• Automatic, encrypted backups to Amazon S3

• Publish SSH fingerprints via DNS.
• Enable CAA with pinned Let's Encrypt account key.
• Publish HTTPS certificate fingerprints via DNS, implement secure automatic updates (difficult).
• Publish XMPP certificate fingerprints via DNS, implement secure automatic updates (difficult).
• Advertise Alt-Svc support for HTTP/2 and HTTP/3.

• [✓ shenmedouxing, 2026-09-21]Enable ECN (Explicit Congestion Notification) and TCP BBR in Git repo.
• Enable Firewall using the VPS provider's settings (not nftables, to save CPU)

• [✓ shenmedouxing, 2026-09-21]Add all server names used by ACME challenges to Nginx in Git
• [✓ shenmedouxing, 2026-09-21]Fix Nginx's missing 80/443 port listens in Git
• [✓ shenmedouxing, 2026-09-21]Fix a TLS certificate renewal script bug.
• [✓ shenmedouxing, 2026-09-21]Enable HTTP/2 and HTTP/3 (QUIC)
• Encrypted Client Hello (ECH)
• Test classical Diffie-Hellman for DoS Resistance (DHEat Attack)
• Update outdated Tor hidden services

• Completely reinstall WordPress as a Trojan precaution.
• Run WordPress with read-only /var/www (wordpress:www-data with mode 750 and 640), with out-of-band auto upgrade via wp-clivia cron. This simulates W^X at the PHP level with Unix permissions to harden WordPress from PHP Trojans.
• Separate the webroot and PHP basepath of WordPress and DokuWiki, with no symlinks between them.
• [✓ shenmedouxing, 2026-09-26]WordPress should use a Unix domain socket to talk MariaDB, disable TCP/IP on MariaDB.
• WordPress's MySQL user should have reduced privileges, not a "allow everything for this database".
• WordPress and DokuWiki accounts should have password resets.
• Inactive historical accounts should be disabled or deleted.
• Abuse of superuser accounts should be avoided.
• WordPress should deploy caching to prevent the "Slashdot" effect, this is especially important in the era of clawers, benchmark needed via Apache <code>ab</code>.
• Audit Web pages for cookies and 3rd-party resources, proxy or remove them.
• DokuWiki needs to implement anti-spam, spambots are already flooding in within a day after the server goes back online.
• Delete over 1000 spam accounts in DokuWiki, without affecting legitimate accounts.
• [✓ shenmedouxing, 2026-09-22]Rate-limit CPU intensive WordPress PHP pages

• Forwarding between LiberaChat and OFTC should be restored.
• Forwarding should be hosted on the server on a system daemon.

• Outgoing port 25 traffic is blocked, circumvent SMTP blocking by hosting provider through a commercial or self-hosted relay
• OpenSMTPD standard compliance (rDNS, DKIM, SPF, DMARC).
• SMTP forwarding test (root/webmaster/abuse/security) to maintainers.
• SMTP sending test (needed for PHP registration, password resets)
• SMTP TLS hardening (PQC, TLSv1.3, disable session ticket)
• SMTP should be tested for spam resistance, if root@ receives spam and it's forwarded, the server must not be blocked by Gmail for spam.

• XMPP should publish abuse contacts
• XEP compliance tests
• [✓ shenmedouxing, 2026-09-22]Implement XMPP over HTTP (BOSH), commit changes to Git.
• [✓ shenmedouxing, 2026-09-23]Implement XMPP over Websocket, commit changes to Git.
• <code>ircbindxmpp</code> and <code>chatlist</code> should be retested for startup timing and crash recovery
• <code>ircbindxmpp</code> should use SASL External, with automatic certificate generation on first startup.
• Re-open registration, with mod_firewall and a custom bot to prevent spam

• XMPP Server adopts more XEPs
• Security Check
• Warrant Canary

Following are the projects that needs contributor!

• "Free Software, Free Society" v3 Chinese Translation: Almost done, needs update all translation to GNU website.
• Planet