Hardening your server

A fresh VPS ships wide open — root password login, no firewall, no auto-updates, no intrusion blocking. Securing it by hand means editing sshd_config, learning nftables, and hoping you don't lock yourself out. HostSSH turns all of that into one button — with a safety net so you can't get stranded.

Coolify deploys your apps. HostSSH runs your server — and a server you run should be a server you've secured. Hardening is built in, not an afterthought.

Secure my server (one click)

1. Open your server in the dashboard (or the on-box panel).
2. Click Secure my server. HostSSH applies a sensible baseline: SSH locked down, a default-deny firewall, automatic security updates, kernel hardening, and brute-force protection.
3. Watch the Security Score climb as each control turns green.

That's it. No config files, no commands.

You can't lock yourself out

This is the part that makes one-click hardening safe to actually use. Every change that could affect your access is protected:

• Validated before it's applied — a bad SSH or firewall change is rejected before it can take effect.
• Snapshotted first — the previous state is saved so any control can be reverted with one click.
• Armed auto-revert — when HostSSH changes anything network- or login-related, it starts a timer. If it can't confirm you're still reachable within a few minutes, it automatically rolls the change back.
• Your channel stays open — the agent never cuts the connection it would need to undo a change.
• Password login is only disabled once a working key/certificate is confirmed present.

So the worst case isn't "locked out" — it's "the change reverted itself and you try again."

Granular control (advanced)

Prefer to tune it yourself? Switch to Customize for a per-control grid:

Control	What it does
SSH	Disable root password login, disable password auth, tighten ciphers and login limits
Firewall	Default-deny inbound; only the ports you grant are open
Automatic updates	Apply security updates without manual patching
Kernel hardening	Safer network + memory sysctl defaults
Intrusion blocking	Block brute-force and scanners automatically
Users & sudo	Audit sudo access, lock unused accounts, keep auth logs

Toggle any control on or off, choose a stronger profile (Strict or CIS Level 1), and apply — the same can't-lock-you-out protections apply to every change.

What HostSSH hardens automatically (defaults)

Some protections are on from the moment the Agent runs — you don't have to click anything:

• Every app container is hardened by default. Containers launch with --security-opt no-new-privileges, a dropped capability set, and (where safe) a read-only root — so a compromised app can't escalate via setuid or gain privileges it wasn't given. (Guard G15.)
• Dual-engine host firewall. hostssh firewall up applies a default-deny inbound policy using whichever engine the box has — nftables or ufw — so hardening never depends on a specific package being installed. SSH is rate-limited per source IP (v4 and v6) rather than globally, so one attacker's brute-force can't lock out legitimate logins. (Guards G16, G18.)
• Auth brute-force protection. The control-plane sign-in and TOTP verification are rate-limited and replay-protected, so password and one-time-code guessing is bounded. (Guard G17.)
• Hardening survives a rebuild. Your firewall and security settings are re-applied automatically on boot, so a reboot or a rebuilt box comes back hardened — not reset to wide-open. (Guard G19.)

These are the fix-forward "build guards" G15–G19 made real. Developers can read the full catalog in docs/dev/build-guards.md.

Panel-configurable, not hardcoded

Every control above is configurable from the dashboard, not baked in. Choose a profile (baseline / Strict / CIS Level 1), toggle individual controls, set which ports the firewall allows, and apply — the settings are stored and re-applied on boot, so what you configure is what the box enforces after every restart.

Security Score & drift

Your score is a live 0–100 read of how hardened the box is. If something later drifts — a package update resets a setting, or someone hand-edits a config — HostSSH flags it so you can re-harden in one click. The same score appears on the box and in the cloud dashboard, so a fleet of servers shows its weakest link at a glance.

What's next

Hardening pairs with Web-SSH & access — keyless, recorded, audited root access — so the box is both locked down and easy to get into when you need to. See Getting started to install the agent, and Licensing for which tier includes which controls.