Security

Harden a FeatherPanel install. Protect the encryption key, set proxy trust, add captchas and IP blocks, review telemetry, lock down nodes and report vulnerabilities.

This page collects the settings that matter for a public FeatherPanel install. Most of them are one switch in the admin area. Read Backups alongside it: a secure panel you cannot restore is still a problem.

Protect the encryption key

The panel encrypts secrets in the database with DATABASE_ENCRYPTION_KEY. On Docker installs it lives in the featherpanel_config volume; on source installs it is in backend/storage/config/.env.

• Keep a copy with your database dumps and another copy off the server.
• Never paste it into a support ticket or a log upload.
• Restoring a database without the matching key leaves encrypted columns unreadable.

Change default passwords

The shipped docker-compose.yml falls back to fixed MariaDB passwords (featherpanel_root and featherpanel_password) when the variables are unset, and the installer does not generate new ones. The database and Redis are not published to the host, so these passwords are only reachable from the Docker network, but you should still replace them on a new install: set MARIADB_ROOT_PASSWORD and MARIADB_PASSWORD in /var/www/featherpanel/.env before the first start. MariaDB only reads them when it creates an empty volume, and the health check hardcodes the root password, so read the notes in Docker install first.

Put the panel behind HTTPS

Serve the panel only through a reverse proxy with TLS. See Web server and SSL. The frontend container publishes port 4831 on all host interfaces, so block it in your firewall and let only the proxy reach it:

ufw deny 4831/tcp

Docker writes its own iptables rules, and published ports can bypass ufw. Check from another machine that http://your-server:4831 does not answer.

Client IPs and proxy trust

Rate limits, IP blocks and audit entries depend on the real client IP. The backend reads X-Forwarded-For and the Cloudflare headers only when the direct peer is a loopback or private address, which covers a proxy on the same host or in the Docker network. If your proxy runs on another public host, set TRUST_PROXY_HEADERS=true. Do not set it when clients can reach the backend directly, because they could then spoof their address.

Sign-up and login protection

In Admin → Settings:

• Turn off registration_enabled if only you create accounts, or require e-mail verification with registration_require_email_verification.
• Limit accounts per device with registration_device_limit_enabled and registration_device_max_accounts.
• Add a captcha: Cloudflare Turnstile, hCaptcha, reCAPTCHA or Friendly Captcha (captcha_provider).
• Enable AbuseIPDB checks on registration (abuseipdb_enabled, abuseipdb_check_on_register) with a minimum confidence score and an action.

The admin area also has pages for blocked IPs, blocked e-mail domains, rate limits and the audit log. Ask users to turn on two-factor authentication or passkeys from their account page.

Roles and API keys

Give staff a role with only the permissions they need instead of the root role. The full list of permission nodes is in the permissions reference. Create API keys per tool so you can revoke one without breaking others, and delete keys you no longer use.

Nodes

• Open only the ports FeatherWings needs: 8080 for the panel connection and 2022 for SFTP, plus server allocations. See Wings installation.
• Run Wings behind TLS when the panel uses HTTPS, or browsers block the console websocket.
• FeatherZeroTrust in the admin area scans server files on a schedule for known malicious hashes.

Telemetry

The telemetry setting defaults to on. It sends daily aggregate counts (resource totals, backup outcomes, feature usage over the last 30 days) to Umami. No installation identifiers or individual activity records are sent, and the collector sees the server’s IP. Turn it off under Admin → Settings → Telemetry.

Updates

Security fixes ship in normal releases. Keep the panel, FeatherWings and FeatherQuilld current. See Updating the panel and Updating Wings.

Reporting a vulnerability

Do not open a public GitHub issue for a security problem. Contact the team privately on the MythicalSystems Discord and include steps to reproduce, the affected version and the impact. Give the maintainers time to release a fix before you publish anything.