[{"data":1,"prerenderedAt":351},["ShallowReactive",2],{"seo-verification":3,"support-category-ma-en-ssl-securite":6,"promo-bar-likely":350},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"items":7,"siblings":282,"self":348},[8,14,19,24,29,34,39,44,49,54,59,64,69,74,79,84,89,94,98,102,106,110,114,118,122,126,130,134,138,142,146,150,154,158,162,166,170,174,178,182,186,190,194,198,202,206,210,214,218,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278],{"id":9,"category":10,"question":11,"answer":12,"weight":13},48,"ssl-securite","Is the SSL certificate included and free?","Yes, a free Let's Encrypt SSL certificate is included with web hosting and renewed automatically. HTTPS is enabled as soon as the site goes live.",416,{"id":15,"category":10,"question":16,"answer":17,"weight":18},49,"Can I install a paid SSL certificate (OV\u002FEV)?","Yes. If you need an extended validation or organization validation certificate, you can install it on your hosting. Our support team will assist you.",415,{"id":20,"category":10,"question":21,"answer":22,"weight":23},50,"Do you force HTTPS on my site?","Automatic redirection from HTTP to HTTPS can be enabled in one click from cPanel, to serve your entire site securely.",414,{"id":25,"category":10,"question":26,"answer":27,"weight":28},51,"Is my data secure?","Our infrastructure applies account isolation, a firewall and regular updates. On a VPS, the security of your environment remains your responsibility (we can advise you).",413,{"id":30,"category":10,"question":31,"answer":32,"weight":33},52,"Do you offer protection against DDoS attacks?","We do not sell one ourselves, and ServOrbit does not guarantee any anti-DDoS protection. However, if your domain uses our managed DNS, you can turn on the Cloudflare proxy for your site's record from your client area, at no extra cost: web traffic then goes through the Cloudflare network, which filters it before it reaches the server, within the protections of its free plan, DDoS attacks included. Email stays outside the proxy.",412,{"id":35,"category":10,"question":36,"answer":37,"weight":38},135,"What is Cloudflare and what does it do for me?","Cloudflare is a global network that acts as a CDN, a DNS provider and a filter between your visitors and your server. If your domain uses our managed DNS, its zone is served by Cloudflare's anycast network. You can also turn on the Cloudflare proxy from your client area, record by record, at no extra cost: your site's web traffic then goes through its network, which caches static files close to visitors, serves HTTPS and filters requests before they reach the server. Email stays outside the proxy.",411,{"id":40,"category":10,"question":41,"answer":42,"weight":43},53,"How do I secure my WordPress site?","Keep WordPress, its themes and plugins up to date, use strong passwords, limit login attempts, enable SSL and make regular backups.",410,{"id":45,"category":10,"question":46,"answer":47,"weight":48},54,"What should I do if my site is compromised?","Contact our support team without delay: we will help you restore a clean backup and identify the vulnerability, so that it does not happen again.",409,{"id":50,"category":10,"question":51,"answer":52,"weight":53},314,"How long do Let's Encrypt SSL certificates last, and is this changing?","Let's Encrypt certificates are valid for 90 days, requiring automated renewal roughly every 60 days. On our hosting plans, renewal is fully automatic — no action needed on your part. The CA\u002FB Forum has adopted a roadmap to progressively shorten this lifetime: first to 100 days, then to 47 days by 2029. More frequent renewals improve security by limiting exposure if a private key is compromised. If you manage a certificate on a server outside our platform, ensure your automation tool (Certbot, acme.sh) is up to date to handle these shorter lifetimes.",184,{"id":55,"category":10,"question":56,"answer":57,"weight":58},322,"How do I automate SSL certificate renewal with an ACME client?","ACME clients such as `certbot`, `acme.sh`, or Caddy can renew your SSL certificates automatically without any manual intervention. Most clients install a systemd timer or cron job natively. This automation is increasingly critical: the CA\u002FB Forum plans to reduce maximum certificate validity to 47 days by 2029, making manual renewal structurally unmanageable.",176,{"id":60,"category":10,"question":61,"answer":62,"weight":63},378,"How does Traefik automatically obtain Let's Encrypt certificates?","Traefik natively integrates an ACME client compatible with Let's Encrypt. Simply declare a resolver in the `certificatesResolvers` section of the `traefik.yml` file (or as an environment variable), then add the label `traefik.http.routers.\u003Cservice>.tls.certresolver=\u003Cname>` to each Docker container you want to protect. Traefik then handles the HTTP-01 or DNS-01 challenge negotiation, certificate issuance and automatic renewal before expiry. Certificates are stored in a persistent JSON file (`acme.json`) that you must mount in a volume to avoid losing them when the container restarts.",120,{"id":65,"category":10,"question":66,"answer":67,"weight":68},387,"Can I protect multiple self-hosted applications with a single identity provider (SSO)?","Yes. Open source solutions like Authentik or Authelia, available in the ServOrbit Marketplace, let you centralise authentication across all your applications (Gitea, Nextcloud, Chatwoot…) through a single SSO\u002FOIDC portal. You manage users, permissions and two-factor authentication from one interface, without reconfiguring each application separately. A VPS Power (4 vCPU, 8 GB) is recommended for Authentik; Authelia requires fewer resources.",111,{"id":70,"category":10,"question":71,"answer":72,"weight":73},402,"Are my files isolated from other clients' files on ServOrbit shared hosting?","Yes, ServOrbit shared hosting runs on CloudLinux, which ensures strong isolation between accounts. Each customer operates inside a sandboxed environment called an LVE (Linux Virtual Environment): your files, processes, and CPU\u002FRAM resources are strictly separated from those of other clients on the same server. A misconfigured or compromised neighboring site cannot access your data or disproportionately impact your performance. This architecture provides an additional layer of protection compared to traditional shared hosting without CloudLinux.",91,{"id":75,"category":10,"question":76,"answer":77,"weight":78},437,"How do I centralise my VPS security logs with Loki and Grafana?","Deploy Promtail on each VPS you want to monitor: it collects system logs (auth.log, syslog, journald) and ships them to a centralised Loki instance on a second VPS or a compatible object-storage bucket. Grafana connects to Loki as a data source and lets you set up alerts on failed login attempts (sudo, SSH) or application errors. The stack is lightweight — Loki plus Grafana fit comfortably on a VPS starting at 99 DH\u002Fmonth with no commitment — and keeps your logs off third-party services.",65,{"id":80,"category":10,"question":81,"answer":82,"weight":83},466,"Can I expose an application on my VPS without opening any inbound firewall port, using a Cloudflare Tunnel?","Yes. Cloudflare Tunnel (formerly Argo Tunnel) establishes an outbound connection from your VPS to the Cloudflare network, allowing you to expose a web application over HTTPS without opening any inbound port — ideal if your VPS is behind a strict firewall. The `cloudflared` daemon is installed on your server and manages the connection; your domain must be managed in Cloudflare. Our dedicated blog post covers the step-by-step configuration.",36,{"id":85,"category":10,"question":86,"answer":87,"weight":88},484,"Can I install a wildcard SSL certificate on my ServOrbit dedicated server or VPS?","Yes, you can generate and install a free Let's Encrypt wildcard certificate via Certbot using the DNS-01 challenge, which covers your main domain and all its subdomains (*.example.com). On a dedicated server or VPS with root access, the process is entirely unrestricted on our side. You can also install a commercial wildcard certificate (OV or EV) obtained from a certificate authority of your choice.",18,{"id":90,"category":10,"question":91,"answer":92,"weight":93},518,"How do I verify that my Nextcloud instance is protected against the 2026 2FA CVEs?","Two critical two-factor authentication bypass vulnerabilities were discovered in Nextcloud in May 2026: CVE-2026-45690 (bypass via HTTP Basic Auth, CVSS 5.9) and CVE-2026-45691 (bypass via a DAV Bearer token, CVSS 5.9). These allow an attacker with credentials to log in without 2FA. **Step 1 — Check your version**: log in to your Nextcloud as administrator, go to **Administration → Overview** and check the displayed version. **Fixed versions**: Nextcloud 32.0.9 and 33.0.3. ⚠️ Nextcloud 34.0.2 contains a regression — do not use it. **Step 2 — Update if necessary**: from the admin interface, go to **Administration → Overview → Check for updates** and apply the latest available update. For a Docker instance, change the image tag to `nextcloud:32.0.9-apache` and restart the container. **Step 3 — Verify the 2FA app**: ensure the Two-Factor TOTP or SMS two-factor app is activated in **Administration → Security** and is mandatory for administrator accounts.",1,{"id":95,"category":10,"question":96,"answer":97,"weight":93},530,"What is the difference between Authelia and Authentik to protect my applications on a VPS?","Authelia is a lightweight authentication proxy (\u003C 30 MB RAM) that adds a 2FA and OIDC SSO layer in front of your applications via a reverse proxy (Traefik or nginx). It does not manage a full user directory and does not speak SAML 2.0. Authentik is a full IAM (Identity and Access Management) platform: it covers OIDC, SAML 2.0, LDAP, SCIM and automatic account provisioning. It requires a VPS with at least 4 GB of RAM (4 containers: server, worker, PostgreSQL, Redis). In practice: use Authelia for 2 to 6 internal applications to protect with 2FA, Authentik if you need SAML 2.0, to federate more than five applications, or to provision accounts automatically. Both are available on the ServOrbit Marketplace.",{"id":99,"category":10,"question":100,"answer":101,"weight":93},556,"How can I reduce the attack surface of a self-hosted back office against post-authentication CVEs?","Post-authentication CVEs exploit vulnerabilities accessible once logged in: keep your applications up to date as soon as a patch is published, restrict admin interface access by IP or via a reverse proxy with strong authentication, and limit administrator accounts to the strict minimum. Placing a WAF in front of your back office — via Cloudflare or an application proxy — allows known exploitation patterns to be blocked before they reach the application.",{"id":103,"category":10,"question":104,"answer":105,"weight":93},588,"My existing Bitwarden devices work fine, but I cannot log in from a new device — why?","Since Bitwarden client version 2026.4.1, some older encryption APIs are no longer accepted by fresh installations: a new client enforces stricter checks than already-open sessions. Verify that your Vaultwarden instance is up to date (image `vaultwarden\u002Fserver:latest` or a recent pinned version) and that your reverse proxy correctly forwards headers — especially `X-Real-IP` and `X-Forwarded-For`. If the issue persists, open a ticket from your client area and include the Vaultwarden version (`docker inspect vaultwarden | grep -i version`) and the exact error message shown by the client.",{"id":107,"category":10,"question":108,"answer":109,"weight":93},610,"How do I secure access to Docmost or another self-hosted wiki with an SSO proxy (Authelia or Authentik)?","Place a reverse proxy (Traefik or nginx) in front of your Docmost instance and attach Authelia or Authentik as an authentication middleware: every request passes through the SSO login page before reaching the application. With Traefik, add the `forwardAuth` middleware pointing to the Authelia decision endpoint in your labels. With nginx, use `auth_request` toward the verification endpoint. This approach is especially suited to internal documentation tools that do not expose robust native authentication. Authentik is available via the ServOrbit marketplace and supports OIDC, SAML 2.0 and Traefik-compatible forward auth headers.",{"id":111,"category":10,"question":112,"answer":113,"weight":93},626,"How do I migrate Uptime Kuma from v1 to v2 without losing my monitors?","Before migrating, export your SQLite database (`kuma.db`) and store it safely — it is the single source of truth for your monitors and alerts. The v2 changes the database schema: start the new container with the same data volume and Uptime Kuma will run the migrations automatically on first launch. Then verify that every monitor is active and notification channels are working before removing the old instance. The v2 fixes vulnerability CVE-2026-45618 (injection via HTTP headers) — the update is recommended.",{"id":115,"category":10,"question":116,"answer":117,"weight":93},627,"How do I connect several VPS instances together without opening public ports on each?","A WireGuard-based mesh VPN — such as Netbird or Tailscale — creates an encrypted peer-to-peer network between your VPS instances using outbound connections only; no inbound port is exposed on the public IP. A coordination node (STUN\u002FTURN relay) handles NAT traversal; traffic between machines travels directly peer-to-peer once the tunnel is established. This approach suits database clusters, internal services and CI\u002FCD pipelines that must not be reachable from the internet.",{"id":119,"category":10,"question":120,"answer":121,"weight":93},642,"CVE-2026-45672 (Open WebUI): how do I check whether my instance is vulnerable?","CVE-2026-45672 is a remote code execution vulnerability in Open WebUI affecting versions earlier than 0.6.10: an authenticated attacker can execute arbitrary code on the server via the file processing pipeline. Check your version from the admin interface (Settings > About) or with `docker inspect ghcr.io\u002Fopen-webui\u002Fopen-webui:latest | grep 'version'`. If you are below 0.6.10, update immediately by pulling the new image: `docker compose pull && docker compose up -d`. In the meantime, restrict access to your interface by IP through your reverse proxy. Contact support@servorbit.com for update assistance.",{"id":123,"category":10,"question":124,"answer":125,"weight":93},654,"What happens if I update AnythingLLM using the :latest image instead of a fixed version?","The :latest tag overwrites the embeddings encryption key on every docker pull: IRREVERSIBLE loss of vectorised documents. Always pin a fixed version (e.g. v1.8.x) in docker-compose. Source: issue #5256 github.com\u002FMintplex-Labs\u002Fanything-llm.",{"id":127,"category":10,"question":128,"answer":129,"weight":93},655,"How does Passbolt protect passwords shared between team members?","Passbolt encrypts each entry with the recipient's public GPG key. Neither the server nor the administrator can read passwords without the holder's private key. Encryption is performed in the browser via the Passbolt extension.",{"id":131,"category":10,"question":132,"answer":133,"weight":93},698,"Is my Chatwoot v3 to v4 upgrade exposed to known CVEs, and how do I check before applying?","Before upgrading Chatwoot, review the official changelog and the NVD\u002FCVE database for vulnerabilities in the target version; the v4 branch notably patched flaws in authentication token handling. Fully back up your PostgreSQL database and volumes before any update, then test on a clone before production. If you are unsure about your instance's exposure, open a ticket from your client area or contact support@servorbit.com.",{"id":135,"category":10,"question":136,"answer":137,"weight":93},722,"What's the difference between a free SSL certificate (Let's Encrypt) and a paid one?","**Let's Encrypt (free)**:\n- **DV (Domain Validation)** certificates only: proves you control the domain, not your organization's identity\n- Valid 90 days (automatic renewal via certbot)\n- Recognized by all modern browsers\n- Suitable for the vast majority of websites\n- Wildcard available (via DNS-01): one certificate covers `*.your-domain.com`\n\n**Paid certificates**:\n- **OV (Organization Validation)**: the CA verifies your company's legal existence — visible in certificate details\n- **EV (Extended Validation)**: thorough verification, formerly shown as a green bar in browsers (this indicator was removed from modern browsers in 2019)\n- Valid 1–2 years\n- May include financial guarantees in case of mis-issuance\n\n**For 99% of use cases, Let's Encrypt is sufficient.** EV\u002FOV certificates are useful for internal compliance reasons, contracts with certain partners, or regulated sectors (banks, insurance) that contractually require them.",{"id":139,"category":10,"question":140,"answer":141,"weight":93},742,"How do I monitor CVEs affecting my self-hosted Gitea instance?","Subscribe to Gitea releases on GitHub (github.com\u002Fgo-gitea\u002Fgitea\u002Freleases) and enable notifications for new versions. Each release specifies whether it fixes CVEs and the severity (CVSS). On a ServOrbit VPS, updates are done via `docker compose pull && docker compose up -d` — always back up before any major update.",{"id":143,"category":10,"question":144,"answer":145,"weight":93},754,"How do I safely migrate my team's password manager to a self-hosted solution like Vaultwarden or Passbolt?","Start by exporting an encrypted vault from your current manager, verify its integrity before deleting the original, then deploy Vaultwarden or Passbolt on a dedicated VPS over HTTPS with a valid certificate — Bitwarden clients refuse unencrypted connections. Enable two-factor authentication on all accounts from the first login, schedule the cutover outside working hours, and only revoke access to the old solution once every team member has validated the new one. Our support team can help with TLS configuration at support@servorbit.com.",{"id":147,"category":10,"question":148,"answer":149,"weight":93},773,"How do I detect suspicious SSH connections on my ServOrbit VPS and react quickly?","Check `\u002Fvar\u002Flog\u002Fauth.log` (Debian\u002FUbuntu) for failed login attempts (`Failed password`, `Invalid user`) and successful logins outside your usual hours. The `last` command lists recent SSH sessions with timestamp and source IP. For ongoing monitoring, `fail2ban` automatically blocks IPs that accumulate failures, and you can configure email alerts. If you confirm an unknown login, immediately end the session with `pkill -u \u003Cuser>`, rotate your SSH keys, and open a ticket from your client area.",{"id":151,"category":10,"question":152,"answer":153,"weight":93},812,"Can I self-host software under a BSL or SSPL licence without legal risk if it is for internal use only?","For purely internal use — team, internal projects, no service exposure to third parties — BSL and SSPL generally impose no constraint: neither targets private use. The SSPL restriction triggers when you offer the software as a service to external users (SaaS); the BSL prohibits offering a commercial service that competes with the publisher. If your clients access the tool, consult a lawyer before deploying. Subscribe to GitHub releases of the projects you rely on to detect licence changes at each major version.",{"id":155,"category":10,"question":156,"answer":157,"weight":93},838,"How do I automatically generate and renew a wildcard SSL certificate with Certbot and the DNS-01 challenge for a .ma domain?","The DNS-01 challenge lets you obtain a wildcard certificate (`*.yourdomain.ma`) without exposing an HTTP port: Certbot creates a TXT record `_acme-challenge` in your DNS zone, which Let's Encrypt then verifies. If your domain is managed via Cloudflare, the `certbot-dns-cloudflare` plugin automates this step with a reduced-scope API token (`Zone:DNS:Edit`). Add a cron job or systemd timer to run `certbot renew` and automatically reload nginx after renewal. Test the renewal process early with `--dry-run` before handing it over to the scheduler.",{"id":159,"category":10,"question":160,"answer":161,"weight":93},863,"How do I check whether my PostgreSQL instance is exposed to the Internet and secure it?","By default, PostgreSQL listens on port 5432; if this port is reachable from the Internet, anyone can attempt to connect. Check your exposure with `ss -tlnp | grep 5432` (or `netstat`): if the listening address is `0.0.0.0` or `::`, the service is reachable from outside. To secure it: bind PostgreSQL to `127.0.0.1` in `postgresql.conf` (`listen_addresses = 'localhost'`), block the port with your firewall (`ufw deny 5432`), and only allow remote access via an SSH tunnel or VPN. If you need help hardening your configuration, open a ticket from your client area.",{"id":163,"category":10,"question":164,"answer":165,"weight":93},908,"My Let's Encrypt SSL certificate expires in 10 days and automatic renewal is failing. What should I do?","Start by checking the Certbot logs using the command journalctl -u certbot or by reading the file \u002Fvar\u002Flog\u002Fletsencrypt\u002Fletsencrypt.log to identify the cause of the failure. If you are using the HTTP-01 challenge, verify that port 80 is accessible from outside and that your web server configuration correctly serves the .well-known\u002Facme-challenge\u002F directory. If port 80 is blocked or if you need a wildcard certificate, switch to the DNS-01 challenge using the DNS plugin appropriate for your provider. To force an immediate renewal to test the configuration, use the command certbot renew --force-renewal.",{"id":167,"category":10,"question":168,"answer":169,"weight":93},909,"How do I obtain a wildcard SSL certificate to cover all my subdomains?","A wildcard SSL certificate covers a domain and all its first-level subdomains, for example *.example.com. Let's Encrypt issues wildcard certificates only via the DNS-01 challenge, which requires creating a TXT record in your DNS zone to prove domain ownership. To automate this process, use Certbot with the DNS plugin corresponding to your DNS provider. ZeroSSL is an alternative to Let's Encrypt that also offers free wildcard certificates via the DNS-01 challenge and provides a web interface to facilitate manual issuance.",{"id":171,"category":10,"question":172,"answer":173,"weight":93},930,"How do I renew an expired Let's Encrypt SSL certificate when my domain is behind Cloudflare?","When your domain is proxied by Cloudflare, Certbot's HTTP-01 challenge may fail because Cloudflare responds instead of your server. Use the DNS-01 challenge instead: install the `certbot-dns-cloudflare` plugin, create a Cloudflare API token with `Zone:DNS:Edit` permission, then run `certbot renew --dns-cloudflare --dns-cloudflare-credentials ~\u002Fcloudflare.ini`. Renewal takes place without exposing any port and works even if your server is unreachable from the internet. Remember to automate renewal via a `certbot renew` cron job to avoid future expirations.",{"id":175,"category":10,"question":176,"answer":177,"weight":93},943,"How do I check whether my SSL certificate is correctly installed and find out its expiry date?","You can verify the installation and expiry date of your SSL certificate directly in your browser: click the padlock in the address bar, then on 'Connection is secure' to display certificate details (issuer, covered domain, validity). Online tools such as SSL Labs (ssllabs.com\u002Fssltest) or check-host.net also allow an in-depth analysis (certificate chain, algorithms, compatibility). If the certificate is managed automatically by ServOrbit (Let's Encrypt), renewal is handled without any action required on your part.",{"id":179,"category":10,"question":180,"answer":181,"weight":93},964,"CVE-2026-82329 affects JFrog Artifactory: how do I check if my instance is vulnerable and apply the fix?","This CVE targets self-hosted Artifactory instances that expose certain REST endpoints without authentication. Check your installed version (Administration → System → General Configuration) and apply the patch from the official JFrog release notes. In the meantime, block public access to the admin port (8081\u002F8082) via your ServOrbit VPS or dedicated server firewall, and disable anonymous access in Artifactory security settings.",{"id":183,"category":10,"question":184,"answer":185,"weight":93},979,"Can Docker Secrets be used without Docker Swarm to protect credentials in production on a VPS?","Yes, since Docker Compose v2.24, Docker Secrets are natively supported without Swarm. You declare a secrets block in your docker-compose.yml referencing a local file: Docker mounts the secret as a temporary file at \u002Frun\u002Fsecrets\u002F\u003Cname> inside the container, without exposing it in environment variables or docker inspect. This is the recommended method for protecting API keys, database passwords or tokens on a root VPS. See our guide on Docker Secrets in production for exact commands and the limits of each approach.",{"id":187,"category":10,"question":188,"answer":189,"weight":93},980,"How do I encrypt sensitive environment variables in a docker-compose.yml in production?","Three approaches are available on a root VPS: Docker Secrets (files mounted at \u002Frun\u002Fsecrets\u002F, no Swarm required since Compose v2.24), .env.vault with the dotenvx tool which encrypts the .env file and only exposes the DOTENV_KEY decryption key, and SOPS which encrypts values in a YAML or .env file using an age or AWS KMS key. In all cases, the plain .env file must never be committed to Git. See our Docker Secrets in production guide for commands and the real limits of each method.",{"id":191,"category":10,"question":192,"answer":193,"weight":93},1012,"What is CVE-2026-87902 WordPress and how do I know if my site is affected?","CVE-2026-87902 is a Remote Code Execution (RCE) vulnerability found in WordPress versions prior to 7.1.2. If your site runs an older version, it may be at risk. Check your current version in your WordPress dashboard under Dashboard → Updates. To stay protected, update to WordPress 7.1.2 or higher immediately through your ServOrbit panel or directly from the WordPress admin.",{"id":195,"category":10,"question":196,"answer":197,"weight":93},1017,"How do I protect my VPS from automated scans and bots after a WordPress CVE?","After a CVE is published, automated bots scan exposed servers en masse. On your ServOrbit VPS, enable the built-in firewall to block suspicious IP ranges, update WordPress immediately, and consider adding the Imunify360 license, available as an option, which provides an application firewall. Also put your site behind Cloudflare in proxied mode to benefit from DDoS protection and additional application-level filtering. Our support team can help you with the setup.",{"id":199,"category":10,"question":200,"answer":201,"weight":93},1030,"How do I check whether my Dokploy instance is affected by the critical CVEs in version 0.29.x, and how do I fix it?","Dokploy 0.29.x was affected by several critical CVEs allowing privilege escalation and remote code execution via the Docker API. To check your version, SSH into the server and run `dokploy --version` or check the admin interface. If you are on 0.29.x, update immediately using `curl -sSL https:\u002F\u002Fdokploy.com\u002Finstall.sh | sh` or follow the official release notes. While waiting for the update, restrict access to the interface port (default 3000) to your trusted IPs via your VPS firewall.",{"id":203,"category":10,"question":204,"answer":205,"weight":93},1045,"Can unattended-upgrades automatically restart my VPS after a kernel patch?","Yes, `unattended-upgrades` can trigger an automatic reboot after installing a kernel patch if the `Unattended-Upgrade::Automatic-Reboot` option is enabled in `\u002Fetc\u002Fapt\u002Fapt.conf.d\u002F50unattended-upgrades`. By default, this option is disabled to avoid unplanned downtime. You can set a fixed reboot time with `Unattended-Upgrade::Automatic-Reboot-Time`, allowing you to schedule restarts outside peak hours. For critical production environments, many administrators prefer to leave this option disabled and handle reboots manually, using `needrestart` to determine whether a reboot is actually required.",{"id":207,"category":10,"question":208,"answer":209,"weight":93},1046,"How do you verify that automatic security updates are working on Debian\u002FUbuntu?","Several methods confirm that `unattended-upgrades` is working correctly. The log file `\u002Fvar\u002Flog\u002Funattended-upgrades\u002Funattended-upgrades.log` lists packages installed during recent runs. The command `unattended-upgrades --dry-run --debug` simulates an execution without making any changes and shows what would be updated. The file `\u002Fvar\u002Flog\u002Fdpkg.log` records every package installation with its timestamp. On recent systems, `systemctl status unattended-upgrades` shows the service state. Finally, `apt-get -s upgrade` combined with filtering for security packages (`unattended-upgrade -d`) lets you verify that no critical update is pending.",{"id":211,"category":10,"question":212,"answer":213,"weight":93},1093,"Does the SSL certificate automatically cover a subdomain I add to my ServOrbit hosting?","Yes, provided the subdomain is created via cPanel and its DNS record points to your hosting server. Let's Encrypt then issues a certificate for that subdomain within minutes of the addition, without any action on your part. If the subdomain is hosted elsewhere or not resolved in DNS, no certificate can be issued automatically.",{"id":215,"category":10,"question":216,"answer":217,"weight":93},1100,"How do I secure Qdrant with an API key on a ServOrbit VPS?","Qdrant exposes its HTTP interface on port 6333 without authentication by default. On a ServOrbit VPS, combine three measures. First, define an API key in the Qdrant configuration by adding `api_key: your-secret-key` to `config\u002Fproduction.yaml` or using the environment variable `QDRANT__SERVICE__API_KEY`. Every request must then include the header `api-key: your-secret-key`. Second, restrict network access to port 6333 with UFW: allow only the IPs of your applications (application server, ingestion pipeline) and block everything else. Third, never expose Qdrant directly on the internet without a TLS reverse proxy: put an nginx vhost in front with a Let's Encrypt certificate and forward HTTPS connections to local port 6333. The ServOrbit template for Qdrant integrates these three measures by default. For any questions about network configuration, contact support@servorbit.com.",{"id":219,"category":10,"question":220,"answer":221,"weight":93},1168,"How do I implement a GDPR-compliant cookie consent policy on my site hosted with ServOrbit?","Cookie compliance — consent banner, blocking third-party scripts before acceptance, and consent records — is your responsibility as the site publisher, regardless of the hosting provider. ServOrbit supplies the secure infrastructure (HTTPS, account isolation, backups) but does not manage your frontend scripts. You can integrate an open-source solution such as Klaro or Cookie Consent on your hosting or VPS, or engage a developer. For any technical question about your hosting configuration, open a ticket from your client area.",{"id":223,"category":10,"question":224,"answer":225,"weight":93},1180,"What is the difference between a mesh VPN (Headscale\u002FTailscale) and a classic VPN like OpenVPN or WireGuard in server mode?","A classic VPN centralizes all traffic through a gateway server: each client connects to the server, which redistributes to the others. A mesh VPN (Tailscale\u002FHeadscale) creates direct encrypted tunnels between each peer using the WireGuard protocol, without routing traffic through a central node. The result is lower latency and higher resilience, at the cost of more distributed key management. Headscale is the self-hostable version of the Tailscale coordination server.",{"id":227,"category":10,"question":228,"answer":229,"weight":93},1182,"Does NIS2 require an SSL\u002FTLS certificate on my self-hosted Jira or Confluence instance?","NIS2 Article 21 mandates proportionate security measures including encryption of data in transit, making a valid TLS certificate mandatory for any self-hosted instance exposed to the Internet. On ServOrbit, each VPS can obtain a free Let's Encrypt certificate through our interface or directly via Certbot. An expired or self-signed certificate does not satisfy NIS2 requirements and exposes your organisation to non-compliance.",{"id":231,"category":10,"question":232,"answer":233,"weight":93},1197,"Can Zitadel act as an OIDC provider to protect access to multiple self-hosted applications on the same VPS?","Yes, Zitadel is designed precisely for this use case: you can create a single Zitadel project and register multiple applications (OIDC clients) within it, each corresponding to one of the self-hosted applications you want to protect. Each application gets its own client ID and secret, with distinct role and scope boundaries, ensuring fine-grained access isolation. Zitadel can be self-hosted on the same ServOrbit VPS behind Traefik, assigned a dedicated subdomain with automatically managed TLS certificates. OIDC-compatible applications (Gitea, Portainer, Grafana, n8n…) can be configured in minutes by adding the Zitadel provider URL and client credentials. Plan for at least 2 GB of RAM for a comfortable Zitadel instance if it runs alongside other services on the same host.",{"id":235,"category":10,"question":236,"answer":237,"weight":93},1200,"How do I deploy Wazuh SIEM on a ServOrbit VPS to monitor my servers in real time?","Wazuh is an open-source SIEM\u002FXDR platform you can install on a ServOrbit VPS (recommended: 4 vCPU, 8 GB RAM minimum). The Wazuh manager centralises alerts from agents deployed on each monitored server; the built-in OpenSearch Dashboards give you a real-time view of security events. ServOrbit offers Wazuh in its marketplace for one-click deployment; for manual installation or configuration assistance, contact support@servorbit.com.",{"id":239,"category":10,"question":240,"answer":241,"weight":93},1206,"Is an SSL certificate mandatory to operate a .ma domain website in compliance with ANRT requirements?","ANRT does not require an SSL certificate as a registration condition for .ma domains, but HTTPS is a de facto requirement imposed by modern browsers and search engines, which flag or downrank unencrypted pages. All ServOrbit hosting plans include a free, automatically renewed Let's Encrypt certificate. For stricter compliance needs (GDPR, NIS2 or sector-specific obligations), OV or EV certificates can be installed on request — reach us via \u003Ca href=\"\u002Fen\u002Fcontact\">our contact form\u003C\u002Fa>.",{"id":243,"category":10,"question":244,"answer":245,"weight":93},1209,"What happens if a Docker container enters a crash loop and my Uptime Kuma instance is outdated?","A crash loop (CrashLoopBackOff) causes the container to restart at increasing intervals: a 'ping container' probe may then alternate between 'up' and 'down' without triggering an alert if the confirmation threshold is too low. Uptime Kuma v2 improved detection of intermediate states compared to v1 — keeping your instance up to date reduces this risk. For critical services, complement the availability probe with an HTTP healthcheck on a real application endpoint, which checks the container's internal state rather than just its startup.",{"id":247,"category":10,"question":248,"answer":249,"weight":93},1216,"Can I use a single Pocket ID server to protect several self-hosted applications on my VPS?","Yes. Pocket ID is an OIDC\u002FOAuth 2.0 provider: register each application as a separate client in its admin interface (client ID + redirect URI), and your users authenticate once to access all compatible OIDC apps. This centralised SSO architecture is particularly effective for protecting a set of services on the same VPS or across several ServOrbit servers sharing a common authentication subdomain.",{"id":251,"category":10,"question":252,"answer":253,"weight":93},1262,"As a Moroccan company, can I get an OV or EV SSL certificate displaying my company name?","Yes, OV (Organization Validation) and EV (Extended Validation) SSL certificates are available at ServOrbit for Moroccan companies with a valid RC or ICE number. These certificates display your company name in the certificate details, increasing visitor trust, especially for e-commerce sites or financial portals. The validation process requires providing official documents (trade register, articles of association); allow 3 to 5 business days. Contact us at support@servorbit.com to start the process.",{"id":255,"category":10,"question":256,"answer":257,"weight":93},1317,"My server shows an older nginx version than the fixed release: is it necessarily vulnerable?","Not necessarily. Debian, Ubuntu, AlmaLinux and Rocky Linux backport security fixes into the version they package without changing the upstream number: only the package suffix changes, and the number shown by `nginx -v` is not enough to conclude. Look for the announced CVE identifier in the changelog of the installed package (`apt changelog nginx` on Debian or Ubuntu, `rpm -q --changelog nginx` on AlmaLinux or Rocky Linux), or check your distribution's security tracker — the same method applies to OpenSSH. On web or reseller hosting, this check is our responsibility; on a VPS or a dedicated server, it is yours.",{"id":259,"category":10,"question":260,"answer":261,"weight":93},1325,"After a remote code execution flaw in my web framework, is updating enough?","The update closes the flaw, but it does not tell you whether it was exploited beforehand. If your application was exposed to the Internet during the vulnerability window, treat the secrets stored on the server (API keys, database passwords, environment file) as possibly read and renew them, then review your access logs. If you suspect a compromise, open a ticket from your customer area.",{"id":263,"category":10,"question":264,"answer":265,"weight":93},1438,"A WordPress plugin on my site is reported as vulnerable and has no fix: what should I do?","Do not just wait: a vulnerable plugin with no fix remains an open door. Make a backup, then deactivate and delete the plugin (simple deactivation often leaves its files in place) and replace it with an equivalent, maintained extension. If the site stayed exposed, look for recently modified files and unknown administrator accounts, and restore a clean backup if you find any. The WordPress manager in your cPanel (WP Toolkit) and support@servorbit.com can help you check the state of the site.",{"id":267,"category":10,"question":268,"answer":269,"weight":93},1455,"Which SSL\u002FTLS mode should I pick in Cloudflare in front of a client site, and why does « Flexible » cause a redirect loop?","Pick « Full (strict) » as soon as your server presents a valid certificate: Cloudflare then also encrypts the leg to the origin and checks its certificate. In « Flexible », Cloudflare contacts the origin over HTTP; if the origin redirects HTTP to HTTPS, the request goes round in circles and the browser shows « too many redirects ». The « Full » mode without « strict » accepts a self-signed or expired certificate: keep it for troubleshooting only. Set the mode before enabling the proxy, then test the site after each change.",{"id":271,"category":10,"question":272,"answer":273,"weight":93},1465,"Does my host update my CMS and plugins for me?","On web hosting, the server and the system are the host's responsibility, but the content of your site remains yours: the CMS, themes, extensions and the PHP version chosen for each domain. These are what most announced CMS vulnerabilities target, rather than the server. The WordPress manager in cPanel (WP Toolkit) shows you the available updates; apply them after a backup. If you have doubts about the state of your site, write to support@servorbit.com.",{"id":275,"category":10,"question":276,"answer":277,"weight":93},1470,"Why does my site show “certificate verify failed” when it calls an external API over HTTPS?","Your server cannot verify the identity of the service it is calling. The most common causes are an old `ca-certificates` package, an incomplete or expired certificate chain on the service side, a hostname missing from the certificate, or a skewed server clock. Test with `openssl s_client -connect api.example.com:443 -servername api.example.com` and read the “Verify return code” line. Never turn verification off to make the call go through: fix the cause.",{"id":279,"category":10,"question":280,"answer":281,"weight":93},1496,"I updated OpenSSH on my server: how do I know the service is using the new version?","Updating the package does not replace the running daemon: `sshd` must be restarted (`sudo systemctl restart ssh` on Debian and Ubuntu, `rc-service sshd restart` on Alpine). To see what it announces, run `nc -w 2 localhost 22 \u003C \u002Fdev\u002Fnull | head -1`: the banner shows the version that is running. On Debian and Ubuntu, this version may stay old even though the fix is installed, because the distribution backports fixes: check the package changelog instead.",[283,288,293,297,302,307,312,316,320,325,329,334,339,344],{"slug":284,"urlSlug":284,"slugs":285,"label":286,"count":287},"domaines",{"fr":284,"en":284,"ar":284,"es":284},"Domains",88,{"slug":289,"urlSlug":289,"slugs":290,"label":291,"count":292},"hebergement",{"fr":289,"en":289,"ar":289,"es":289},"Web Hosting",99,{"slug":294,"urlSlug":294,"slugs":295,"label":296,"count":25},"emails",{"fr":294,"en":294,"ar":294,"es":294},"Professional Email",{"slug":298,"urlSlug":298,"slugs":299,"label":300,"count":301},"revendeur",{"fr":298,"en":298,"ar":298,"es":298},"Reseller",33,{"slug":303,"urlSlug":303,"slugs":304,"label":305,"count":306},"vps",{"fr":303,"en":303,"ar":303,"es":303},"Cloud VPS",195,{"slug":308,"urlSlug":308,"slugs":309,"label":310,"count":311},"dedicated",{"fr":308,"en":308,"ar":308,"es":308},"Dedicated Servers",46,{"slug":10,"urlSlug":10,"slugs":313,"label":314,"count":315},{"fr":10,"en":10,"ar":10,"es":10},"SSL & Security",64,{"slug":317,"urlSlug":317,"slugs":318,"label":319,"count":40},"sauvegardes",{"fr":317,"en":317,"ar":317,"es":317},"Backups",{"slug":321,"urlSlug":321,"slugs":322,"label":323,"count":324},"migration",{"fr":321,"en":321,"ar":321,"es":321},"Migration",67,{"slug":326,"urlSlug":326,"slugs":327,"label":328,"count":9},"paiement",{"fr":326,"en":326,"ar":326,"es":326},"Payment & Billing",{"slug":330,"urlSlug":330,"slugs":331,"label":332,"count":333},"compte",{"fr":330,"en":330,"ar":330,"es":330},"Account & Client Area",43,{"slug":335,"urlSlug":335,"slugs":336,"label":337,"count":338},"marketplace",{"fr":335,"en":335,"ar":335,"es":335},"Marketplace",625,{"slug":340,"urlSlug":340,"slugs":341,"label":342,"count":343},"support",{"fr":340,"en":340,"ar":340,"es":340},"Support",42,{"slug":345,"urlSlug":345,"slugs":346,"label":347,"count":20},"general",{"fr":345,"en":345,"ar":345,"es":345},"General",{"slug":10,"urlSlug":10,"slugs":349,"label":314,"count":315},{"fr":10,"en":10,"ar":10,"es":10},true,1794271195482]