Servers
Security center
A server's security score, the baseline checklist, and each site's SSL grade, WAF and blocking rules in one place.
Open a server and choose Security.
Security score
A score from 0 to 100, with every item that lowers it listed next to it:
| Item | Points |
|---|---|
| A failed baseline check | 15 (high), 7 (medium) or 3 (low) |
| Security updates waiting | 15 |
| A reboot required to finish updates | 5 |
| Sites without HTTPS | 5 each, up to 20 |
| Sites with an SSL grade of C, T or F | 10 each, up to 20 |
| No site uses the WAF | 5 |
The score appears once the security baseline has run: choose Run security checks. Fix what the list names, then run it again.
Checklist
The baseline is a CIS-lite check of the server: root and password SSH login, empty passwords, X11 forwarding and login attempts, the firewall's default deny, automatic security updates, kernel hardening, extra UID 0 accounts, accounts with empty passwords, CrowdSec and time synchronisation. Each line shows whether it passes. Servers connected through Zefily are set up this way; a failing line usually means something was changed by hand.
Sites and SSL grade
For each site the table shows HTTPS, its SSL grade, the WAF mode and its blocking rules. Check SSL connects to the site the way a browser does and grades it:
| Grade | Meaning |
|---|---|
| A+ | TLS 1.2 and 1.3 only, a valid certificate and HSTS for at least six months |
| A | The same without long HSTS |
| B | TLS 1.3 is not offered |
| C | TLS 1.0 or 1.1 is still accepted, or an RSA key shorter than 2048 bits |
| T | The certificate chain is not trusted (self-signed, missing intermediate) |
| F | No HTTPS answer, an expired certificate or one that does not cover the name |
Sites on Zefily's nginx get A+ with a Let's Encrypt certificate. Behind Cloudflare's proxy the check sees Cloudflare's edge: raise Minimum TLS to 1.2 on the site's DNS pane. The check also notes which security headers the site sends; add missing ones with the header presets on the site's Rules pane. Results are kept for seven days.
Blocking
Each site's Rules pane can block AI crawlers, addresses and countries; the Access pane sets the WAF. See Access and caching. For attacks on a site behind Cloudflare, use I'm under attack mode on its DNS pane.
Updated October 22, 2026 View as Markdown llms.txt