Most security breaches don’t exploit sophisticated vulnerabilities. They exploit default configurations, unnecessarily exposed services and systems that haven’t been updated in months. A poorly configured server is an open door: nobody may force it today, but bots never rest.
I take care of closing that door before there’s a problem. Audit of the current state, attack surface reduction and configuration of the right defence layers for each service. No heavy suites, no black-box solutions: your infrastructure, properly configured, with everything documented.
I work with agencies and developers that need to leave their clients’ servers in good shape before handover, and with e-commerce managers and companies that want to know their real exposure level.
Common symptoms
- Freshly set up server, never reviewed. Root SSH access with password, open ports that aren’t used, default services still running. A default hosting environment or VPS is not a secure server.
- Ongoing brute-force attacks. SSH, wp-login, xmlrpc, admin panels… the logs are full of attempts and nobody has configured anything to block them.
- Nobody knows which ports or services are exposed. The firewall is “enabled” but nobody has reviewed the rules or checked what’s listening on which port in a long time.
- Security updates pending. The operating system, kernel or stack services haven’t been updated in months. Every week that passes, there are more known, exploitable CVEs.
- Audit needed before a delivery or certification. A client is asking for security evidence, there’s an external audit coming, or you simply want to know the real state before handing over.
How I approach it
The starting point is always the same: understand the real state before touching anything. No applying a generic checklist without understanding the environment. First I audit, then I prioritise by real impact, then I apply changes with documentation for each decision.
The goal is not a “perfect” server on paper, but a server with a reasonable attack surface, with active defence layers where they matter and sufficient logging to detect anomalies.
What this service covers
System security audit
- Review of exposed ports, active services and system users.
- Analysis of default configurations, file permissions and sensitive directories.
- Log review for signs of suspicious access or previous attempts.
- Report with findings classified by severity and concrete recommendations.
System hardening
- SSH configuration: key-based authentication, disable root login, port change if applicable, access restrictions.
- Firewall configuration (iptables, nftables, pf on BSD): restrictive policy, only what’s necessary left open.
- Attack surface reduction: remove unnecessary services, review crons and users.
- fail2ban or equivalent for automatic brute-force blocking (SSH, HTTP, specific services).
- HTTP security headers, properly configured TLS and automatic certificate renewal.
- Security updates for the operating system, kernel and stack packages.
Web application protection
- Protection of sensitive endpoints: wp-login, xmlrpc, admin panels, APIs.
- Bot and scraper filtering at web server level before requests reach your app.
- Server-level WAF (ModSecurity) or perimeter WAF (Cloudflare) depending on the case.
- Correct file and directory permissions in the docroot.
Ongoing security
- Periodic system security update management.
- Log review and anomaly alerts.
- Re-audit after significant infrastructure changes.