What I changed
- Introduced GoAccess to visualise web traffic.
- Connected the VPS logs to Wazuh.
- Created custom rules for suspicious requests.
- Improved Nginx protections for sensitive paths.
- Tested how the server responded to common probes.
What I learned
- Logs are useful only when you understand what they're showing.
- A security alert needs investigation, not just a scary description.
- Security is an ongoing process rather than a one-time setting.
The takeaway
← Back to the build diary
CyberCumbria became more than a website. It became another practical cybersecurity lab.