Security hub
Protect your server with defensive practices
General recommendations for admins. They reduce risk, but no practice or review guarantees absolute security.
Scope: self-managed servers.
Security basics
What to protect first and how to prioritise with little time.
Backups & recovery
Scheduled, off-server backups and tested restores.
Permission management
Groups, inheritance and least privilege.
Secure configuration
Ports, RCON, web panels and defaults.
Updating plugins & dependencies
Changelog, staging and update order.
Credentials & secrets
Out of code, rotation and restricted access.
Logs & diagnostics
What to log, how long to keep it and how to read it.
Performance & stability
Measure before optimising.
Third-party resources: good practice
- Download only from the original source shown on the sheet.
- Check the licence and whether it allows redistribution or commercial use.
- Review the code, especially obfuscated files or network calls.
- Test on a server copy before production.
- Record the installed version and its hash if the author publishes one.
How to read review statuses
Editorial review
The editorial team checked provenance, licence and links. It does not include code or malware analysis.
Pending review
Published with author information; editorial review is in progress.
Not reviewed
Information comes only from the author and has not been checked.
No status means "safe"Use statuses as context, not as a guarantee.