I’ve run the testssl.sh script against an out of the box Sympl install and it comes out pretty well, with a score of A (90) before enabling HSTS. However, one thing that is flagged as negative is the lack of a server cipher order. Is this something to be concerned about? It’s not flagged up on the VM I’ve moved away from, which is a bespoke LEMP stack that I configured myself.
Full results here: https://www.roguetory.org.uk/testssl.html
- Sympl Version [9.0/10.0]: 10.0
- Sympl Testing Version? [Yes/No] No
- Debian Version [Buster/Stretch]: Buster
- Hardware Type? [Dedicated/Virtual/Pi] Virtual
- Hosted On? [name of hosting co] Mythic Beasts