StackHarden Tools

Your VPS is hardened. Or is it?

Ten questions, three minutes, a real answer with a reading list. Grouped by area — host, edge, data tier, ops.

No sign-up, no email required. Your answers are saved so the result URL is shareable, but nothing about you personally is stored — no IP, no user-agent, no cookies. Records are cleared after 30 days.

Host

Have you applied a documented hardening baseline to this host?

A defined baseline covering SSH, firewall, MAC layer, patching, and removal of unused services — not just provider defaults.

Is SSH key-only, with root login disabled and modern algorithms?

`PasswordAuthentication no`, `PermitRootLogin no`, modern KexAlgorithms / Ciphers / MACs restricted set.

Are automatic security patches configured with a reboot policy?

`unattended-upgrades` on Debian-family or `dnf-automatic.timer` on RHEL-family, with a defined reboot window and a failure alert.

Is your firewall default-deny, with only explicit allows?

`ufw status verbose` returns `Default: deny (incoming)` or `firewall-cmd --get-default-zone` returns `drop`/`block`. No 'temporary' 0.0.0.0/0 rules.

Edge

Do public endpoints accept only TLS 1.2/1.3 with modern ciphers and HSTS?

`nginx -T | grep ssl_protocols` returns only `TLSv1.2 TLSv1.3`; HSTS `max-age` ≥ 31536000; OCSP stapling on; external scan at A or A+.

Are auth endpoints rate-limited, with fail2ban or equivalent brute-force protection?

Login, signup, password-reset all rate-limited by Nginx `limit_req` (or Caddy equivalent), and fail2ban jailing repeat abusers.

Data tier

Do database connections require TLS, with least-privilege scoped roles?

PostgreSQL: `pg_hba.conf` uses `hostssl`, `SHOW ssl;` returns `on`, application roles are non-superuser. Redis: `tls-port` on, `ACL LIST` scoped per purpose.

Are backups encrypted off-site, with a tested restore in the last 6 months?

Encryption at rest (restic passphrase / GPG); off-host target (S3, B2, other provider); the last restore drill's outcome documented within 6 months.

Ops

Are logs forwarded to a separate log store with a documented retention policy?

rsyslog / journal-upload / equivalent agent forwards off-host; retention window written down; log minimisation applied so you don't retain what you don't need.

Is MFA enforced on every admin interface — cloud, git, CI/CD, DB, WordPress?

Cloud provider consoles, code repos (org-level enforcement), CI/CD tokens, database admin tools, application admin (WordPress etc.) — all MFA-required, not opt-in.

You'll get a score out of 100, a band (Green / Amber / Red), and a reading list ranked by which pieces close the most ground for the least effort.