Your billing system holds the keys to your whole business: client details, invoices, saved payment methods and the API credentials that control your servers. Blesta has a good security reputation, but a secure product can still be set up loosely. These nine Blesta security steps tighten an install in an afternoon, and most of them take minutes. After the checklist, we cover payment data, server access, email and what to do if something goes wrong.
Why Blesta Security Matters So Much
Most systems in a hosting business hold one thing. Blesta holds everything at once: who your clients are, what they pay, and the API tokens that can create, suspend or delete accounts on your servers. Someone with staff access could cancel services, change payment details or take over client domains. That’s why Blesta security deserves more care than your average web app, and why the steps below focus on the doors attackers really use: stolen passwords, too much access, old software and missing backups.
1. Turn On Two-Factor Authentication for Every Staff Member
A stolen staff password is the most common way into any billing system. Blesta supports two-factor authentication with time-based codes (TOTP) from apps like Google Authenticator, and Blesta’s MFA guide recommends that method. Each staff member turns it on under My Info at the top of the staff area, scans the QR code and confirms with a code and their password. Make it a rule for everyone with staff access. If you do only one Blesta security step today, make it this one.
2. Encourage Clients to Use It Too
Clients can enable two-factor authentication from Manage Account > Authentication in the client area. Mention it in your welcome email and knowledge base. A client whose account is taken over can have their domains and services changed, and you’ll be the one cleaning it up.
3. Give Staff Only the Access They Need
Under Settings > System > Staff, use staff groups to limit what each person can do. Support staff rarely need access to payment gateways, system settings or plugin installs. Remove accounts for anyone who has left, rather than just changing the password.
4. Protect the Encryption Key in config/blesta.php
Blesta encrypts sensitive data, and the key lives in config/blesta.php. Blesta’s guide to moving servers calls it a “very important encryption key”. Two rules follow:
- Keep a copy of that file somewhere safe and offline. A database backup without it isn’t a complete backup.
- Make sure the file isn’t readable by other users on the server, and never commit it to a public code repository. Permissions of 640 or stricter are a sensible target on most shared servers.
5. Keep Uploads and Cache Outside the Web Root
Blesta’s installation guide says to move the uploads directory one level above the public folder, and Blesta 6 puts its cache in cache_blesta/ above it too. Files there can’t be downloaded directly by someone guessing a URL. If you installed with an auto-installer, check where these folders ended up under Settings > System > General.
6. Use HTTPS Everywhere
Your Blesta install should only ever load over HTTPS, with HTTP redirecting to it. A free Let’s Encrypt or AutoSSL certificate is fine. When you connect modules like cPanel, tick the option to use SSL for the API connection, as our Blesta cPanel guide explains.
7. Keep Blesta, PHP and Extensions Updated
Apply Blesta security releases promptly, keep PHP on a supported version, and update plugins and modules when their developers release fixes. Remove extensions you no longer use; an unused plugin is still code that can be attacked. Our Blesta update checklist makes updating routine.
8. Back Up, and Test the Backup
Back up the database daily and the files whenever they change, and keep copies off the server. Once in a while, restore a backup to a test site to prove it actually works. A backup you’ve never restored is a hope, not a plan.
9. Watch the Logs
Blesta records logins, emails, module calls and more under Tools > Logs. Glance at staff logins now and then for times or locations that don’t make sense. For extra protection, Blesta also includes a PHPIDS plugin that watches for suspicious requests.
Strong Passwords and Shared Logins
Two-factor authentication works best on top of strong, unique passwords. Ask every staff member to use a password manager, and never share one staff login between people. Shared logins make the logs useless, because you can’t tell who did what, and they mean a single leaked password exposes everyone’s access. Each person gets their own account, their own password and their own two-factor app. It’s a small habit that makes a big difference to Blesta security.
Blesta Security for One-Person Hosts
If you run the whole business yourself, it’s tempting to skip some of this. Don’t skip the parts that matter most. Turn on two-factor, keep a copy of config/blesta.php and your backups somewhere other than the server, and keep Blesta updated. Store your recovery codes and a short “how to restore” note where a trusted person could find them if you were unavailable. A small business can’t afford a week of downtime any more than a big one can.
Protect Payment Data
The safest card number is one you never store. Where you can, use payment gateways that keep card details on the processor’s side and give Blesta only a token, so a breach of your server can’t expose full card numbers. This also shrinks the work you need to do for PCI compliance. If you do store payment details in Blesta, the encryption key from step 4 becomes even more important, so treat it like the most valuable file you own.
Lock Down Server and API Access
Good Blesta security reaches beyond Blesta itself. Run a firewall on the server, use SSH keys instead of passwords for shell access, and keep the database closed to the outside world. For the API tokens Blesta uses to reach WHM, registrars and other systems, give each token only the permissions it needs and, where the remote system supports it, limit it to your Blesta server’s IP address. Then a leaked token is useless from anywhere else.
Protect Clients From Fake Billing Emails
Scammers love to copy hosting invoices, because clients expect them. Set up SPF, DKIM and DMARC for the domain Blesta sends from, so fake emails using your name are more likely to be blocked. Tell clients in your welcome email that you’ll never ask for their password by email, and keep your invoice emails consistent so anything odd stands out.
Choosing Plugins Safely
Every plugin you install runs with full access to Blesta. Before installing one, check who built it, whether it’s maintained and whether its forms use Blesta’s CSRF protection. Our own Blesta plugins use Blesta’s CSRF tokens on every form, escape everything they display, and in Caddie’s case refuse to fetch private or internal addresses so client tools can’t be used to probe your network.
If You Think Blesta Was Compromised
Move fast, but in order. Put Blesta in maintenance mode so nothing else changes. Reset every staff password and two-factor setup. Rotate the API tokens for your servers, gateways and registrars, because those are what an attacker would want most. Then review the logs, staff list, installed plugins and recently changed files to understand what happened, and contact your host and Blesta support. Restore from a clean backup if files were changed. Afterwards, tell any affected clients plainly what happened and what you’ve done, and check whether your local laws require you to notify anyone. Clients forgive a problem handled openly far more readily than one they discover on their own. Writing this plan down now, while things are calm, is one of the most useful Blesta security habits you can build.
A Quarterly Blesta Security Review
Settings drift over time: people join and leave, plugins pile up, and backups quietly stop working. Put a 30-minute review on your calendar every three months to catch it early:
- Check every staff account still belongs to someone who needs it, and that each has two-factor turned on.
- Remove plugins and modules you no longer use, since every extra extension adds to your Blesta security risk.
- Confirm Blesta, PHP and your extensions are current.
- Restore last night’s backup to a test site.
- Skim the staff login log for anything unexpected.
Frequently Asked Questions
Is Blesta secure?
Blesta has a strong security record and uses well-known, openly reviewed encryption. Most real-world Blesta security problems come from weak passwords, no two-factor authentication, outdated servers or untrusted add-ons, which is what this checklist covers.
Does Blesta security depend on my host?
Partly. Blesta can only be as safe as the server it runs on. Choose a host that keeps PHP and the operating system patched, runs a firewall and offers offsite backups.
Do I need a separate security plugin?
Not usually. The built-in two-factor login and the bundled PHPIDS plugin cover the Blesta side. Most Blesta security gains come from the settings and habits in this guide, plus a well-run server.
Can you help secure our install?
Yes. Get in touch and we’ll go through your Blesta security setup with you.
