Learn how to upgrade your Ghost CMS to the latest version and implement robust security measures to protect your website from threats.
Prerequisites
Before starting the update process, ensure you:
Have SSH access to your server
Are using MySQL in production and running Ghost version 3.0.0 or higher
Have the latest Node.js version (Node v18 Hydrogen LTS is currently recommended)
Update Process
1. Server Preparation First, update your system packages:
sudo apt update
sudo apt upgrade
2. Backup Creation Navigate to your Ghost installation directory and create a backup:
cd /var/www/ghost
ghost backup
3. Ghost-CLI Update Update the Ghost-CLI tool to the latest version:
sudo npm install -g ghost-cli@latest
4. Update Ghost Execute the update command:
ghost update
5. Post-Update Check Run the doctor command to verify the installation:
ghost doctor
Troubleshooting
Common Database Error Fix If you encounter "ECONNREFUSED ::1:3306" error after updating:
Open your config.production.js file
Change the database host from localhost to 127.0.0.1
Restart Ghost
Update Recovery Options
Important Notes
Always create a backup before updating
Update to the latest minor version before attempting a major version upgrade
If running an older version (pre-3.0.0), a full reinstall is recommended rather than an update
Consider using tmux to protect the upgrade process from SSH disconnections
What are the common issues faced during a Ghost CMS update
Node.js Compatibility Issues
The most frequent issue is Node.js version incompatibility. Ghost requires specific Node.js versions for different releases - currently Node v18 Hydrogen LTS is recommended. When upgrading Ghost, you may encounter errors if your Node.js version doesn't meet the requirements.
Database Connection Problems
After updating Node.js, users commonly encounter the "ECONNREFUSED ::1:3306" error because Node v18 prefers IPv6 over IPv4. This can be resolved by changing the database host from localhost to 127.0.0.1 in the config.production.js file.
Version Jump Restrictions
Ghost enforces a structured update path across major versions:
You must update to the latest minor version before jumping to a new major version
Direct updates across major versions are not allowed
For example, updating from v3.x to v4.x requires first updating to the latest v3.x release
System Resource Issues
Memory constraints are a primary cause of update failures. Insufficient RAM or swap space can cause the update process to fail.
Post-Update Troubleshooting
Common issues after updates include:
Theme compatibility problems with new Ghost versions
Layout inconsistencies across devices
Missing or broken post components
Featured image display issues
Recovery Options
If update problems occur, you can:
Use ghost update --force to force retry an update
Use ghost update --rollback to revert to the previous version
Run ghost doctor to check for system issues
Restore from the backup created before the update
How can I ensure my Ghost CMS installation is secure after an update
Core Security Checks
SSL Configuration
Verify SSL certificates are properly configured and active
Ensure the config.production.js file uses HTTPS in the URL settings
Restart Ghost after making SSL-related changes
Authentication Security
Implement strong password requirements and update existing passwords
Enable brute force protection (5 login attempts per hour per IP)
Verify two-factor authentication is working if enabled
Server-Level Security
Permission Settings
Confirm Ghost is not running as root user
Verify directory permissions follow OWASP standards
Check file ownership and access rights
NGINX Configuration Add these security headers to your NGINX configuration:
add_header X-XSS-Protection "1; mode=block";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options nosniff;
Database Security
Verify database connection settings are correct
Change database host from localhost to 127.0.0.1 if using Node v18
Ensure proper data validation and serialization is in place
Post-Update Validation
Run ghost doctor to verify installation integrity
Monitor logs for suspicious activity
Test all admin functionality
Verify content security policies are working
Check that all uploaded files have proper symlink protection
Here are the essential security headers to implement in your NGINX configuration for Ghost CMS:
add_header Strict-Transport-Security "max-age=31536000";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "no-referrer";
add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";
proxy_hide_header X-Powered-By;
HSTS (Strict-Transport-Security) Forces browsers to use HTTPS connections for enhanced security.
Content Protection
X-Content-Type-Options prevents MIME-type sniffing
X-Frame-Options protects against clickjacking attempts
X-XSS-Protection helps prevent cross-site scripting attacks
Privacy Enhancement
Referrer-Policy controls information shared in HTTP headers
Permissions-Policy restricts access to browser features
Removing X-Powered-By hides technology information from potential attackers
Additional Security Measures
Server Information Protection Add this to your nginx.conf file:
server_tokens off;
This configuration prevents NGINX from displaying version information in server responses.
How do I rollback to a previous version if the Ghost CMS update fails
Ghost CMS provides multiple ways to handle failed updates and rollback to a previous stable version:
Automatic Rollback
The simplest method is to use the built-in rollback command:
ghost update --rollback
This command reverts Ghost to the previous stable version.
Force Update Retry
Before attempting a rollback, you can try forcing the update to run again:
ghost update --force
This attempts to retry the failed update process.
Manual Recovery Steps
1. Check Version Directory
Use ghost ls to locate your Ghost installation directory
Verify that previous versions exist in the versions folder
Only the last 2 versions are kept by default
2. Database Restoration If the automatic rollback fails:
Navigate to your Ghost content directory
Restore the previous database backup
Ensure database permissions are correct
Prevention Measures
Before Updating Create a backup using:
ghost backup
Version Management
Keep at least one previous stable version
Update to the latest minor version before attempting major version upgrades
Ensure you have sufficient disk space for version storage
Important Notes
The rollback feature requires at least one previous version to be available
Database changes may need manual intervention during rollback
If rollback fails, you may need to restore from your backup
Always test updates on a staging environment first
