> For the complete documentation index, see [llms.txt](https://www.one.thezero.club/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.one.thezero.club/guide/securing-your-website.md).

# Securing Your Website

Before applying the recommendations below, we highly recommend reading Kirby's official security guide, which covers server configuration, deployment best practices, authentication, and other important security considerations:

* [Kirby Security Guide](https://getkirby.com/docs/guide/security)

In this section, we'll focus on practical security improvements that can help protect your website beyond the default Kirby installation.

{% hint style="info" %}
**Note:** The examples below require changes to your Kirby `config.php` file. If you're unsure where to place these options, please read our [**Config Options Guide**](https://www.one.thezero.club/guide/installation/config-options) first.
{% endhint %}

***

### Hide Your Kirby Panel URL

One of the easiest and most effective security improvements is to hide the default Kirby Panel URL.

By default, the administration panel is accessible via `/panel`. Since this is common knowledge, automated bots and malicious actors frequently scan websites looking for this endpoint.

While changing the Panel URL does not replace proper authentication and security practices, it significantly reduces unwanted login attempts. It helps obscure the fact that your website is powered by Kirby.

Kirby allows you to move the Panel to a custom URL of your choice. For example:

{% code title="site/config/config.your-domain.com.php" %}

```php
return [
    'panel' => [
        'slug' => 'your-secret-login'
    ],
    
    // The rest of your config options
];
```

{% endcode %}

With this configuration, the Panel would be available at:

```
https://your-domain.com/your-secret-login
```

You can learn more about this option in the official Kirby documentation:

* [Move the Panel to a Different URL](https://getkirby.com/docs/reference/system/options/panel#move-the-panel-to-a-different-url)

{% hint style="info" %}
**Security tip:** Choose a unique and non-obvious Panel URL and avoid using common alternatives such as `/admin`, `/dashboard`, `/login`, or `/cms`.
{% endhint %}

By simply changing the Panel URL, you make your website a less obvious target for automated attacks while maintaining the same functionality and user experience for administrators.

***

### Change the Session Cookie Name

Even after moving your Panel to a custom URL, there is one small detail that can still reveal your website is powered by Kirby.

When a user logs in to the Panel, Kirby creates a session cookie. By default, this cookie contains a Kirby-specific name that can be seen in browser developer tools.

This is not a security vulnerability, but changing the cookie name is an additional hardening measure that helps reduce information disclosure and makes it less obvious which CMS powers your website.

#### Recommended Configuration

{% code title="site/config/config.your-domain.com.php" %}

```php
return [

    'session' => [
        'cookieName' => 'zeroone_session'
    ],

    // The rest of your config options

];
```

{% endcode %}

You can replace `zeroone_session` with any unique name you prefer.

#### Why Change It?

Most automated attacks start by identifying the technologies used on a website. While changing the session cookie name won't stop a determined attacker, it removes another small clue that your website is running Kirby.

{% hint style="info" %}
Learn more about session options in [official Kirby documentation](https://getkirby.com/docs/reference/system/options/session).
{% endhint %}

***

### Set Unique Content Salt and Cookie Key

Kirby recommends setting secure random values for both the `content.salt` and `cookie.key` options. While your website will work without them, configuring these values improves security and ensures that your installation uses unique cryptographic secrets.

#### Why Is This Important?

Every Kirby website should have its own unique security keys.

Using randomly generated values helps Kirby:

* Protect sensitive data.
* Secure cookies and sessions.
* Prevent attackers from predicting or reusing known values.
* Ensure your installation is unique, even when multiple websites are built from the same starter kit or theme.

Think of these values as secret keys that belong only to your website.

#### Add the Keys to Your Configuration

Once you have generated your values, add them to your Kirby configuration:

{% code title="site/config/config.your-domain.com.php" %}

```php
return [

    'content' => [
        'salt' => 'your-random-content-salt'
    ],

    'cookie' => [
        'key' => 'your-random-cookie-key'
    ],

    // The rest of your config options

];
```

{% endcode %}

#### How to Generate Secure Values

The easiest way to create these values is to use a password manager that includes a password generator. Most modern password managers can generate long, random, and highly secure strings that are perfect for this purpose.

Examples include:

* 1Password
* Bitwarden
* LastPass
* KeePass
* Apple Passwords
* Google Password Manager

Generate two different random strings with a length of at least 32 characters and use them as your `content.salt` and `cookie.key` values.

For example:

{% code title="site/config/config.your-domain.com.php" %}

```php
return [

    'content' => [
        'salt' => '4yA!mN8xq#zK2sLp7VdR9fGt3QwB5hJc'
    ],

    'cookie' => [
        'key' => 'X9rF$wLm2Pq8KzN7tGh4VcY1jDs6AbEe'
    ],

    // The rest of your config options

];
```

{% endcode %}

{% hint style="danger" %}
**Important:** These example values are for demonstration purposes only. Never copy them directly. Always generate your own unique values.
{% endhint %}

#### Do I Need to Change These Values Later?

In most cases, you only need to generate these values once when setting up the website.

However, if you believe your configuration has been exposed or compromised, generating new values is a sensible security measure. Keep in mind that changing security keys may invalidate existing user sessions and cookies.

***

### Harden Authentication Settings

Kirby's authentication system includes a number of options that can help protect your website from unauthorized access. While the default settings are already secure, you may want to make them even stricter depending on your security requirements.

A complete overview of available options can be found in the official Kirby documentation:

* [Kirby Authentication Options](https://getkirby.com/docs/reference/system/options/auth)

#### Limit Failed Login Attempts

One of the most effective ways to reduce the risk of brute-force attacks is to limit how many times a user can enter an incorrect password before being temporarily blocked.

For example:

{% code title="site/config/config.your-domain.com.php" %}

```php
return [

    'auth' => [
        'methods' => ['password'],
        'challenge' => [
            'timeout' => 1800 // 30 minutes
        ]
    ],

    // The rest of your config options

];
```

{% endcode %}

This increases the waiting period after too many failed login attempts, making automated attacks significantly less practical.

#### Passwordless Login

Kirby also supports passwordless authentication methods such as login codes and magic links. Depending on your workflow, these methods can offer an additional security benefit by reducing reliance on traditional passwords.

However, every project has different requirements, so we recommend reviewing the available authentication options and enabling only those that fit your needs.

{% hint style="info" %}
**Security tip:** Even with strong authentication settings, the most important protection is still a unique Panel URL, strong passwords, and secure server configuration. Authentication options should be viewed as an additional layer of security rather than a replacement for good security practices.
{% endhint %}

***

### Disable the Vue Template Compiler

Kirby's Panel includes a Vue template compiler that is primarily intended for advanced plugin development. If you are not actively developing custom Panel plugins that rely on Vue templates at runtime, you can safely disable it.

Disabling the compiler reduces the attack surface of your Kirby installation and follows the security principle of only enabling features that are actually needed.

#### Recommended Configuration

Add the following option to your configuration:

{% code title="site/config/config.your-domain.com.php" %}

```php
return [

    'panel' => [
        'vue' => [
          'compiler' => false
        ]
     ],

    // The rest of your config options

];
```

{% endcode %}

#### Should I Enable This?

For most Zero One users, the answer is **yes**.

If your project uses only the standard Kirby Panel and Zero One features, disabling the Vue compiler is generally a safe and sensible hardening measure.

If you later install a custom Panel plugin that requires runtime Vue template compilation, you can simply change the option back to:

```php
'panel' => [
    'vue' => [
      'compiler' => true
    ]
 ],
```

{% hint style="info" %}
**Security tip:** As a general rule, disable any feature you don't actively use. A smaller attack surface means fewer opportunities for abuse and a more secure website.
{% endhint %}

***

### Disable Debug Mode in Production

This is probably the single most important configuration check.

{% code title="site/config/config.your-domain.com.php" %}

```php
return [

    'debug' => false,

];
```

{% endcode %}

When enabled, debug mode may expose stack traces, file paths, configuration details, and other information that is useful during development but should never be visible on a live website.

{% hint style="info" %}
**Recommendation:** Enable debug mode only on localhost and keep it disabled on staging and production environments.
{% endhint %}

***

### Use Strong Passwords

Even with all security measures in place, weak passwords remain one of the most common security risks.

Every Panel user should use a unique and complex password that is not reused on other websites or services.

#### Recommended Best Practices

* Use a password manager.
* Generate long, random passwords.
* Never reuse passwords across multiple websites.
* Avoid predictable combinations such as names, birthdays or company names.
* Enable two-factor authentication if your workflow supports it.

***

### Remove Unused User Accounts

Over time, websites often accumulate old user accounts belonging to former employees, freelancers, or clients.

Every account with Panel access increases the potential attack surface of your website.

#### Regularly Review Users

We recommend periodically reviewing all Panel users and removing accounts that are no longer needed.

Consider removing:

* Former team members.
* Temporary contractor accounts.
* Test accounts created during development.
* Accounts that have not been used for a long time.

{% hint style="info" %}
**Security tip:** If multiple people need access to the Panel, give each person their own account instead of sharing credentials.
{% endhint %}

***

### Keep Kirby, Plugins, and Zero One Updated

Security is not a one-time task. New vulnerabilities are discovered and fixed over time, which is why keeping your website updated is so important.

Whenever possible, keep the following up to date:

* Kirby CMS
* Zero One
* Third-party plugins
* Server software managed by your hosting provider

#### Why Updates Matter

Updates often include:

* Security fixes
* Bug fixes
* Performance improvements
* Compatibility updates

Postponing updates for months or years can leave your website exposed to issues that have already been fixed in newer releases.

***

### Security Is About Layers

There is no single setting that makes a website completely secure. Instead, security is built from multiple layers working together.

By following the recommendations in this guide, you can significantly improve the security of your website:

* Move the Panel to a custom URL.
* Change session cookie name.
* Configure unique `content.salt` and `cookie.key` values.
* Review Kirby's authentication options.
* Disable the Vue template compiler if you don't need it.
* Disable debug mode in production.
* Use strong passwords.
* Remove unused accounts.
* Keep Kirby, Zero One, and plugins updated.

Combined with the recommendations from Kirby's official security documentation and a properly configured server, these measures will help keep your website secure and resilient against common threats.

{% hint style="info" %}
**Security tip:** Security is often about removing unnecessary clues. If visitors and bots don't immediately know which CMS powers your website, you're already reducing your exposure to targeted automated attacks.
{% endhint %}