuser accounts should be avoided.
• WordPress should deploy caching to prevent the "Slashdot" effect, this is especially important in the era of clawers, benchmark needed via Apache <code>ab</code>.
• Audit Web pages for cookies and 3rd-party resources, proxy or remove them.
• DokuWiki Anti-Spam
• Rate-limit CPU intensive WordPress PHP pages

• Forwarding between LiberaChat and OFTC should be restored.
• Forwarding should be hosted on the server on a system daemon.

• Outgoing port 25 traffic is blocked, circumvent SMTP blocking by hosting provider through a commercial or self-hosted relay
• OpenSMTPD standard compliance (rDNS, DKIM, SPF, DMARC).
• SMTP forwarding test (root/webmaster/abuse/security to maintainers.
• SMTP sending test (needed for PHP registration, password resets)
• SMTP TLS hardening (PQC, TLSv1.3, disable session ticket)
• SMTP should be tested for spam resistance, if root@ receives spam and it's forwarded, the server must not be blocked by Gmail for spam.

• XMPP should publish abuse contacts
• XEP compliance tests
• <code>ircbindxmpp</code> and <code>chatlist</code> should be retested for startup timing and crash recovery
• <code>ircbindxmpp</code> should use SASL External, with automatic certificate generation on first startup.
• Re-open registration, with mod_firewall and a custom bot to prevent spam

• XMPP Server adopts more XEPs
• Security Check
• Warrant Canary

Following are the projects that needs contributor!

• "Free Software, Free Society" v3 Chinese Translation: Almost done, needs update all translation to GNU website.
• Planet