The 17-Point Self-Hosted Security Checklist
The exact checklist I run on every server before it touches the internet. Firewall, SSH, containers, secrets, and backups, with the commands. Free PDF.
The first server I ever owned got popped in 11 days. Default image, root SSH with a password I thought was clever, port 22 wide open. I came back from a weekend to a CPU pinned at 100% and a stranger's crypto miner eating my credits.
I've audited servers for four clients in the past year. Every one had at least three of the issues on this list. The difference between a homelab and someone else's free crypto miner is usually about 17 boring config decisions. This PDF is the checklist I run on every server I touch, mine and my clients', with the exact commands.
What's inside
- A default-deny firewall setup, and why your cloud security group doesn't replace a host firewall
- SSH hardening you can do in 90 seconds (no root, no passwords, ed25519 keys)
- Running services and your deploy user as non-root, with a whitelisted sudo example
- Patching on autopilot and scanning container images for known CVEs
- Locking down Docker: non-root, read-only, dropped capabilities, pinned digests
- TLS everywhere (yes, internal too) and one HSTS header
- Getting secrets out of env files, in order of effort
- Shipping logs off-host and the five things worth alerting on
- The 3-2-1 backup rule, and the restore drill everyone skips
- A one-page 17-point baseline you can print and tape to your monitor
Who it's for
Anyone running their own VPS or homelab: indie developers, small teams, and founders who self-host. No security background needed. Every point comes with the command or config to apply it.
Get the PDF
Drop your name and email above and the checklist is yours. It's a clean, printable PDF you can keep next to your terminal and run on every new box before you expose it to the internet.