# Security center

> A server's security score, the baseline checklist, and each site's SSL grade, WAF and blocking rules in one place.

Open a server and choose **Security**.

## Security score

A score from 0 to 100, with every item that lowers it listed next to it:

| Item | Points |
| --- | --- |
| A failed baseline check | 15 (high), 7 (medium) or 3 (low) |
| Security updates waiting | 15 |
| A reboot required to finish updates | 5 |
| Sites without HTTPS | 5 each, up to 20 |
| Sites with an SSL grade of C, T or F | 10 each, up to 20 |
| No site uses the WAF | 5 |

The score appears once the security baseline has run: choose **Run security checks**. Fix what the list names, then run it again.

## Checklist

The baseline is a CIS-lite check of the server: root and password SSH login, empty passwords, X11 forwarding and login attempts, the firewall's default deny, automatic security updates, kernel hardening, extra UID 0 accounts, accounts with empty passwords, CrowdSec and time synchronisation. Each line shows whether it passes. Servers connected through Zefily are set up this way; a failing line usually means something was changed by hand.

## Sites and SSL grade

For each site the table shows HTTPS, its **SSL grade**, the WAF mode and its blocking rules. **Check SSL** connects to the site the way a browser does and grades it:

| Grade | Meaning |
| --- | --- |
| A+ | TLS 1.2 and 1.3 only, a valid certificate and HSTS for at least six months |
| A | The same without long HSTS |
| B | TLS 1.3 is not offered |
| C | TLS 1.0 or 1.1 is still accepted, or an RSA key shorter than 2048 bits |
| T | The certificate chain is not trusted (self-signed, missing intermediate) |
| F | No HTTPS answer, an expired certificate or one that does not cover the name |

Sites on Zefily's nginx get A+ with a Let's Encrypt certificate. Behind Cloudflare's proxy the check sees Cloudflare's edge: raise **Minimum TLS** to 1.2 on the site's [DNS](/docs/dns) pane. The check also notes which security headers the site sends; add missing ones with the header presets on the site's **Rules** pane. Results are kept for seven days.

## Blocking

Each site's **Rules** pane can block AI crawlers, addresses and countries; the **Access** pane sets the WAF. See [Access and caching](/docs/access-and-caching). For attacks on a site behind Cloudflare, use **I'm under attack mode** on its DNS pane.

---
Source: https://zefily.com/docs/security-center