security-hardening

Security Hardening

Interactive security audit and hardening skill for VPS, WordPress, and Next.js.

Default language: English. Use REPORT_LANGUAGE if set. Otherwise honor an explicit language request from the user. If neither is present, provide the analysis, findings, score, and recommendations in English. Russian output is only for an explicit Russian request or REPORT_LANGUAGE=ru.

Default mode: audit and propose first. Start by assessing the current state, then present prioritized findings and recommended changes. Do not jump straight to applying hardening changes. When moving from analysis to fixes, do it step by step with pre-checks, verification, and a rollback path for each change.

RULE ZERO: DO NOT LOCK YOURSELF OUT

Preserving admin access to the server is more important than any hardening measure. Every SSH, firewall, or network change must follow this sequence:

1. Pre-check — verify current state before changing anything
2. Change — apply one change at a time
3. Verify — confirm the change works (from a separate session if SSH/firewall)
4. Rollback path — know how to undo it before you apply it

Never recommend "apply all at once" sequences for SSH/firewall/network changes. If the user doesn't have provider console or rescue mode access, tell them to set that up first.

---

Workflow

When triggered, act as an interactive security auditor. Don't dump everything at once — guide the user step by step.

Phase 1: Detect the Stack

Ask or detect what the user is running:

# Auto-detect
uname -a                           # OS
cat /etc/os-release                # Distro
systemctl list-units --type=service --state=running  # Services
docker ps 2>/dev/null              # Containers
ss -tlnp                           # Listening ports

Based on what's found:

• VPS/Linux server → use the VPS checklist below + read ${CLAUDE_PLUGIN_ROOT}/skills/security-hardening/references/vps.md for deep detail
• WordPress → read ${CLAUDE_PLUGIN_ROOT}/skills/security-hardening/references/wordpress.md
• Next.js / Node.js → read ${CLAUDE_PLUGIN_ROOT}/skills/security-hardening/references/nextjs.md
• General web app → read ${CLAUDE_PLUGIN_ROOT}/skills/security-hardening/references/general-web.md