diff --git a/docs/CLOUDPANEL_SETUP.md b/docs/CLOUDPANEL_SETUP.md
index 03057d4..37ac9d1 100644
--- a/docs/CLOUDPANEL_SETUP.md
+++ b/docs/CLOUDPANEL_SETUP.md
@@ -36,6 +36,7 @@ In die vHost-Config der Site aufnehmen:
 
 ```nginx
 location /api/ {
+  limit_req zone=limit burst=20 nodelay;
   proxy_pass http://127.0.0.1:8787/;
   proxy_set_header Host $host;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -43,6 +44,16 @@ location /api/ {
 }
 ```
 
+## Security Header (empfohlen)
+
+```nginx
+add_header X-Frame-Options "SAMEORIGIN" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header Permissions-Policy "geolocation=(self)" always;
+add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'" always;
+```
+
 ## Backend Services
 
 - `staysense-api.service` (API)
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index dd565f8..668db2a 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -21,6 +21,13 @@ sudo journalctl -u staysense-api.service -f
 sudo journalctl -u staysense-import.service -f
 ```
 
+Fail2ban Status:
+
+```bash
+sudo fail2ban-client status
+sudo fail2ban-client status nginx-staysense-limitreq
+```
+
 Health check:
 
 ```bash
@@ -39,3 +46,12 @@ cp /opt/staysense/data/staysense.db /opt/staysense/data/staysense.db.bak
 cp /opt/staysense/data/staysense.db.bak /opt/staysense/data/staysense.db
 sudo systemctl restart staysense-api.service
 ```
+
+## Hardening Snapshot
+
+- API-Rate-Limit aktiv auf `/api/` (`limit_req zone=limit burst=20 nodelay`)
+- Security Header aktiv im vHost (`CSP`, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`)
+- Fail2ban Jail aktiv:
+  - Name: `nginx-staysense-limitreq`
+  - Log: `/home/staysense-site/logs/nginx/error.log`
+  - Ban bei wiederholten Rate-Limit-Verstoessen