# wazuh-security-hardening
Companion files for the lesson **Hardening Wazuh Itself: Certificates, Exposure, Access**.
Lesson:
Tested against: Wazuh 5.0 (beta5 documentation, September 2026). Wazuh 5.0 is still in beta, so
re-verify every default at general availability.
## Files
| File | What it is |
| --- | --- |
| `hardening-checklist.md` | A seven-section hardening checklist with a sign-off table |
## How to use it
Copy `hardening-checklist.md` into your change record and work it top to bottom. The sections are
ordered so that nothing later depends on something earlier being skipped: credentials before
exposure, exposure before certificates, certificates before the agent-facing settings that use
them.
Two conventions in the file:
- `[n/a]` requires a written reason. An unexplained skip reads as an oversight in six months.
- Items marked **UNVERIFIED** are things the 5.0 beta documentation does not state. Certificate
rotation and document-level security are the two that matter most. Do not treat them as settled.
## Scope
The checklist covers the Wazuh platform: the indexer, the manager, the dashboard and the
agent-facing surface. It does not cover host hardening of the servers Wazuh runs on, network
segmentation design, or the detection content itself.
It is a baseline, not an assessment. Working through it produces a deployment without the obvious
findings; it does not substitute for testing the deployment.
## Sources
Every item is drawn from the Wazuh 5.0-beta documentation:
- Indexer security, default internal users and roles:
- Password management tool and its options:
- Agent HTTPS listener and legacy listener defaults:
- Enrolment service, password handling and TLS options:
- Cluster port and shared key:
- Manager API authentication and token lifetime:
- Certificate generation and deployment:
- Manager identity verification for agents:
- Anti-tampering:
- Notifications module settings, including the host deny list: