Last updated: August 30, 2026
This is a static site: no database, no user accounts, and no forms that collect personal information beyond the optional PayPal payment form described below. It's served by a standard web server like any other website, but that server doesn't run any application logic on your data or store anything about you beyond routine access logs. This site does two things with data: it uses Google Analytics to collect aggregated, anonymized traffic statistics, and it uses your browser's own local storage to remember your progress through the guide — kept only on your device, never sent anywhere.
This site does not sell any data, and does not share any data with anyone beyond what's described below.
This site uses Google Analytics (GA4) to understand overall traffic and which parts of the guide are most useful. Google Analytics sets cookies in your browser and may collect information such as your approximate location (derived from IP address), device and browser type, pages visited, and how you arrived at the site. This data is processed by Google in aggregated form; this site never uses it to identify you personally.
You can find more detail on how Google handles this data in Google's Privacy Policy, and you can opt out of Google Analytics tracking across all websites using the Google Analytics Opt-out Browser Add-on. Your browser's own settings also let you block or delete cookies at any time.
| Cookie / storage | Purpose | Duration |
|---|---|---|
_ga, _ga_* | Google Analytics — distinguishes unique visitors | Up to 2 years |
sh_guide_progress_v1 | Local storage (not a cookie) — remembers which guide tips you've viewed, kept only on your device | Until cleared by you |
sh_checklist_v1 | Local storage (not a cookie) — remembers which golden rules you've ticked off, kept only on your device | Until cleared by you |
sh_cookie_notice_ack_v1 | Local storage (not a cookie) — remembers that you've dismissed the cookie notice | Until cleared by you |
This site uses your browser's own localStorage to remember your progress as you go — which guide tips you've viewed, which golden rules you've ticked off, and that you've dismissed the cookie notice. This works the same way across every tip and checklist on the site, not just the golden rules. None of this data is saved on any server or transmitted anywhere; it only ever lives on your own device. You can erase it at any time by clearing your browser's site data for this domain.
The guide links out to Synology's official documentation and to Buy Me a Coffee for optional voluntary support — these are plain links, and nothing loads from those sites unless you click through. This page also loads two small icon images directly from PayPal's image server (paypalobjects.com) to display the payment button, which involves your browser making a request to PayPal's servers whenever this page loads.
The PayPal donation button itself is a plain form: clicking it submits you to a PayPal-hosted checkout page (paypal.com) in a new tab to complete an optional payment. No PayPal script runs in your browser and no PayPal cookies are set unless and until you click the button and are taken to PayPal's own site. This site does not receive your payment card or PayPal account details — those are handled entirely by PayPal. See PayPal's Privacy Statement for details on how PayPal itself handles this data.
The recommendations in this guide reflect one reasonable approach to hardening a Synology NAS, not an official, exhaustive, or universally "correct" standard. What counts as a good setting can depend on your specific device, network, threat model, and how you use your NAS — a setting that makes sense for one person's setup may not be ideal for another's. This site makes no warranty, express or implied, that following these recommendations will make your system secure, and accepts no liability for any loss, damage, data breach, or other harm arising from using or relying on this guide.
There is no such thing as 100% security. Even a system configured according to every recommendation here can still be vulnerable to new exploits, misconfiguration, human error, physical access, or attacks not covered by this guide. Treat this as one input among several: keep an eye on Synology's own security advisories, stay current with independent security research, and consider consulting a qualified professional if you're protecting something particularly sensitive. Backups, tested restore procedures, and the assumption that things can still go wrong are as important as any individual setting.
This site is not directed at children and does not knowingly collect information from children.
This policy may be updated occasionally to reflect changes to the site or the tools it uses. The date at the top of this page reflects the most recent revision.
Questions about this policy can be sent using the contact option on the About section of the main guide.
synologyhardening.com