Chapter 29 • Guide 30 of 31
Security and recovery checklist
- Enable MFA on every administrator account and store recovery codes offline.
- Use unique passwords of at least 12 characters; prefer SSH keys for SFTP and SSH.
- Give operators only the websites and feature sections they require.
- Keep Core Panel, PHP branches, and the operating system updated.
- Use managed SSL and force HTTPS after certificate activation.
- Restrict database remote access and firewall sources to known IPs.
- Configure panel-wide recovery to an independent S3-compatible target.
- Store PANEL_RECOVERY_KEY separately from the server and restrict access to the escrow copy.
- Confirm that the newest panel-wide bundle has passed its own clean restore drill; an unvalidated bundle is not a valid recovery backup.
- Continue downloading or exporting website and encrypted mail backups when workload-level recovery is required.
- Review System Settings > Production readiness and resolve every Missing or Partial control before treating the panel as production-ready.
- Review audit, Nginx, website, mail, and malware-scan results regularly.
- Never paste secrets into feedback, logs, cron commands, or screenshots.
- Use the root terminal only for commands you understand and have reviewed.
- Run panel-wide CLI inventory commands only as root; never expose /etc/hostpanel/control-plane.env or grant ordinary users access to the hostpanel group.
Continue this workflow