Secure your Pterodactyl Panel

An administrator account on a Pterodactyl Panel can create, change and delete every server on every node. This guide goes through the settings and checks that matter most. The names of menus and buttons are those of Panel 1.x.

Require two-step verification for administrators#

1. Turn it on for your own account first: open your account (top right in the panel), and under Two-Step Verification choose Enable Two-Step. Scan the code with an authenticator app and keep the recovery codes somewhere safe.
2. Open the admin area and go to Settings.
3. Under Require 2-Factor Authentication, choose Admin Only (or All Users to require it from everyone).
4. Choose Save.

Every account in the chosen group must now set up two-step verification before it can use the panel.

Check who is an administrator#

1. In the admin area, open Users. Administrators have a star next to their email address.
2. For every administrator you do not expect, open the user and check the Administrator setting. Set it to No if that person should not have admin rights.
3. Remove accounts that are no longer used. A user who still owns servers cannot be deleted: move or delete those servers first.

Check also the Users tab of important servers: subusers listed there can do what their permissions allow on that server.

Check the API keys#

API keys work without a password or two-step verification.

1. In the admin area, open Application API. These keys can manage the whole panel. Delete every key you do not use or do not recognise.
2. Ask your users, and check yourself, under your account at API Credentials: these keys act as that user.
3. Under SSH Keys in an account you can see which keys may log in to SFTP as that user.

When you create a key, give it only what it needs. For an Application API key, set every resource it does not use to None. For a key under API Credentials, fill in Allowed IPs with the addresses that will use it.

Look at the activity log#

Under your account, Activity shows logins and actions on your account. On a server, the Activity tab shows what happened on that server and who did it. Look there when something changed that you did not expect.

Turn off debug mode#

With debug mode on, an error page can show details of your configuration. Check it without showing the rest of .env:

sudo grep '^APP_DEBUG=' /var/www/pterodactyl/.env

It should say APP_DEBUG=false. If not, change it, then run:

cd /var/www/pterodactyl
sudo php artisan config:clear

php artisan p:info also shows Debug Mode in its output.

Keep secrets secret#

• The .env file holds the database password and the APP_KEY. Never share it or paste it in a support chat. Only the web server's user and root should be able to read it.
• /etc/pterodactyl/config.yml on each node holds the node's key. Treat it the same way.
• If a secret may have leaked, change it. For a node key: in the admin area, open Nodes, your node, Settings, tick Reset Daemon Master Key and save. According to the release notes of Wings 1.13.3, newer versions pick up the new key by themselves. With older Wings, copy the new configuration from the node's Configuration tab to /etc/pterodactyl/config.yml and restart Wings.

Close the ports you do not need#

Do not make the database (3306) or Redis (6379) reachable from the internet. Check what listens with sudo ss -tulpn. To set up a firewall, see set up a firewall with ufw; note that ports of game servers are opened by Docker, not by ufw.

Keep everything up to date#

• The panel and Wings: update Pterodactyl Panel and Wings.
• PHP on the panel server: update PHP on Ubuntu or Debian. For the October 2026 PHP vulnerabilities, see PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619.
• The rest of the server: automatic security updates on Ubuntu and Debian.
• SSH on both servers: secure SSH on your server.
• Certificates of the panel and nodes: renew an expired SSL certificate with certbot.

Install addons and themes only from sources you trust: they run with the same rights as the panel.