SSL & Security

Yes, a free Let's Encrypt SSL certificate is included with web hosting and renewed automatically. HTTPS is enabled as soon as the site goes live.

Yes. If you need an extended validation or organization validation certificate, you can install it on your hosting. Our support team will assist you.

Automatic redirection from HTTP to HTTPS can be enabled in one click from cPanel, to serve your entire site securely.

Our infrastructure applies account isolation, a firewall and regular updates. On a VPS, the security of your environment remains your responsibility (we can advise you).

Yes: every site is protected by the Cloudflare network, which absorbs DDoS attacks on a global scale — the same protection as the largest sites on the web, included at no extra cost.

Cloudflare is the network that speeds up and protects nearly 20% of the global web. We connect your domain to it automatically and free of charge: you gain a global CDN (a faster site everywhere), DDoS protection, a resilient anycast DNS and HTTPS — with nothing for you to configure.

Keep WordPress, its themes and plugins up to date, use strong passwords, limit login attempts, enable SSL and make regular backups.

Contact our support team without delay: we will help you restore a clean backup and identify the vulnerability, so that it does not happen again.

Let's Encrypt certificates are valid for 90 days, requiring automated renewal roughly every 60 days. On our hosting plans, renewal is fully automatic — no action needed on your part. The CA/B Forum has adopted a roadmap to progressively shorten this lifetime: first to 100 days, then to 47 days by 2029. More frequent renewals improve security by limiting exposure if a private key is compromised. If you manage a certificate on a server outside our platform, ensure your automation tool (Certbot, acme.sh) is up to date to handle these shorter lifetimes.

ACME clients such as `certbot`, `acme.sh`, or Caddy can renew your SSL certificates automatically without any manual intervention. Most clients install a systemd timer or cron job natively. This automation is increasingly critical: the CA/B Forum plans to reduce maximum certificate validity to 47 days by 2029, making manual renewal structurally unmanageable.

Traefik natively integrates an ACME client compatible with Let's Encrypt. Simply declare a resolver in the `certificatesResolvers` section of the `traefik.yml` file (or as an environment variable), then add the label `traefik.http.routers.<service>.tls.certresolver=<name>` to each Docker container you want to protect. Traefik then handles the HTTP-01 or DNS-01 challenge negotiation, certificate issuance and automatic renewal before expiry. Certificates are stored in a persistent JSON file (`acme.json`) that you must mount in a volume to avoid losing them when the container restarts.

Yes. Open source solutions like Authentik or Authelia, available in the ServOrbit Marketplace, let you centralise authentication across all your applications (Gitea, Nextcloud, Chatwoot…) through a single SSO/OIDC portal. You manage users, permissions and two-factor authentication from one interface, without reconfiguring each application separately. A VPS Power (4 vCPU, 8 GB) is recommended for Authentik; Authelia requires fewer resources.

Yes, ServOrbit shared hosting runs on CloudLinux, which ensures strong isolation between accounts. Each customer operates inside a sandboxed environment called an LVE (Linux Virtual Environment): your files, processes, and CPU/RAM resources are strictly separated from those of other clients on the same server. A misconfigured or compromised neighboring site cannot access your data or disproportionately impact your performance. This architecture provides an additional layer of protection compared to traditional shared hosting without CloudLinux.

Deploy Promtail on each VPS you want to monitor: it collects system logs (auth.log, syslog, journald) and ships them to a centralised Loki instance on a second VPS or a compatible object-storage bucket. Grafana connects to Loki as a data source and lets you set up alerts on failed login attempts (sudo, SSH) or application errors. The stack is lightweight — Loki plus Grafana fit comfortably on a VPS starting at 99 DH/month — and keeps your logs off third-party services.

Yes. Cloudflare Tunnel (formerly Argo Tunnel) establishes an outbound connection from your VPS to the Cloudflare network, allowing you to expose a web application over HTTPS without opening any inbound port — ideal if your VPS is behind a strict firewall. The `cloudflared` daemon is installed on your server and manages the connection; your domain must be managed in Cloudflare. Our dedicated blog post covers the step-by-step configuration.

Yes, you can generate and install a free Let's Encrypt wildcard certificate via Certbot using the DNS-01 challenge, which covers your main domain and all its subdomains (*.example.com). On a dedicated server or VPS with root access, the process is entirely unrestricted on our side. You can also install a commercial wildcard certificate (OV or EV) obtained from a certificate authority of your choice.

Two critical two-factor authentication bypass vulnerabilities were discovered in Nextcloud in May 2026: CVE-2026-45690 (bypass via HTTP Basic Auth, CVSS 5.9) and CVE-2026-45691 (bypass via a DAV Bearer token, CVSS 5.9). These allow an attacker with credentials to log in without 2FA. **Step 1 — Check your version**: log in to your Nextcloud as administrator, go to **Administration → Overview** and check the displayed version. **Fixed versions**: Nextcloud 32.0.9 and 33.0.3. ⚠️ Nextcloud 34.0.2 contains a regression — do not use it. **Step 2 — Update if necessary**: from the admin interface, go to **Administration → Overview → Check for updates** and apply the latest available update. For a Docker instance, change the image tag to `nextcloud:32.0.9-apache` and restart the container. **Step 3 — Verify the 2FA app**: ensure the Two-Factor TOTP or SMS two-factor app is activated in **Administration → Security** and is mandatory for administrator accounts.

Authelia is a lightweight authentication proxy (< 30 MB RAM) that adds a 2FA and OIDC SSO layer in front of your applications via a reverse proxy (Traefik or nginx). It does not manage a full user directory and does not speak SAML 2.0. Authentik is a full IAM (Identity and Access Management) platform: it covers OIDC, SAML 2.0, LDAP, SCIM and automatic account provisioning. It requires a VPS with at least 4 GB of RAM (4 containers: server, worker, PostgreSQL, Redis). In practice: use Authelia for 2 to 6 internal applications to protect with 2FA, Authentik if you need SAML 2.0, to federate more than five applications, or to provision accounts automatically. Both are available on the ServOrbit Marketplace.

Post-authentication CVEs exploit vulnerabilities accessible once logged in: keep your applications up to date as soon as a patch is published, restrict admin interface access by IP or via a reverse proxy with strong authentication, and limit administrator accounts to the strict minimum. Placing a WAF in front of your back office — via Cloudflare or an application proxy — allows known exploitation patterns to be blocked before they reach the application.

Since Bitwarden client version 2026.4.1, some older encryption APIs are no longer accepted by fresh installations: a new client enforces stricter checks than already-open sessions. Verify that your Vaultwarden instance is up to date (image `vaultwarden/server:latest` or a recent pinned version) and that your reverse proxy correctly forwards headers — especially `X-Real-IP` and `X-Forwarded-For`. If the issue persists, open a ticket from your client area and include the Vaultwarden version (`docker inspect vaultwarden | grep -i version`) and the exact error message shown by the client.

Place a reverse proxy (Traefik or nginx) in front of your Docmost instance and attach Authelia or Authentik as an authentication middleware: every request passes through the SSO login page before reaching the application. With Traefik, add the `forwardAuth` middleware pointing to the Authelia decision endpoint in your labels. With nginx, use `auth_request` toward the verification endpoint. This approach is especially suited to internal documentation tools that do not expose robust native authentication. Authentik is available via the ServOrbit marketplace and supports OIDC, SAML 2.0 and Traefik-compatible forward auth headers.

Before migrating, export your SQLite database (`kuma.db`) and store it safely — it is the single source of truth for your monitors and alerts. The v2 changes the database schema: start the new container with the same data volume and Uptime Kuma will run the migrations automatically on first launch. Then verify that every monitor is active and notification channels are working before removing the old instance. The v2 fixes vulnerability CVE-2026-45618 (injection via HTTP headers) — the update is recommended.

A WireGuard-based mesh VPN — such as Netbird or Tailscale — creates an encrypted peer-to-peer network between your VPS instances using outbound connections only; no inbound port is exposed on the public IP. A coordination node (STUN/TURN relay) handles NAT traversal; traffic between machines travels directly peer-to-peer once the tunnel is established. This approach suits database clusters, internal services and CI/CD pipelines that must not be reachable from the internet.

CVE-2026-45672 is a remote code execution vulnerability in Open WebUI affecting versions earlier than 0.6.10: an authenticated attacker can execute arbitrary code on the server via the file processing pipeline. Check your version from the admin interface (Settings > About) or with `docker inspect ghcr.io/open-webui/open-webui:latest | grep 'version'`. If you are below 0.6.10, update immediately by pulling the new image: `docker compose pull && docker compose up -d`. In the meantime, restrict access to your interface by IP through your reverse proxy. Contact [email protected] for update assistance.

The :latest tag overwrites the embeddings encryption key on every docker pull: IRREVERSIBLE loss of vectorised documents. Always pin a fixed version (e.g. v1.8.x) in docker-compose. Source: issue #5256 github.com/Mintplex-Labs/anything-llm.

Passbolt encrypts each entry with the recipient's public GPG key. Neither the server nor the administrator can read passwords without the holder's private key. Encryption is performed in the browser via the Passbolt extension.

Before upgrading Chatwoot, review the official changelog and the NVD/CVE database for vulnerabilities in the target version; the v4 branch notably patched flaws in authentication token handling. Fully back up your PostgreSQL database and volumes before any update, then test on a clone before production. If you are unsure about your instance's exposure, open a ticket from your client area or contact [email protected].

**Let's Encrypt (free)**: - **DV (Domain Validation)** certificates only: proves you control the domain, not your organization's identity - Valid 90 days (automatic renewal via certbot) - Recognized by all modern browsers - Suitable for the vast majority of websites - Wildcard available (via DNS-01): one certificate covers `*.your-domain.com` **Paid certificates**: - **OV (Organization Validation)**: the CA verifies your company's legal existence — visible in certificate details - **EV (Extended Validation)**: thorough verification, formerly shown as a green bar in browsers (this indicator was removed from modern browsers in 2019) - Valid 1–2 years - May include financial guarantees in case of mis-issuance **For 99% of use cases, Let's Encrypt is sufficient.** EV/OV certificates are useful for internal compliance reasons, contracts with certain partners, or regulated sectors (banks, insurance) that contractually require them.

Subscribe to Gitea releases on GitHub (github.com/go-gitea/gitea/releases) and enable notifications for new versions. Each release specifies whether it fixes CVEs and the severity (CVSS). On a ServOrbit VPS, updates are done via `docker compose pull && docker compose up -d` — always back up before any major update.

Start by exporting an encrypted vault from your current manager, verify its integrity before deleting the original, then deploy Vaultwarden or Passbolt on a dedicated VPS over HTTPS with a valid certificate — Bitwarden clients refuse unencrypted connections. Enable two-factor authentication on all accounts from the first login, schedule the cutover outside working hours, and only revoke access to the old solution once every team member has validated the new one. Our support team can help with TLS configuration at [email protected].

Check `/var/log/auth.log` (Debian/Ubuntu) for failed login attempts (`Failed password`, `Invalid user`) and successful logins outside your usual hours. The `last` command lists recent SSH sessions with timestamp and source IP. For ongoing monitoring, `fail2ban` automatically blocks IPs that accumulate failures, and you can configure email alerts. If you confirm an unknown login, immediately end the session with `pkill -u <user>`, rotate your SSH keys, and open a ticket from your client area.

For purely internal use — team, internal projects, no service exposure to third parties — BSL and SSPL generally impose no constraint: neither targets private use. The SSPL restriction triggers when you offer the software as a service to external users (SaaS); the BSL prohibits offering a commercial service that competes with the publisher. If your clients access the tool, consult a lawyer before deploying. Subscribe to GitHub releases of the projects you rely on to detect licence changes at each major version.

The DNS-01 challenge lets you obtain a wildcard certificate (`*.yourdomain.ma`) without exposing an HTTP port: Certbot creates a TXT record `_acme-challenge` in your DNS zone, which Let's Encrypt then verifies. If your domain is managed via Cloudflare, the `certbot-dns-cloudflare` plugin automates this step with a reduced-scope API token (`Zone:DNS:Edit`). Add a cron job or systemd timer to run `certbot renew` and automatically reload nginx after renewal. Test the renewal process early with `--dry-run` before handing it over to the scheduler.

By default, PostgreSQL listens on port 5432; if this port is reachable from the Internet, anyone can attempt to connect. Check your exposure with `ss -tlnp | grep 5432` (or `netstat`): if the listening address is `0.0.0.0` or `::`, the service is reachable from outside. To secure it: bind PostgreSQL to `127.0.0.1` in `postgresql.conf` (`listen_addresses = 'localhost'`), block the port with your firewall (`ufw deny 5432`), and only allow remote access via an SSH tunnel or VPN. If you need help hardening your configuration, open a ticket from your client area.

Start by checking the Certbot logs using the command journalctl -u certbot or by reading the file /var/log/letsencrypt/letsencrypt.log to identify the cause of the failure. If you are using the HTTP-01 challenge, verify that port 80 is accessible from outside and that your web server configuration correctly serves the .well-known/acme-challenge/ directory. If port 80 is blocked or if you need a wildcard certificate, switch to the DNS-01 challenge using the DNS plugin appropriate for your provider. To force an immediate renewal to test the configuration, use the command certbot renew --force-renewal.

A wildcard SSL certificate covers a domain and all its first-level subdomains, for example *.example.com. Let's Encrypt issues wildcard certificates only via the DNS-01 challenge, which requires creating a TXT record in your DNS zone to prove domain ownership. To automate this process, use Certbot with the DNS plugin corresponding to your DNS provider. ZeroSSL is an alternative to Let's Encrypt that also offers free wildcard certificates via the DNS-01 challenge and provides a web interface to facilitate manual issuance.

When your domain is proxied by Cloudflare, Certbot's HTTP-01 challenge may fail because Cloudflare responds instead of your server. Use the DNS-01 challenge instead: install the `certbot-dns-cloudflare` plugin, create a Cloudflare API token with `Zone:DNS:Edit` permission, then run `certbot renew --dns-cloudflare --dns-cloudflare-credentials ~/cloudflare.ini`. Renewal takes place without exposing any port and works even if your server is unreachable from the internet. Remember to automate renewal via a `certbot renew` cron job to avoid future expirations.

You can verify the installation and expiry date of your SSL certificate directly in your browser: click the padlock in the address bar, then on 'Connection is secure' to display certificate details (issuer, covered domain, validity). Online tools such as SSL Labs (ssllabs.com/ssltest) or check-host.net also allow an in-depth analysis (certificate chain, algorithms, compatibility). If the certificate is managed automatically by ServOrbit (Let's Encrypt), renewal is handled without any action required on your part.

This CVE targets self-hosted Artifactory instances that expose certain REST endpoints without authentication. Check your installed version (Administration → System → General Configuration) and apply the patch from the official JFrog release notes. In the meantime, block public access to the admin port (8081/8082) via your ServOrbit VPS or dedicated server firewall, and disable anonymous access in Artifactory security settings.

Yes, since Docker Compose v2.24, Docker Secrets are natively supported without Swarm. You declare a secrets block in your docker-compose.yml referencing a local file: Docker mounts the secret as a temporary file at /run/secrets/<name> inside the container, without exposing it in environment variables or docker inspect. This is the recommended method for protecting API keys, database passwords or tokens on a root VPS. See our guide on Docker Secrets in production for exact commands and the limits of each approach.

Three approaches are available on a root VPS: Docker Secrets (files mounted at /run/secrets/, no Swarm required since Compose v2.24), .env.vault with the dotenvx tool which encrypts the .env file and only exposes the DOTENV_KEY decryption key, and SOPS which encrypts values in a YAML or .env file using an age or AWS KMS key. In all cases, the plain .env file must never be committed to Git. See our Docker Secrets in production guide for commands and the real limits of each method.