How to set up a separate domain for AnQiCMS backend to enhance security?

In the daily operation of the website, security is always our top priority.AnQiCMS is a content management system designed with security in mind, which, while providing efficient and convenient services, also leaves us space to further strengthen the security line.Among other things, setting up a separate domain for the AnQiCMS backend is a simple yet extremely effective security enhancement strategy.Today, let's delve deeply into the value of this approach and its specific implementation steps.

Why do you need to set a separate domain for AnQiCMS backend?

By default, AnQiCMS backend usually goes through the main domain under/system/such as the pathyourdomain.com/system/This pattern is convenient, but it also brings some potential security risks. By configuring an independent domain for the backend (for exampleadmin.yourdomain.com), we can gain multiple security advantages:

first, Enhance the stealthiness of the back-end entrySeparate the back-end address from the main site domain, which can effectively prevent potential attackers from guessing or discovering the back-end entry by scanning the main site directory.admin.yourdomain.com/system/This form, compared to directly probing under the main domain name, adds an additional layer of protection, reducing the risk of the background being maliciously accessed.

secondly,Achieving more refined access control.. A separate backend domain allows us to apply stricter access restrictions to the web server (such as Nginx, Apache) or firewall.For example, you can only allow access from specific IP address rangesadmin.yourdomain.comThus, the attack surface is minimized. Even if the main site domain is detected with a vulnerability for some reason, the back-end system can also receive additional protection due to its independent access strategy.

Moreover,Easy to implement independent SSL/TLS encryption. Although the main site usually also deploys HTTPS, configuring a dedicated SSL certificate for the background independent domain can further ensure the security of data transmission during background management, preventing sensitive information (such as login credentials, operational data) from being intercepted or tampered with during transmission.This not only meets modern network security standards, but also enhances the operation staff's trust in the back-end environment.

Finally,Enhance professionalism and management convenience. Have a dedicated backend domain name, which not only looks more professional visually but also facilitates the team's internal recognition and memory of the backend management entry, avoiding confusion with front-end operations.Under the multi-site management scenario, each site has an independent backend domain, which also makes the management structure clearer.

How to configure an independent domain for AnQiCMS backend: A practical guide

AnQiCMS added the feature of 'support for custom backend domain name function, enhanced backend protection' in version v2.1.1, which provides official support for us to achieve the above security goals.Here are the specific configuration steps:

Step 1: Register and parse a dedicated backend domain

You need to choose a suitable subdomain for the backend, such asadmin.yourdomain.com/manage.yourdomain.comEven it can be a new domain name that is completely different from the main site.After selecting, go to your domain registrar or DNS service provider to add an A record for this new domain and point it to the IP address of your AnQiCMS server.Ensure that DNS resolution takes effect, which usually takes a few minutes to several hours.

Step 2: Configure reverse proxy of web server

AnQiCMS as a Go language application typically runs on a specific port (by default is8001We need to set up a reverse proxy through a web server like Nginx or Apache so that the external domain can access this port.

For example, using Nginx, you need to add a block for your background domain in the Nginx configuration file.serverOr add a new one in the existing main domain configuration.locationBlock to handle this subdomain, forward all requests to the port where AnQiCMS is running. A basic Nginx configuration snippet might look like this: admin.yourdomain.comA basic Nginx configuration snippet might look like this:

server {
    listen 80; # 监听HTTP请求
    server_name admin.yourdomain.com; # 你的后台域名

    # 强烈建议在此处配置HTTPS，并将HTTP请求重定向到HTTPS
    # listen 443 ssl;
    # server_name admin.yourdomain.com;
    # ssl_certificate /path/to/your/admin.yourdomain.com.pem;
    # ssl_certificate_key /path/to/your/admin.yourdomain.com.key;
    # return 301 https://$host$request_uri; # HTTP强制跳转HTTPS

    location / {
        proxy_pass https://en.anqicms.com; # 将请求转发到AnQiCMS的运行端口
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

If you are using panel management tools such as Baota Panel, 1Panel, or aaPanel, these tools usually provide an intuitive reverse proxy setting interface. For example, in the Baota Panel, go to 'Website' -> 'Reverse Proxy' and add your backend domain, setting the target URL tohttps://en.anqicms.comAs soon as it is done, please restart the Nginx or Apache service to make the configuration effective.

Step 3: Go to the AnQiCMS backend to make the settings.

After completing the domain name resolution and reverse proxy configuration of the web server, we still need to tell the system where its new home is in the AnQiCMS backend.

Log in to the AnQiCMS backend (you may still need to access it through the original main domain)/system/Access the path once), navigate to the "Global Function Settings" page under "Backend Settings" (refer tohelp-setting-system.mdDocument). Here, you will find an option named "Backend Domain Address". Enter your newly configured independent domain name in this field, for examplehttps://admin.yourdomain.com.

Important reminder:Enter the backend domain address, it is strongly recommended to use it directlyhttps://The full URL at the beginning, even if your server is not fully configured with SSL, it should be preset to enable HTTPS.Because once the SSL configuration is complete, you will always access the back-end through an encrypted connection, and AnQiCMS will also generate the correct link accordingly.

Step 4: Enable HTTPS encrypted connection (strongly recommended)

Although we mentioned SSL configuration in the second step, we emphasize its importance again.Applying and installing an SSL certificate for your independent domain backend is a crucial step in enhancing security.You can obtain a free certificate through Let's Encrypt, most server management panels provide a dummy application and deployment function.Enable HTTPS and make sure your web server is configured to redirect all HTTP requests to HTTPS.

How to verify after the configuration is completed?

After everything is set up, try entering the new backend domain you have configured in the browser, for examplehttps://admin.yourdomain.com/system/(or any custom path you set). If everything goes well, you should be able to access the AnQiCMS admin login interface normally. At the same time, try accessing the originalyourdomain.com/system/Path, observe whether it is redirected to a new domain name or blocked by the web server, which depends on your specific Nginx/Apache configuration. For security reasons, it is recommended to keep the original/system/Redirect the path to a new domain or block access directly to avoid exposure.

By following these steps, your AnQiCMS backend will run in a safer and more concealed environment, protecting your website operations.Security is not achieved overnight, but is a continuous optimization process. Setting up a separate domain for the background is an important link in this process.

Frequently Asked Questions (FAQ)

Q1: After setting up a separate domain for the background, does it mean that the front-end website and the back-end website must be deployed on different servers?

A1:It is not necessarily. Setting up an independent domain for the AnQiCMS background is mainly to distinguish access entry and strengthen access control strategies, and the front-end and back-end can still be deployed on the same server.The usual practice is to use the reverse proxy feature of a web server (such as Nginx) to directadmin.yourdomain.comThe request is forwarded to a specific port running inside AnQiCMS (default is 8001), and foryourdomain.comThe request points to the AnQiCMS front-end service. In this way, they share the same server resources physically, but achieve separation in the logical access level.

**Q2: After configuring a separate domain name, under the original main domain `/system/