diff --git a/combined-report.txt b/combined-report.txt
index 8d1fe4d..fab06d1 100644
--- a/combined-report.txt
+++ b/combined-report.txt
@@ -35169,3 +35169,7 @@ autorecon-results/traefik.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_traefik.lan.d
 autorecon-results/traefik.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_traefik.lan.ddnsgeek.com_vhosts_subdomains-top1million-110000.txt:100985:anonymous2
 autorecon-results/traefik.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_traefik.lan.ddnsgeek.com_vhosts_subdomains-top1million-110000.txt:113208:uninvitedguest
 
+
+
+[Hardening Plan]
+See reverse-proxy-hardening-plan.md for remediation/validation checklist and accepted-risk tracking.
diff --git a/reverse-proxy-hardening-plan.md b/reverse-proxy-hardening-plan.md
new file mode 100644
index 0000000..0eee647
--- /dev/null
+++ b/reverse-proxy-hardening-plan.md
@@ -0,0 +1,54 @@
+# Reverse Proxy Fingerprint Hardening Plan
+
+Date: 2026-04-07
+Scope: Public FQDNs listed in `results/targets.txt`.
+
+## Required hardening actions
+
+1. Disable server tokens/version banners on nginx/Apache/other reverse proxies.
+2. Remove or minimize `X-Powered-By` and framework-identifying headers.
+3. Standardize generic error pages for unauthenticated endpoints; remove app-specific stack hints.
+4. Validate with:
+   - `whatweb`
+   - `nmap --script http-headers`
+5. Track unavoidable disclosures (for example, app title in HTML) as accepted risk.
+
+## Validation targets
+
+- auth.lan.ddnsgeek.com
+- edge.lan.ddnsgeek.com
+- familytree.lan.ddnsgeek.com
+- gitea.lan.ddnsgeek.com
+- gotify.lan.ddnsgeek.com
+- grafana.lan.ddnsgeek.com
+- influxdb.lan.ddnsgeek.com
+- kuma.lan.ddnsgeek.com
+- monitor-kuma.lan.ddnsgeek.com
+- nextcloud.lan.ddnsgeek.com
+- node-red.lan.ddnsgeek.com
+- passbolt.lan.ddnsgeek.com
+- portainer.lan.ddnsgeek.com
+- prometheus.lan.ddnsgeek.com
+- searxng.lan.ddnsgeek.com
+- shifts.lan.ddnsgeek.com
+- stockfill.lan.ddnsgeek.com
+- traefik.lan.ddnsgeek.com
+
+## Command set to run per host
+
+```bash
+whatweb https://<fqdn>
+whatweb http://<fqdn>
+nmap -Pn -p 80,443 --script http-headers <fqdn>
+```
+
+## Environment note (this run)
+
+`whatweb` and `nmap` are not installed in the current execution environment, so live validation was not completed in this run.
+
+## Accepted-risk register template
+
+| FQDN | Unavoidable disclosure | Justification | Owner | Review date |
+|---|---|---|---|---|
+| <fqdn> | App title / product branding | Required for user navigation and SSO trust context | Security + App owner | 2026-07-07 |
+