autorecon/reverse-proxy-hardening-plan.md

Reverse Proxy Fingerprint Hardening Plan

Date: 2026-04-07 Scope: Public FQDNs listed in results/targets.txt.

Required hardening actions

1. Disable server tokens/version banners on nginx/Apache/other reverse proxies.
2. Remove or minimize X-Powered-By and framework-identifying headers.
3. Standardize generic error pages for unauthenticated endpoints; remove app-specific stack hints.
4. Validate with:
   • whatweb
   • nmap --script http-headers
5. Track unavoidable disclosures (for example, app title in HTML) as accepted risk.

Validation targets

• auth.lan.ddnsgeek.com
• edge.lan.ddnsgeek.com
• familytree.lan.ddnsgeek.com
• gitea.lan.ddnsgeek.com
• gotify.lan.ddnsgeek.com
• grafana.lan.ddnsgeek.com
• influxdb.lan.ddnsgeek.com
• kuma.lan.ddnsgeek.com
• monitor-kuma.lan.ddnsgeek.com
• nextcloud.lan.ddnsgeek.com
• node-red.lan.ddnsgeek.com
• passbolt.lan.ddnsgeek.com
• portainer.lan.ddnsgeek.com
• prometheus.lan.ddnsgeek.com
• searxng.lan.ddnsgeek.com
• shifts.lan.ddnsgeek.com
• stockfill.lan.ddnsgeek.com
• traefik.lan.ddnsgeek.com

Command set to run per host

whatweb https://<fqdn>
whatweb http://<fqdn>
nmap -Pn -p 80,443 --script http-headers <fqdn>

Environment note (this run)

whatweb and nmap are not installed in the current execution environment, so live validation was not completed in this run.

Accepted-risk register template

FQDN	Unavoidable disclosure	Justification	Owner	Review date
	App title / product branding	Required for user navigation and SSO trust context	Security + App owner	2026-07-07