Security as layers, not as a wall
Anything exposed to the open internet is scanned around the clock — that is not a threat scenario, it is the normal state. The answer is not a single wall but a chain of independent controls: filter before computing, check before rolling out, and look regularly for what was missed. This page describes the principles on purpose — the configuration stays inside.
Hardening guide
16 steps, ordered by D3FEND, each with a self-check question. For your own website or homelab.
Open →D3FEND explained
What the MITRE catalogue is, how it is structured, and how to use it to measure your own defences.
Open →D3FEND cube
272 techniques as a 3D city. Explore the example or rate your own setup in a few minutes.
Open →Several independent layers
Every request passes edge filtering, transport encryption, the reverse proxy and the login gate in turn. None of those layers has to be perfect — they only have to fail independently, so a flaw in one does not carry the next one with it.
Filter before computing
At the very front sit a rate limit and a reputation filter that turns away known scanner and attacker addresses before an application ever sees them. It was introduced first where a false positive costs nothing — and deliberately not where it could cut off the path to fixing it.
Strict rules in the browser
The browser is told what it may load at all: nothing from foreign servers, no embedded scripts. Fonts are therefore self-hosted on the same server — and as a side effect, opening this page discloses no IP address to a third party.
Checked before it ships
Every change runs through a pipeline that scans configuration and container images for known weaknesses automatically. The same inventory is scanned again while running — otherwise a weakness that only becomes known after the rollout would stay invisible.
Secrets do not belong in Git
Credentials live in the self-hosted password vault and are distributed from there into file-based secrets, instead of sitting as environment variables inside every container. Version control never holds a password, only the pointer to one.
Measured, not guessed
The defensive posture is reviewed regularly against an established catalogue of defensive measures. What is missing becomes a tracked task — including the uncomfortable part of making blind spots visible in the first place.