How secure are the preconfigured Droplets (e.g. Ghost installation)?

Posted October 31, 2014 3.1k views

I’m planning on spinning up a Ghost blog ( just for fun.

I don’t really have the time to do a manual installation (unfortunately), so I’m planning on going with one of the preconfigured Ghost droplets.

How secure are these installations (have they been hardened, should I expect my blog to be readily hacked,…)?


These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
2 answers

You should put additional security measures in place from the ground up.
For instance you could explore:

Setting up SSH keys and spinning up your droplets with them.

Setting up UFW on your droplet is an easy way to configure IP Tables.

You could configure port knocking for some obscurity of your ssh access but setting up ssh keys is usually good enough.

PS: Already It’s been said that Ghost is more secure than other popular blogging platforms.

by Shaun Lewis
Learn how to setup a firewall with UFW on an Ubuntu / Debian cloud server.

I just did this recently and one thing definitely stood out to me when I was following the tutorial for using Ghost with Digital Ocean.

Once it’s set up you barely have to do any configuration; if I remember correctly the only thing I had to do was set up my server name. However, the problem is that the droplets don’t have HTTPS support by default, since they can’t set it up for you, so you should probably get an SSL certificate and enable HTTPS so that the admin login page won’t be done through HTTP.