Thoughts, tutorials, and insights from the trenches.
ModSecurity paired with the OWASP Core Rule Set knows absolutely nothing about the specific application running behind it. That is exactly why it is so useful. It brutally catches the generic exploit attempts that hit every single server, regardless of what is actually running.
Adding a TOTP code on top of key-only SSH sounds like great defense in depth. But before you break your automation, let's be honest about what it actually protects against.
Almost every compromised WordPress site I have ever cleaned up was hit by something incredibly boring: an outdated plugin, a weak admin password, or a random theme nobody remembered installing. The fixes are exactly as boring, and that is exactly why they work.
Let's Encrypt's 90-day certificates are designed to force automation. But I constantly find servers where the renewal cron job runs, but nobody told the web server to reload the new certificate.
Before anything gets installed, every new server goes through the same short checklist to close off automated attacks.
A walkthrough of cleaning up CyberPanel servers hit by an unauthenticated RCE vulnerability, and the hardening steps that followed.