Security hardening checklist
A practical checklist of recommended TurboStack security settings: SSH keys, IP allow-lists, 2FA, TurboShield, WAF, TLS, and the Threat Center.
TurboStack is secure by default, but a few deliberate choices make your servers and applications significantly harder to attack. Work through this checklist and tighten each area to match your risk.
Access
- Use Secure Shell (SSH) keys and disable password authentication (SSH). Keys cannot be guessed the way passwords can.
- Restrict access with an Internet Protocol (IP) allow-list (Security).
- Enable two-factor authentication (2FA) on your account, so a stolen password alone is not enough to log in.
- Treat Credentials as secrets. Store and share them carefully.
- Use least-privilege extra database users (readonly where possible) (Applications).
Web protection
- Keep TurboShield enabled, and raise it to
highwhile under attack. - Enable the Web Application Firewall (WAF), which blocks common web attacks such as SQL injection.
- Consider GeoIP filtering (blocking by the visitor's country) for regions you do not serve.
- Understand how the layers fit together (Security overview).
Encryption (TLS)
- Always use Let's Encrypt and redirect all traffic to HTTPS, the encrypted version of HTTP. This keeps data between your visitors and the server private. See Transport Layer Security (TLS) certificates.
Stay current and watch
- Keep your application and runtime versions updated.
- Review the Threat Center for vulnerabilities and malware.
- Act promptly on any findings.
Tip
Start with the defaults. TurboStack is secure by default. Tighten settings based on what the Threat Center reports for your hosts.
Related
- Security configuration
- Security overview
- SSH
- Threat Center
- Two-factor authentication
- TurboStack CLI - manage firewall blocks from the server with
tscli firewall