Browse all patterns

Domain & server security checklist

Extension of the ⁠⁠Information security checklist for the InfoSec lead ⁠ focused on domain infrastructure, email authentication, and website security. Run these checks periodically, many can be automated.
N.B. Moral Fabric can automate the steps below for you using Claude.

8. Email Domain Security 📧 

SPF

An SPF (Sender Policy Framework) record exists for the domain required Specifies which mail servers are authorised to send email on behalf of your domain.
The SPF record does not use overly permissive qualifiers required Avoid +all or ?all — these allow any server to send on your behalf. Use -all (hard fail) or ~all (soft fail).

DKIM

DKIM signing is enabled for all outgoing mail required Adds a cryptographic signature to outgoing email so receiving servers can verify it hasn't been tampered with.
DKIM keys are at least 2048-bit required 1024-bit keys are considered weak and should be rotated.

DMARC

A DMARC record exists for the domain required Tells receiving servers what to do with email that fails SPF or DKIM checks.
DMARC policy is set to quarantine or reject required p=none only monitors — it provides no protection against spoofing.
A DMARC reporting address (rua=) is configured recommended Without this, you have no visibility into spoofing attempts or delivery issues.

9. DNS Infrastructure Security 🏗️ 

DNSSEC

Verify with: internet.nl/site (+ for troubleshooting: dnsviz.net/d/[domain]/dnssec/ )Solution: ⁠⁠How to: Enable DNSSEC⁠
DNSSEC is enabled on the domain's DNS zone recommended Adds cryptographic signatures to DNS records, preventing DNS hijacking/spoofing.
The DS record is present at the registrar recommended The chain of trust is only complete if the DS record is published at the registrar — not just the DNS hosting provider.

MTA-STS

An MTA-STS policy is published recommended Ensure other mail servers can verify your TLS requirements by publishing a policy file at https://mta-sts.[yourdomain]/.well-known/mta-sts.txt with mode: enforce.

TLS-RPT

TLS-RPT is configured alongside MTA-STS recommended The _smtp._tls DNS record enables reporting on email delivery failures.

10. Website & CMS Security 🌐 

General

The website runs entirely over HTTPS required No mixed content. SSL/TLS certificate is valid and not expired — automate renewal where possible (e.g. Let's Encrypt).
HSTS is enabled required Prevents browsers from loading the site over plain HTTP.
Security headers are configured recommended At minimum: X-Frame-Options , X-Content-Type-Options , Content-Security-Policy .

WordPress-specific

WordPress core, plugins, and active theme are up to date required Most WP compromises exploit known vulnerabilities in outdated plugins.
No unused plugins or themes are installed required Inactive plugins are still an attack surface.
The default admin username is not in use required It's the first username attackers try.
wp-login.php is protected recommended Apply rate limiting, 2FA, or relocate the login URL to reduce brute-force exposure.
XML-RPC is disabled if not needed recommended /xmlrpc.php is a frequent target for brute-force and DDoS amplification attacks.
WPScan is run periodically to detect known vulnerabilities recommendedWPScan detects issues that haven't yet been patched or flagged by WordPress itself.