Self-hosted security checklist

HTTPS, backups, updates, and the installer lock.

After install

/install returns 404 once the lock file exists. Do not delete that lock on a live instance. Keep the generated admin path private.

Operations

  • Terminate TLS at the reverse proxy; do not expose the app on plain HTTP in production. HSTS, firewall, and extra security headers are your responsibility — the app does not set them globally.
  • Back up the database and storage/ on a schedule you have tested restoring.
  • Keep PHP 8.3+ and Composer dependencies updated.
  • Run cron so SSL checks, reminders, and mail actually fire.
  • Use SMTP for real mail; the log driver does not send messages.

Still need help?

Write to the team and we'll get back within one business day.

Contact support