Punto SynoPower Club:<\/strong> I worked on the support side of Synology for years, and the compromised machines I saw were almost never beaten by something clever. They had the default admin account still enabled, a management port forwarded to the internet, and no second factor. Good NAS security is mostly boring work done in the right order. What surprised me after we started hosting our own store is how much of the job moves outside the NAS. Most of the traffic we refuse today is turned away before it ever touches our line.<\/p>\n<\/blockquote>\n\n\n\n A private NAS has one job in a security sense: keep strangers out of the login page. A NAS that hosts a public website has the opposite problem. Strangers are the customers, and thousands of them must get in every day without an account. The question changes from who may connect to what a connection is allowed to ask for.<\/p>\n\n\n\n That is why we stopped thinking about NAS security as a product feature and started drawing it as a path. A request for our shop passes five points, and each one can refuse it:<\/p>\n\n\n\n No single layer is trusted to be right. Each one is there for the day the layer in front of it is wrong, misconfigured, or simply bypassed.<\/p>\n\n\n\n Good NAS security starts somewhere that is not the NAS. The cheapest request to defend against is the one that never arrives. In the 24 hours before we wrote this, Cloudflare handled 78,690 requests for our domain. It answered 57,620 of them from its cache, stopped 5,590 as unwanted, and sent only 15,470 on to our origin. Four out of five requests never used a single CPU cycle on the NAS.<\/p>\n\n\n\n We are on the Pro plan and run 15 custom firewall rules plus two rate limits. Every one of them exists because of a specific bad day. Three examples show the pattern:<\/p>\n\n\n\n Cloudflare Turnstile covers the forms the firewall cannot judge: registration, password reset, comments and the contact form. The account that controls all of this, and the one at our domain registrar, both require a second factor. An attacker who can change your DNS does not need to break your NAS.<\/p>\n\n\n\n Whatever Cloudflare lets through arrives at a Synology router running SRM, the second NAS security layer. This is the layer that was in the original note for this article: Threat Prevention blocks another wave<\/em>. It is an intrusion prevention system that compares packets with known attack signatures, and ours is set to drop high-severity matches automatically instead of merely logging them.<\/p>\n\n\n\n On 2 August 2026 one address fired 116 attempts at a PHP flaw that only affects Windows servers. It could never have worked against us, and that is the point of the story: Threat Prevention dropped every attempt, and when we searched the web server logs afterwards the address was not there at all. The attack ended at the router.<\/p>\n\n\n\n Three plainer settings on the same box do as much for NAS security as the inspection engine does:<\/p>\n\n\n\n The front NAS is the first Synology system an outside packet can reach, so this is where classic NAS security advice applies in full. Our settings are deliberately unoriginal:<\/p>\n\n\n\n Two habits matter to NAS security as much as the switches. We reach DSM from outside through QuickConnect or not at all, which is why no management port needs to be open. And temporary helpers get temporary accounts: when a contractor or an AI agent needs administrator access, we create a named account, let the work finish, and disable it the same day.<\/p>\n\n\n\n WordPress does not run on the front NAS. It runs in a container inside a Virtual DSM, a complete second copy of DSM hosted by Virtual Machine Manager. Mail, the reverse proxy and the shop therefore live in separate systems with separate accounts and separate storage.<\/p>\n\n\n\n Isolation is the part of NAS security that does not try to prevent a break-in. It limits what a break-in is worth. If a WordPress plugin is ever compromised, the attacker lands in a container with a memory limit, inside a virtual machine that holds no mailboxes and no backups. And because the whole machine is a single file to Virtual Machine Manager, a snapshot before every risky change takes seconds and rolling back takes a few minutes.<\/p>\n\n\n\n Virtual Machine Manager includes one Virtual DSM instance free of charge on supported models, which is enough to try this layout. Further instances need a license each.<\/p>\n\n\n\nWhat NAS Security Means Once the NAS Hosts a Website<\/h2>\n\n\n\n
\n
Layer 1: Cloudflare Refuses Most Attacks Before They Reach Us<\/h2>\n\n\n\n
![\"Cloudflare](\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/cloudflare-security-analytics-mitigated-requests-scaled.webp\")
\n
Layer 2: Threat Prevention on the Synology Router<\/h2>\n\n\n\n
![\"Synology](\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-router-threat-prevention-map.webp\")
\n
Layer 3: NAS Security Inside DSM, From 2FA to Auto Block<\/h2>\n\n\n\n
\n
admin<\/code> e guest<\/code> are switched off. Every automated login attack starts with those two names.<\/li>\n\n\n\n![\"DSM](\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/dsm-enforce-2fa-administrators-adaptive-mfa.webp\")
Layer 4: A Virtual DSM That Contains the Damage<\/h2>\n\n\n\n