# Ghost CMS Upgrade & Security Guide: Enhance Your Website's Safety and Performance Learn how to upgrade your Ghost CMS to the latest version and implement robust security measures to protect your website from threats. --- ## Prerequisites Before starting the update process, ensure you: * Have SSH access to your server * Are using MySQL in production and running Ghost version 3.0.0 or higher * Have the latest Node.js version (Node v18 Hydrogen LTS is currently recommended) --- ## Update Process **1\. Server Preparation** First, update your system packages: ```bash sudo apt update sudo apt upgrade ``` **2\. Backup Creation** Navigate to your Ghost installation directory and create a backup: ```bash cd /var/www/ghost ghost backup ``` **3\. Ghost-CLI Update** Update the Ghost-CLI tool to the latest version: ```bash sudo npm install -g ghost-cli@latest ``` **4\. Update Ghost** Execute the update command: ```bash ghost update ``` **5\. Post-Update Check** Run the doctor command to verify the installation: ```bash ghost doctor ``` --- ## Troubleshooting **Common Database Error Fix** If you encounter "ECONNREFUSED ::1:3306" error after updating: 1. Open your config.production.js file 2. Change the database host from [`localhost`](http://localhost) to `127.0.0.1` 3. Restart Ghost **Update Recovery Options** * To force retry an update: `ghost update --force` * To rollback to previous version: `ghost update --rollback` --- ## Important Notes * Always create a backup before updating * Update to the latest minor version before attempting a major version upgrade * If running an older version (pre-3.0.0), a full reinstall is recommended rather than an update * Consider using tmux to protect the upgrade process from SSH disconnections --- --- ## What are the common issues faced during a Ghost CMS update --- ## Node.js Compatibility Issues The most frequent issue is Node.js version incompatibility. Ghost requires specific Node.js versions for different releases - currently Node v18 Hydrogen LTS is recommended. When upgrading Ghost, you may encounter errors if your Node.js version doesn't meet the requirements. --- ## Database Connection Problems After updating Node.js, users commonly encounter the "ECONNREFUSED ::1:3306" error because Node v18 prefers IPv6 over IPv4. This can be resolved by changing the database host from [`localhost`](http://localhost) to `127.0.0.1` in the config.production.js file. --- ## Version Jump Restrictions Ghost enforces a structured update path across major versions: * You must update to the latest minor version before jumping to a new major version * Direct updates across major versions are not allowed * For example, updating from v3.x to v4.x requires first updating to the latest v3.x release --- ## System Resource Issues Memory constraints are a primary cause of update failures. Insufficient RAM or swap space can cause the update process to fail. --- ## Post-Update Troubleshooting Common issues after updates include: * Theme compatibility problems with new Ghost versions * Layout inconsistencies across devices * Missing or broken post components * Featured image display issues --- ## Recovery Options If update problems occur, you can: * Use `ghost update --force` to force retry an update * Use `ghost update --rollback` to revert to the previous version * Run `ghost doctor` to check for system issues * Restore from the backup created before the update --- --- ## How can I ensure my Ghost CMS installation is secure after an update --- ## Core Security Checks **SSL Configuration** * Verify SSL certificates are properly configured and active * Ensure the config.production.js file uses HTTPS in the URL settings * Restart Ghost after making SSL-related changes --- ## Authentication Security * Implement strong password requirements and update existing passwords * Enable brute force protection (5 login attempts per hour per IP) * Verify two-factor authentication is working if enabled --- ## Server-Level Security **Permission Settings** * Confirm Ghost is not running as root user * Verify directory permissions follow OWASP standards * Check file ownership and access rights **NGINX Configuration** Add these security headers to your NGINX configuration: ```nginx add_header X-XSS-Protection "1; mode=block"; add_header X-Frame-Options "SAMEORIGIN"; add_header X-Content-Type-Options nosniff; ``` --- ## Database Security * Verify database connection settings are correct * Change database host from [`localhost`](http://localhost) to `127.0.0.1` if using Node v18 * Ensure proper data validation and serialization is in place --- ## Post-Update Validation * Run `ghost doctor` to verify installation integrity * Monitor logs for suspicious activity * Test all admin functionality * Verify content security policies are working * Check that all uploaded files have proper symlink protection --- --- ## What are the key security headers I should add to my NGINX configuration for Ghost CMS Here are the essential security headers to implement in your NGINX configuration for Ghost CMS: --- ## Required Headers ```nginx # Security Headers Configuration add_header Strict-Transport-Security "max-age=31536000"; add_header X-Content-Type-Options "nosniff"; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header Referrer-Policy "no-referrer"; add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"; proxy_hide_header X-Powered-By; ``` --- ## Header Functions **HSTS (Strict-Transport-Security)** Forces browsers to use HTTPS connections for enhanced security. **Content Protection** * X-Content-Type-Options prevents MIME-type sniffing * X-Frame-Options protects against clickjacking attempts * X-XSS-Protection helps prevent cross-site scripting attacks **Privacy Enhancement** * Referrer-Policy controls information shared in HTTP headers * Permissions-Policy restricts access to browser features * Removing X-Powered-By hides technology information from potential attackers --- ## Additional Security Measures **Server Information Protection** Add this to your nginx.conf file: ```nginx server_tokens off; ``` This configuration prevents NGINX from displaying version information in server responses. --- --- ## How do I rollback to a previous version if the Ghost CMS update fails Ghost CMS provides multiple ways to handle failed updates and rollback to a previous stable version: --- ## Automatic Rollback The simplest method is to use the built-in rollback command: ```bash ghost update --rollback ``` This command reverts Ghost to the previous stable version. --- ## Force Update Retry Before attempting a rollback, you can try forcing the update to run again: ```bash ghost update --force ``` This attempts to retry the failed update process. --- ## Manual Recovery Steps **1\. Check Version Directory** * Use `ghost ls` to locate your Ghost installation directory * Verify that previous versions exist in the versions folder * Only the last 2 versions are kept by default **2\. Database Restoration** If the automatic rollback fails: * Navigate to your Ghost content directory * Restore the previous database backup * Ensure database permissions are correct --- ## Prevention Measures **Before Updating** Create a backup using: ```bash ghost backup ``` **Version Management** * Keep at least one previous stable version * Update to the latest minor version before attempting major version upgrades * Ensure you have sufficient disk space for version storage --- ## Important Notes * The rollback feature requires at least one previous version to be available * Database changes may need manual intervention during rollback * If rollback fails, you may need to restore from your backup * Always test updates on a staging environment first