# Reverse Proxy Fingerprint Hardening Plan

Date: 2026-04-07
Scope: Public FQDNs listed in `results/targets.txt`.

## Required hardening actions

1. Disable server tokens/version banners on nginx/Apache/other reverse proxies.
2. Remove or minimize `X-Powered-By` and framework-identifying headers.
3. Standardize generic error pages for unauthenticated endpoints; remove app-specific stack hints.
4. Validate with:
   - `whatweb`
   - `nmap --script http-headers`
5. Track unavoidable disclosures (for example, app title in HTML) as accepted risk.

## Validation targets

- auth.lan.ddnsgeek.com
- edge.lan.ddnsgeek.com
- familytree.lan.ddnsgeek.com
- gitea.lan.ddnsgeek.com
- gotify.lan.ddnsgeek.com
- grafana.lan.ddnsgeek.com
- influxdb.lan.ddnsgeek.com
- kuma.lan.ddnsgeek.com
- monitor-kuma.lan.ddnsgeek.com
- nextcloud.lan.ddnsgeek.com
- node-red.lan.ddnsgeek.com
- passbolt.lan.ddnsgeek.com
- portainer.lan.ddnsgeek.com
- prometheus.lan.ddnsgeek.com
- searxng.lan.ddnsgeek.com
- shifts.lan.ddnsgeek.com
- stockfill.lan.ddnsgeek.com
- traefik.lan.ddnsgeek.com

## Command set to run per host

```bash
whatweb https://<fqdn>
whatweb http://<fqdn>
nmap -Pn -p 80,443 --script http-headers <fqdn>
```

## Environment note (this run)

`whatweb` and `nmap` are not installed in the current execution environment, so live validation was not completed in this run.

## Accepted-risk register template

| FQDN | Unavoidable disclosure | Justification | Owner | Review date |
|---|---|---|---|---|
| <fqdn> | App title / product branding | Required for user navigation and SSO trust context | Security + App owner | 2026-07-07 |