• Automatic, encrypted backups to Amazon S3

• Publish SSH fingerprints via DNS.
• Enable CAA with pinned Let's Encrypt account key.
• Publish HTTPS certificate fingerprints via DNS, implement secure automatic updates (difficult).
• Publish XMPP certificate fingerprints via DNS, implement secure automatic updates (difficult).
• Advertise Alt-Svc support for HTTP/2 and HTTP/3.

• [✓ shenmedouxing, 2026-09-21]Enable ECN (Explicit Congestion Notification) and TCP BBR in Git repo.
• Enable Firewall using the VPS provider's settings (not nftables, to save CPU)

• [✓ shenmedouxing, 2026-09-21]Add all server names used by ACME challenges to Nginx in Git
• [✓ shenmedouxing, 2026-09-21]Fix Nginx's missing 80/443 port listens in Git
• [✓ shenmedouxing, 2026-09-21]Fix a TLS certificate renewal script bug.
• [✓ shenmedouxing, 2026-09-21]Enable HTTP/2 and HTTP/3 (QUIC)
• Encrypted Client Hello (ECH)
• Test classical Diffie-Hellman for DoS Resistance (DHEat Attack)
• Update outdated Tor hidden services

• Completely reinstall WordPress.
• Run WordPress with read-only <todo>/var/www (

  wordpress:www-data

  with mode 650), with out-of-band auto upgrade via

  wp-cli

  . This simulate W^X with Unix permissions to harden WordPress from PHP Trojans.</todo>.

• WordPress and DokuWiki accounts should have password resets.
• Inactive historical accounts should be disabled or deleted.
• Abuse of superuser accounts should be avoided.
• WordPress should deploy caching to prevent the "Slashdot" effect, this is especially important in the era of clawers, benchmark needed via Apache <code>ab</code>.
• Audit Web pages for cookies and 3rd-party resources, proxy or remove them.
• DokuWiki needs to implement anti-spam, spambots are already flooding in within a day after the server goes back online.
• Delete over 1000 spam accounts in DokuWiki, without affecting legitimate accounts.
• [✓ shenmedouxing, 2026-09-22]Rate-limit CPU intensive WordPress PHP pages

• Forwarding between LiberaChat and OFTC should be restored.
• Forwarding should be hosted on the server on a system daemon.

• Outgoing port 25 traffic is blocked, circumvent SMTP blocking by hosting provider through a commercial or self-hosted relay
• OpenSMTPD standard compliance (rDNS, DKIM, SPF, DMARC).
• SMTP forwarding test (root/webmaster/abuse/security) to maintainers.
• SMTP sending test (needed for PHP registration, password resets)
• SMTP TLS hardening (PQC, TLSv1.3, disable session ticket)
• SMTP should be tested for spam resistance, if root@ receives spam and it's forwarded, the server must not be blocked by Gmail for spam.

• XMPP should publish abuse contacts
• XEP compliance tests
• [✓ shenmedouxing, 2026-09-22]Implement XMPP over HTTP (BOSH), commit changes to Git.
• Implement XMPP over Websocket, commit changes to Git.
• <code>ircbindxmpp</code> and <code>chatlist</code> should be retested for startup timing and crash recovery
• <code>ircbindxmpp</code> should use SASL External, with automatic certificate generation on first startup.
• Re-open registration, with mod_firewall and a custom bot to prevent spam

• XMPP Server adopts more XEPs
• Security Check
• Warrant Canary

Following are the projects that needs contributor!

• "Free Software, Free Society" v3 Chinese Translation: Almost done, needs update all translation to GNU website.
• Planet