# Security

> Harden a FeatherPanel install. Protect the encryption key, set proxy trust, add captchas and IP blocks, review telemetry, lock down nodes and report vulnerabilities.

Source: https://featherpanel.com/docs/security/

This page collects the settings that matter for a public FeatherPanel install. Most of them are one switch in the admin
area. Read [Backups](https://featherpanel.com/docs/panel/backups) alongside it: a secure panel you cannot restore is still a problem.

## Protect the encryption key

The panel encrypts secrets in the database with `DATABASE_ENCRYPTION_KEY`. On Docker installs it lives in the
`featherpanel_config` volume; on source installs it is in `backend/storage/config/.env`.

- Keep a copy with your database dumps and another copy off the server.
- Never paste it into a support ticket or a log upload.
- Restoring a database without the matching key leaves encrypted columns unreadable.

## Change default passwords

The shipped `docker-compose.yml` falls back to fixed MariaDB passwords (`featherpanel_root` and
`featherpanel_password`) when the variables are unset, and the installer does not generate new ones. The database and
Redis are not published to the host, so these passwords are only reachable from the Docker network, but you should
still replace them on a new install: set `MARIADB_ROOT_PASSWORD` and `MARIADB_PASSWORD` in
`/var/www/featherpanel/.env` before the first start. MariaDB only reads them when it creates an empty volume, and the
health check hardcodes the root password, so read the notes in [Docker install](https://featherpanel.com/docs/panel/installation/docker) first.

## Put the panel behind HTTPS

Serve the panel only through a reverse proxy with TLS. See [Web server](https://featherpanel.com/docs/panel/web-server) and [SSL](https://featherpanel.com/docs/panel/ssl).
The frontend container publishes port 4831 on all host interfaces, so block it in your firewall and let only the proxy
reach it:

```bash
ufw deny 4831/tcp
```

Docker writes its own iptables rules, and published ports can bypass ufw. Check from another machine that
`http://your-server:4831` does not answer.

## Client IPs and proxy trust

Rate limits, IP blocks and audit entries depend on the real client IP. The backend reads `X-Forwarded-For` and the
Cloudflare headers only when the direct peer is a loopback or private address, which covers a proxy on the same host
or in the Docker network. If your proxy runs on another public host, set `TRUST_PROXY_HEADERS=true`. Do not set it when
clients can reach the backend directly, because they could then spoof their address.

## Sign-up and login protection

In **Admin → Settings**:

- Turn off `registration_enabled` if only you create accounts, or require e-mail verification with
  `registration_require_email_verification`.
- Limit accounts per device with `registration_device_limit_enabled` and `registration_device_max_accounts`.
- Add a captcha: Cloudflare Turnstile, hCaptcha, reCAPTCHA or Friendly Captcha (`captcha_provider`).
- Enable AbuseIPDB checks on registration (`abuseipdb_enabled`, `abuseipdb_check_on_register`) with a minimum
  confidence score and an action.

The admin area also has pages for **blocked IPs**, **blocked e-mail domains**, **rate limits** and the **audit log**.
Ask users to turn on two-factor authentication or passkeys from their [account page](https://featherpanel.com/docs/user/account).

## Roles and API keys

Give staff a role with only the permissions they need instead of the root role. The full list of permission nodes is
in the [permissions reference](https://featherpanel.com/docs/reference/permissions). Create API keys per tool so you can revoke one without
breaking others, and delete keys you no longer use.

## Nodes

- Open only the ports FeatherWings needs: 8080 for the panel connection and 2022 for SFTP, plus server allocations. See
  [Wings installation](https://featherpanel.com/docs/wings/installation).
- Run Wings behind TLS when the panel uses HTTPS, or browsers block the console websocket.
- FeatherZeroTrust in the admin area scans server files on a schedule for known malicious hashes.

## Telemetry

The `telemetry` setting defaults to on. It sends daily aggregate counts (resource totals, backup outcomes, feature
usage over the last 30 days) to Umami. No installation identifiers or individual activity records are sent, and the
collector sees the server's IP. Turn it off under **Admin → Settings → Telemetry**.

## Updates

Security fixes ship in normal releases. Keep the panel, FeatherWings and FeatherQuilld current. See
[Updating the panel](https://featherpanel.com/docs/panel/updating) and [Updating Wings](https://featherpanel.com/docs/wings/updating).

## Reporting a vulnerability

Do not open a public GitHub issue for a security problem. Contact the team privately on the
[MythicalSystems Discord](https://discord.mythical.systems) and include steps to reproduce, the affected version and the
impact. Give the maintainers time to release a fix before you publish anything.

## Frequently asked questions

### What happens if I lose DATABASE_ENCRYPTION_KEY?

Values the panel encrypted with it, such as node tokens and stored secrets, can no longer be read. Keep a copy of the key outside the server together with your database backups.

### Does FeatherPanel send telemetry?

The telemetry setting is on by default. It sends daily aggregate counts to Umami without installation identifiers or individual activity. Turn it off in Admin, Settings, Telemetry.

### How do I report a security issue?

Do not open a public issue. Contact the maintainers privately through the MythicalSystems Discord and give them time to ship a fix before you publish details.