The 17-Point Self-Hosted Security Checklist

The first server I ever owned got popped in 11 days. Default image, root SSH with a password I thought was clever, port 22 wide open. I came back from a weekend to a CPU pinned at 100% and a stranger's crypto miner eating my credits.

I've audited servers for four clients in the past year. Every one had at least three of the issues on this list. The difference between a homelab and someone else's free crypto miner is usually about 17 boring config decisions. This PDF is the checklist I run on every server I touch, mine and my clients', with the exact commands.

What's inside

• A default-deny firewall setup, and why your cloud security group doesn't replace a host firewall
• SSH hardening you can do in 90 seconds (no root, no passwords, ed25519 keys)
• Running services and your deploy user as non-root, with a whitelisted sudo example
• Patching on autopilot and scanning container images for known CVEs
• Locking down Docker: non-root, read-only, dropped capabilities, pinned digests
• TLS everywhere (yes, internal too) and one HSTS header
• Getting secrets out of env files, in order of effort
• Shipping logs off-host and the five things worth alerting on
• The 3-2-1 backup rule, and the restore drill everyone skips
• A one-page 17-point baseline you can print and tape to your monitor

Who it's for

Anyone running their own VPS or homelab: indie developers, small teams, and founders who self-host. No security background needed. Every point comes with the command or config to apply it.

Get the PDF

Drop your name and email above and the checklist is yours. It's a clean, printable PDF you can keep next to your terminal and run on every new box before you expose it to the internet.