Server Hardening Checklist

Most servers are not compromised by a clever attack. They are compromised because of a handful of settings nobody revisited — a firewall rule left open, password authentication still enabled on SSH, a service nobody remembers installing, patches that quietly stopped being applied months ago.

This checklist covers 29 items across nine categories: access control, SSH hardening, firewall rules, updates and patching, intrusion detection, system baseline, web server configuration, backups, and the advanced hardening steps worth doing once the basics are in place.

Every item explains what the setting does and what it protects against rather than just naming a directive, so you can judge whether it applies to your setup. Where a step needs a fuller walkthrough, the item links to the guide that covers it — the first 24 hours on a new VPS guide for the access-control and SSH basics, and CrowdSec and Nginx hardening for the later sections.

Work through it and your score and grade update live. Progress is saved in your browser, so you can close the tab and pick it up later, and there is a shareable summary when you are done — useful as a record of what was verified, and when.

If the server is brand new, start with the first 24 hours on a new VPS guide, which puts in place the access control and SSH steps this checklist assumes are already done.