SSL & Security

Yes, a free Let's Encrypt SSL certificate is included with web hosting and renewed automatically. HTTPS is enabled as soon as the site goes live.

Yes. If you need an extended validation or organization validation certificate, you can install it on your hosting. Our support team will assist you.

Automatic redirection from HTTP to HTTPS can be enabled in one click from cPanel, to serve your entire site securely.

Our infrastructure applies account isolation, a firewall and regular updates. On a VPS, the security of your environment remains your responsibility (we can advise you).

Yes, when your domain uses our managed DNS with your site's record proxied: traffic then goes through the Cloudflare network, which absorbs DDoS attacks on a global scale — the same protection as the largest sites on the web, included at no extra cost.

Cloudflare is the network that speeds up and protects nearly 20% of the global web. We connect your domain to it automatically and free of charge: you gain a global CDN (a faster site everywhere), DDoS protection, a resilient anycast DNS and HTTPS — with nothing for you to configure.

Keep WordPress, its themes and plugins up to date, use strong passwords, limit login attempts, enable SSL and make regular backups.

Contact our support team without delay: we will help you restore a clean backup and identify the vulnerability, so that it does not happen again.

Let's Encrypt certificates are valid for 90 days, requiring automated renewal roughly every 60 days. On our hosting plans, renewal is fully automatic — no action needed on your part. The CA/B Forum has adopted a roadmap to progressively shorten this lifetime: first to 100 days, then to 47 days by 2029. More frequent renewals improve security by limiting exposure if a private key is compromised. If you manage a certificate on a server outside our platform, ensure your automation tool (Certbot, acme.sh) is up to date to handle these shorter lifetimes.

ACME clients such as `certbot`, `acme.sh`, or Caddy can renew your SSL certificates automatically without any manual intervention. Most clients install a systemd timer or cron job natively. This automation is increasingly critical: the CA/B Forum plans to reduce maximum certificate validity to 47 days by 2029, making manual renewal structurally unmanageable.

Traefik natively integrates an ACME client compatible with Let's Encrypt. Simply declare a resolver in the `certificatesResolvers` section of the `traefik.yml` file (or as an environment variable), then add the label `traefik.http.routers.<service>.tls.certresolver=<name>` to each Docker container you want to protect. Traefik then handles the HTTP-01 or DNS-01 challenge negotiation, certificate issuance and automatic renewal before expiry. Certificates are stored in a persistent JSON file (`acme.json`) that you must mount in a volume to avoid losing them when the container restarts.

Yes. Open source solutions like Authentik or Authelia, available in the ServOrbit Marketplace, let you centralise authentication across all your applications (Gitea, Nextcloud, Chatwoot…) through a single SSO/OIDC portal. You manage users, permissions and two-factor authentication from one interface, without reconfiguring each application separately. A VPS Power (4 vCPU, 8 GB) is recommended for Authentik; Authelia requires fewer resources.

Yes, ServOrbit shared hosting runs on CloudLinux, which ensures strong isolation between accounts. Each customer operates inside a sandboxed environment called an LVE (Linux Virtual Environment): your files, processes, and CPU/RAM resources are strictly separated from those of other clients on the same server. A misconfigured or compromised neighboring site cannot access your data or disproportionately impact your performance. This architecture provides an additional layer of protection compared to traditional shared hosting without CloudLinux.

Deploy Promtail on each VPS you want to monitor: it collects system logs (auth.log, syslog, journald) and ships them to a centralised Loki instance on a second VPS or a compatible object-storage bucket. Grafana connects to Loki as a data source and lets you set up alerts on failed login attempts (sudo, SSH) or application errors. The stack is lightweight — Loki plus Grafana fit comfortably on a VPS starting at 99 DH/month — and keeps your logs off third-party services.

Yes. Cloudflare Tunnel (formerly Argo Tunnel) establishes an outbound connection from your VPS to the Cloudflare network, allowing you to expose a web application over HTTPS without opening any inbound port — ideal if your VPS is behind a strict firewall. The `cloudflared` daemon is installed on your server and manages the connection; your domain must be managed in Cloudflare. Our dedicated blog post covers the step-by-step configuration.

Yes, you can generate and install a free Let's Encrypt wildcard certificate via Certbot using the DNS-01 challenge, which covers your main domain and all its subdomains (*.example.com). On a dedicated server or VPS with root access, the process is entirely unrestricted on our side. You can also install a commercial wildcard certificate (OV or EV) obtained from a certificate authority of your choice.

Two critical two-factor authentication bypass vulnerabilities were discovered in Nextcloud in May 2026: CVE-2026-45690 (bypass via HTTP Basic Auth, CVSS 5.9) and CVE-2026-45691 (bypass via a DAV Bearer token, CVSS 5.9). These allow an attacker with credentials to log in without 2FA. **Step 1 — Check your version**: log in to your Nextcloud as administrator, go to **Administration → Overview** and check the displayed version. **Fixed versions**: Nextcloud 32.0.9 and 33.0.3. ⚠️ Nextcloud 34.0.2 contains a regression — do not use it. **Step 2 — Update if necessary**: from the admin interface, go to **Administration → Overview → Check for updates** and apply the latest available update. For a Docker instance, change the image tag to `nextcloud:32.0.9-apache` and restart the container. **Step 3 — Verify the 2FA app**: ensure the Two-Factor TOTP or SMS two-factor app is activated in **Administration → Security** and is mandatory for administrator accounts.

Authelia is a lightweight authentication proxy (< 30 MB RAM) that adds a 2FA and OIDC SSO layer in front of your applications via a reverse proxy (Traefik or nginx). It does not manage a full user directory and does not speak SAML 2.0. Authentik is a full IAM (Identity and Access Management) platform: it covers OIDC, SAML 2.0, LDAP, SCIM and automatic account provisioning. It requires a VPS with at least 4 GB of RAM (4 containers: server, worker, PostgreSQL, Redis). In practice: use Authelia for 2 to 6 internal applications to protect with 2FA, Authentik if you need SAML 2.0, to federate more than five applications, or to provision accounts automatically. Both are available on the ServOrbit Marketplace.

Post-authentication CVEs exploit vulnerabilities accessible once logged in: keep your applications up to date as soon as a patch is published, restrict admin interface access by IP or via a reverse proxy with strong authentication, and limit administrator accounts to the strict minimum. Placing a WAF in front of your back office — via Cloudflare or an application proxy — allows known exploitation patterns to be blocked before they reach the application.

Since Bitwarden client version 2026.4.1, some older encryption APIs are no longer accepted by fresh installations: a new client enforces stricter checks than already-open sessions. Verify that your Vaultwarden instance is up to date (image `vaultwarden/server:latest` or a recent pinned version) and that your reverse proxy correctly forwards headers — especially `X-Real-IP` and `X-Forwarded-For`. If the issue persists, open a ticket from your client area and include the Vaultwarden version (`docker inspect vaultwarden | grep -i version`) and the exact error message shown by the client.

Place a reverse proxy (Traefik or nginx) in front of your Docmost instance and attach Authelia or Authentik as an authentication middleware: every request passes through the SSO login page before reaching the application. With Traefik, add the `forwardAuth` middleware pointing to the Authelia decision endpoint in your labels. With nginx, use `auth_request` toward the verification endpoint. This approach is especially suited to internal documentation tools that do not expose robust native authentication. Authentik is available via the ServOrbit marketplace and supports OIDC, SAML 2.0 and Traefik-compatible forward auth headers.

Before migrating, export your SQLite database (`kuma.db`) and store it safely — it is the single source of truth for your monitors and alerts. The v2 changes the database schema: start the new container with the same data volume and Uptime Kuma will run the migrations automatically on first launch. Then verify that every monitor is active and notification channels are working before removing the old instance. The v2 fixes vulnerability CVE-2026-45618 (injection via HTTP headers) — the update is recommended.

A WireGuard-based mesh VPN — such as Netbird or Tailscale — creates an encrypted peer-to-peer network between your VPS instances using outbound connections only; no inbound port is exposed on the public IP. A coordination node (STUN/TURN relay) handles NAT traversal; traffic between machines travels directly peer-to-peer once the tunnel is established. This approach suits database clusters, internal services and CI/CD pipelines that must not be reachable from the internet.

CVE-2026-45672 is a remote code execution vulnerability in Open WebUI affecting versions earlier than 0.6.10: an authenticated attacker can execute arbitrary code on the server via the file processing pipeline. Check your version from the admin interface (Settings > About) or with `docker inspect ghcr.io/open-webui/open-webui:latest | grep 'version'`. If you are below 0.6.10, update immediately by pulling the new image: `docker compose pull && docker compose up -d`. In the meantime, restrict access to your interface by IP through your reverse proxy. Contact [email protected] for update assistance.

The :latest tag overwrites the embeddings encryption key on every docker pull: IRREVERSIBLE loss of vectorised documents. Always pin a fixed version (e.g. v1.8.x) in docker-compose. Source: issue #5256 github.com/Mintplex-Labs/anything-llm.

Passbolt encrypts each entry with the recipient's public GPG key. Neither the server nor the administrator can read passwords without the holder's private key. Encryption is performed in the browser via the Passbolt extension.

Before upgrading Chatwoot, review the official changelog and the NVD/CVE database for vulnerabilities in the target version; the v4 branch notably patched flaws in authentication token handling. Fully back up your PostgreSQL database and volumes before any update, then test on a clone before production. If you are unsure about your instance's exposure, open a ticket from your client area or contact [email protected].

**Let's Encrypt (free)**: - **DV (Domain Validation)** certificates only: proves you control the domain, not your organization's identity - Valid 90 days (automatic renewal via certbot) - Recognized by all modern browsers - Suitable for the vast majority of websites - Wildcard available (via DNS-01): one certificate covers `*.your-domain.com` **Paid certificates**: - **OV (Organization Validation)**: the CA verifies your company's legal existence — visible in certificate details - **EV (Extended Validation)**: thorough verification, formerly shown as a green bar in browsers (this indicator was removed from modern browsers in 2019) - Valid 1–2 years - May include financial guarantees in case of mis-issuance **For 99% of use cases, Let's Encrypt is sufficient.** EV/OV certificates are useful for internal compliance reasons, contracts with certain partners, or regulated sectors (banks, insurance) that contractually require them.

Subscribe to Gitea releases on GitHub (github.com/go-gitea/gitea/releases) and enable notifications for new versions. Each release specifies whether it fixes CVEs and the severity (CVSS). On a ServOrbit VPS, updates are done via `docker compose pull && docker compose up -d` — always back up before any major update.

Start by exporting an encrypted vault from your current manager, verify its integrity before deleting the original, then deploy Vaultwarden or Passbolt on a dedicated VPS over HTTPS with a valid certificate — Bitwarden clients refuse unencrypted connections. Enable two-factor authentication on all accounts from the first login, schedule the cutover outside working hours, and only revoke access to the old solution once every team member has validated the new one. Our support team can help with TLS configuration at [email protected].

Check `/var/log/auth.log` (Debian/Ubuntu) for failed login attempts (`Failed password`, `Invalid user`) and successful logins outside your usual hours. The `last` command lists recent SSH sessions with timestamp and source IP. For ongoing monitoring, `fail2ban` automatically blocks IPs that accumulate failures, and you can configure email alerts. If you confirm an unknown login, immediately end the session with `pkill -u <user>`, rotate your SSH keys, and open a ticket from your client area.

For purely internal use — team, internal projects, no service exposure to third parties — BSL and SSPL generally impose no constraint: neither targets private use. The SSPL restriction triggers when you offer the software as a service to external users (SaaS); the BSL prohibits offering a commercial service that competes with the publisher. If your clients access the tool, consult a lawyer before deploying. Subscribe to GitHub releases of the projects you rely on to detect licence changes at each major version.

The DNS-01 challenge lets you obtain a wildcard certificate (`*.yourdomain.ma`) without exposing an HTTP port: Certbot creates a TXT record `_acme-challenge` in your DNS zone, which Let's Encrypt then verifies. If your domain is managed via Cloudflare, the `certbot-dns-cloudflare` plugin automates this step with a reduced-scope API token (`Zone:DNS:Edit`). Add a cron job or systemd timer to run `certbot renew` and automatically reload nginx after renewal. Test the renewal process early with `--dry-run` before handing it over to the scheduler.

By default, PostgreSQL listens on port 5432; if this port is reachable from the Internet, anyone can attempt to connect. Check your exposure with `ss -tlnp | grep 5432` (or `netstat`): if the listening address is `0.0.0.0` or `::`, the service is reachable from outside. To secure it: bind PostgreSQL to `127.0.0.1` in `postgresql.conf` (`listen_addresses = 'localhost'`), block the port with your firewall (`ufw deny 5432`), and only allow remote access via an SSH tunnel or VPN. If you need help hardening your configuration, open a ticket from your client area.

Start by checking the Certbot logs using the command journalctl -u certbot or by reading the file /var/log/letsencrypt/letsencrypt.log to identify the cause of the failure. If you are using the HTTP-01 challenge, verify that port 80 is accessible from outside and that your web server configuration correctly serves the .well-known/acme-challenge/ directory. If port 80 is blocked or if you need a wildcard certificate, switch to the DNS-01 challenge using the DNS plugin appropriate for your provider. To force an immediate renewal to test the configuration, use the command certbot renew --force-renewal.

A wildcard SSL certificate covers a domain and all its first-level subdomains, for example *.example.com. Let's Encrypt issues wildcard certificates only via the DNS-01 challenge, which requires creating a TXT record in your DNS zone to prove domain ownership. To automate this process, use Certbot with the DNS plugin corresponding to your DNS provider. ZeroSSL is an alternative to Let's Encrypt that also offers free wildcard certificates via the DNS-01 challenge and provides a web interface to facilitate manual issuance.

When your domain is proxied by Cloudflare, Certbot's HTTP-01 challenge may fail because Cloudflare responds instead of your server. Use the DNS-01 challenge instead: install the `certbot-dns-cloudflare` plugin, create a Cloudflare API token with `Zone:DNS:Edit` permission, then run `certbot renew --dns-cloudflare --dns-cloudflare-credentials ~/cloudflare.ini`. Renewal takes place without exposing any port and works even if your server is unreachable from the internet. Remember to automate renewal via a `certbot renew` cron job to avoid future expirations.

You can verify the installation and expiry date of your SSL certificate directly in your browser: click the padlock in the address bar, then on 'Connection is secure' to display certificate details (issuer, covered domain, validity). Online tools such as SSL Labs (ssllabs.com/ssltest) or check-host.net also allow an in-depth analysis (certificate chain, algorithms, compatibility). If the certificate is managed automatically by ServOrbit (Let's Encrypt), renewal is handled without any action required on your part.

This CVE targets self-hosted Artifactory instances that expose certain REST endpoints without authentication. Check your installed version (Administration → System → General Configuration) and apply the patch from the official JFrog release notes. In the meantime, block public access to the admin port (8081/8082) via your ServOrbit VPS or dedicated server firewall, and disable anonymous access in Artifactory security settings.

Yes, since Docker Compose v2.24, Docker Secrets are natively supported without Swarm. You declare a secrets block in your docker-compose.yml referencing a local file: Docker mounts the secret as a temporary file at /run/secrets/<name> inside the container, without exposing it in environment variables or docker inspect. This is the recommended method for protecting API keys, database passwords or tokens on a root VPS. See our guide on Docker Secrets in production for exact commands and the limits of each approach.

Three approaches are available on a root VPS: Docker Secrets (files mounted at /run/secrets/, no Swarm required since Compose v2.24), .env.vault with the dotenvx tool which encrypts the .env file and only exposes the DOTENV_KEY decryption key, and SOPS which encrypts values in a YAML or .env file using an age or AWS KMS key. In all cases, the plain .env file must never be committed to Git. See our Docker Secrets in production guide for commands and the real limits of each method.

CVE-2026-87902 is a Remote Code Execution (RCE) vulnerability found in WordPress versions prior to 7.1.2. If your site runs an older version, it may be at risk. Check your current version in your WordPress dashboard under Dashboard → Updates. To stay protected, update to WordPress 7.1.2 or higher immediately through your ServOrbit panel or directly from the WordPress admin.

After a CVE is published, automated bots scan exposed servers en masse. On your ServOrbit VPS, enable the built-in firewall to block suspicious IP ranges, update WordPress immediately, and consider adding the Imunify360 license, available as an option, which provides an application firewall. Also put your site behind Cloudflare in proxied mode to benefit from DDoS protection and additional application-level filtering. Our support team can help you with the setup.

Dokploy 0.29.x was affected by several critical CVEs allowing privilege escalation and remote code execution via the Docker API. To check your version, SSH into the server and run `dokploy --version` or check the admin interface. If you are on 0.29.x, update immediately using `curl -sSL https://dokploy.com/install.sh | sh` or follow the official release notes. While waiting for the update, restrict access to the interface port (default 3000) to your trusted IPs via your VPS firewall.

Yes, `unattended-upgrades` can trigger an automatic reboot after installing a kernel patch if the `Unattended-Upgrade::Automatic-Reboot` option is enabled in `/etc/apt/apt.conf.d/50unattended-upgrades`. By default, this option is disabled to avoid unplanned downtime. You can set a fixed reboot time with `Unattended-Upgrade::Automatic-Reboot-Time`, allowing you to schedule restarts outside peak hours. For critical production environments, many administrators prefer to leave this option disabled and handle reboots manually, using `needrestart` to determine whether a reboot is actually required.

Several methods confirm that `unattended-upgrades` is working correctly. The log file `/var/log/unattended-upgrades/unattended-upgrades.log` lists packages installed during recent runs. The command `unattended-upgrades --dry-run --debug` simulates an execution without making any changes and shows what would be updated. The file `/var/log/dpkg.log` records every package installation with its timestamp. On recent systems, `systemctl status unattended-upgrades` shows the service state. Finally, `apt-get -s upgrade` combined with filtering for security packages (`unattended-upgrade -d`) lets you verify that no critical update is pending.

Yes, provided the subdomain is created via cPanel and its DNS record points to your hosting server. Let's Encrypt then issues a certificate for that subdomain within minutes of the addition, without any action on your part. If the subdomain is hosted elsewhere or not resolved in DNS, no certificate can be issued automatically.

Qdrant exposes its HTTP interface on port 6333 without authentication by default. On a ServOrbit VPS, combine three measures. First, define an API key in the Qdrant configuration by adding `api_key: your-secret-key` to `config/production.yaml` or using the environment variable `QDRANT__SERVICE__API_KEY`. Every request must then include the header `api-key: your-secret-key`. Second, restrict network access to port 6333 with UFW: allow only the IPs of your applications (application server, ingestion pipeline) and block everything else. Third, never expose Qdrant directly on the internet without a TLS reverse proxy: put an nginx vhost in front with a Let's Encrypt certificate and forward HTTPS connections to local port 6333. The ServOrbit template for Qdrant integrates these three measures by default. For any questions about network configuration, contact [email protected].

Cookie compliance — consent banner, blocking third-party scripts before acceptance, and consent records — is your responsibility as the site publisher, regardless of the hosting provider. ServOrbit supplies the secure infrastructure (HTTPS, account isolation, backups) but does not manage your frontend scripts. You can integrate an open-source solution such as Klaro or Cookie Consent on your hosting or VPS, or engage a developer. For any technical question about your hosting configuration, open a ticket from your client area.

A classic VPN centralizes all traffic through a gateway server: each client connects to the server, which redistributes to the others. A mesh VPN (Tailscale/Headscale) creates direct encrypted tunnels between each peer using the WireGuard protocol, without routing traffic through a central node. The result is lower latency and higher resilience, at the cost of more distributed key management. Headscale is the self-hostable version of the Tailscale coordination server.

NIS2 Article 21 mandates proportionate security measures including encryption of data in transit, making a valid TLS certificate mandatory for any self-hosted instance exposed to the Internet. On ServOrbit, each VPS can obtain a free Let's Encrypt certificate through our interface or directly via Certbot. An expired or self-signed certificate does not satisfy NIS2 requirements and exposes your organisation to non-compliance.

Yes, Zitadel is designed precisely for this use case: you can create a single Zitadel project and register multiple applications (OIDC clients) within it, each corresponding to one of the self-hosted applications you want to protect. Each application gets its own client ID and secret, with distinct role and scope boundaries, ensuring fine-grained access isolation. Zitadel can be self-hosted on the same ServOrbit VPS behind Traefik, assigned a dedicated subdomain with automatically managed TLS certificates. OIDC-compatible applications (Gitea, Portainer, Grafana, n8n…) can be configured in minutes by adding the Zitadel provider URL and client credentials. Plan for at least 2 GB of RAM for a comfortable Zitadel instance if it runs alongside other services on the same host.

Wazuh is an open-source SIEM/XDR platform you can install on a ServOrbit VPS (recommended: 4 vCPU, 8 GB RAM minimum). The Wazuh manager centralises alerts from agents deployed on each monitored server; the built-in OpenSearch Dashboards give you a real-time view of security events. ServOrbit offers Wazuh in its marketplace for one-click deployment; for manual installation or configuration assistance, contact [email protected].

ANRT does not require an SSL certificate as a registration condition for .ma domains, but HTTPS is a de facto requirement imposed by modern browsers and search engines, which flag or downrank unencrypted pages. All ServOrbit hosting plans include a free, automatically renewed Let's Encrypt certificate. For stricter compliance needs (GDPR, NIS2 or sector-specific obligations), OV or EV certificates can be installed on request — reach us via our contact form.

A crash loop (CrashLoopBackOff) causes the container to restart at increasing intervals: a 'ping container' probe may then alternate between 'up' and 'down' without triggering an alert if the confirmation threshold is too low. Uptime Kuma v2 improved detection of intermediate states compared to v1 — keeping your instance up to date reduces this risk. For critical services, complement the availability probe with an HTTP healthcheck on a real application endpoint, which checks the container's internal state rather than just its startup.

Yes. Pocket ID is an OIDC/OAuth 2.0 provider: register each application as a separate client in its admin interface (client ID + redirect URI), and your users authenticate once to access all compatible OIDC apps. This centralised SSO architecture is particularly effective for protecting a set of services on the same VPS or across several ServOrbit servers sharing a common authentication subdomain.

Yes, OV (Organization Validation) and EV (Extended Validation) SSL certificates are available at ServOrbit for Moroccan companies with a valid RC or ICE number. These certificates display your company name in the certificate details, increasing visitor trust, especially for e-commerce sites or financial portals. The validation process requires providing official documents (trade register, articles of association); allow 3 to 5 business days. Contact us at [email protected] to start the process.

Not necessarily. Debian, Ubuntu, AlmaLinux and Rocky Linux backport security fixes into the version they package without changing the upstream number: only the package suffix changes, and the number shown by `nginx -v` is not enough to conclude. Look for the announced CVE identifier in the changelog of the installed package (`apt changelog nginx` on Debian or Ubuntu, `rpm -q --changelog nginx` on AlmaLinux or Rocky Linux), or check your distribution's security tracker — the same method applies to OpenSSH. On web or reseller hosting, this check is our responsibility; on a VPS or a dedicated server, it is yours.

The update closes the flaw, but it does not tell you whether it was exploited beforehand. If your application was exposed to the Internet during the vulnerability window, treat the secrets stored on the server (API keys, database passwords, environment file) as possibly read and renew them, then review your access logs. If you suspect a compromise, open a ticket from your customer area.

Do not just wait: a vulnerable plugin with no fix remains an open door. Make a backup, then deactivate and delete the plugin (simple deactivation often leaves its files in place) and replace it with an equivalent, maintained extension. If the site stayed exposed, look for recently modified files and unknown administrator accounts, and restore a clean backup if you find any. The WordPress manager in your cPanel (WP Toolkit) and [email protected] can help you check the state of the site.

Pick « Full (strict) » as soon as your server presents a valid certificate: Cloudflare then also encrypts the leg to the origin and checks its certificate. In « Flexible », Cloudflare contacts the origin over HTTP; if the origin redirects HTTP to HTTPS, the request goes round in circles and the browser shows « too many redirects ». The « Full » mode without « strict » accepts a self-signed or expired certificate: keep it for troubleshooting only. Set the mode before enabling the proxy, then test the site after each change.

On web hosting, the server and the system are the host's responsibility, but the content of your site remains yours: the CMS, themes, extensions and the PHP version chosen for each domain. These are what most announced CMS vulnerabilities target, rather than the server. The WordPress manager in cPanel (WP Toolkit) shows you the available updates; apply them after a backup. If you have doubts about the state of your site, write to [email protected].

Your server cannot verify the identity of the service it is calling. The most common causes are an old `ca-certificates` package, an incomplete or expired certificate chain on the service side, a hostname missing from the certificate, or a skewed server clock. Test with `openssl s_client -connect api.example.com:443 -servername api.example.com` and read the “Verify return code” line. Never turn verification off to make the call go through: fix the cause.