So Outside Technology Security CMS
AnQiCMS
Online Demonstration

Does the content system listen to port 8001 by default, and should it be changed when deploying reverse proxy?

📅 2026-11-01 👁️ 0

The content system listens on port 8001 by default, should it be changed when the reverse proxy goes online? The conclusion is to decide according to the access path, not by habit. When there is a reverse proxy in front, there is no need to change the program port to 80 or 443, keep it as 8001 for clarity: the proxy is responsible for external protocols and certificates, and the program is responsible for the application itself. The place that needs to be changed is in the proxy configuration and site address settings, pointing the forwarding target to the local 8001, and ensuring that 8001 is not directly accessible on the public network. When there is no proxy in front, it is necessary to handle standard ports at the entry layer.

Why is it recommended to keep the program port?

There are two practical benefits to retaining the original port. One is that the configuration does not change during upgrades and rollbacks; when deploying Docker images, the port mapping is written in the orchestration, and changing the program to listen on the port will also change the mapping and health checks. The other is that troubleshooting is clear, and it is easy to distinguish between the proxy layer and the application layer when problems occur. AnQiCMS supports deployment with Baota panel, aaPanel, LNMP command deployment, and Docker image in several ways, and the default port is 8001. It is more in line with the layered habit to entrust the proxy to the entry layer in all paths.

Three items to be changed on the proxy side

The first item is the forwarding target and protocol, forwarding the domain name resolution to port 80 and 443 to the local application port, and terminating the certificate at the proxy layer. The second item is the site access address setting, the site address in the background should be written as the external domain name instead of the address with the application port, otherwise the generated links, image paths, and push addresses will all include the port number. The third item is the transmission of real visitor information, passing the visitor address and protocol header to the application to avoid the proxy address being all in the log, and to prevent data collection and access statistics from obtaining incorrect sources.

Should the port be open to the outside?

This is the real security issue with this configuration. The application port should only listen internally, and only the standard port used by the proxy should be opened on the public side. After going online, try accessing the address with the application port directly from the outside once, and if it can be opened, it means the boundary has not been tightened, and the public entry of this port should be turned off in the firewall or security group. The same is true for the background entry, and the management path should also be confirmed to ensure that it has not been exposed directly without going through the proxy.

How to check static resources and pseudo-static resources

The most common two types of exceptions after modifying the proxy are image path and address redirection. Static resources need to be confirmed to use the external domain name, and the path should remain consistent after backup and recovery; the pseudo-static rules should align with the rewrite order of the proxy layer to avoid the situation where the application has generated a friendly address and the proxy handles it according to another set of rules. Check the order first: open the homepage to see if all resource requests fall under the domain name, then verify the category pages, detail pages, sitemap, and search pages one by one, and finally confirm that the 301 redirect of the old address still works in the proxy layer.

The verification list on the day of launch

Go through five items: External direct access to the application port should not be accessible; Domain name access through proxy is normal and the address does not include a port; Backend login and form submissions for comments and reviews are normal; Sitemap and robots file are accessible; After completing one backup and recovery exercise, confirm that static files are also included in the backup range. Only after all five items pass should traffic be released.

Common questions

Question: Will changing the port affect search engine crawling?Answer: The crawling sees the external domain name and path, as long as the site address is configured correctly and the page links do not include an internal port, it will not affect. On the contrary, including the application port in the link is more likely to cause address inconsistency.

How do I also use the standard port for local debugging?Similarly, add a layer of proxy or use port mapping locally, keep the application port unchanged, and avoid forming two sets of habits between debugging and production configurations.

Can multiple sites share the same application port?You need to distinguish whether it is multiple sites under the same instance or multiple independent instances. In the multi-site scenario, distribution should be done according to the domain name at the entry layer, and independent instances should occupy their respective application ports and be distributed by a proxy.

Related articles

The content system's major version at the end of the year is set for December 8, how to arrange the upgrade window for hosted sites

The end-of-year major version is set to be around December 8th, and the upgrade window needs to be arranged in three layers: first, confirm whether there are any must-now-be-fixed security patches for the current period, then leave the major version for the rollback period during the business low-peak time, and finally allocate time for panel restart and dependency readiness for the托管 environment. The sequence is wrong, which may lead to the situation where security items are delayed and no one handles them during the holiday.

2026-11-01

The PHP branch only has two years of active support, how should the site's runtime environment upgrade be scheduled?

The PHP official policy is to provide full support for each branch starting from the stable version, and then handle only critical security issues as needed for the next two years. According to the deadline on the current page, 8.2 to December 31, 2026, 8.3 to the same year in 2027, 8.4 to 2028, 8.5 to 2029. The site scheduling should separate these two stages and leave at least one complete regression cycle, and do not wait until the patch stops before starting.

2026-11-01

How should the arrangement of multi-language for cross-border e-commerce websites, and the steps of full page translation and language switching be arranged?

The order should be to define the site structure first, then translate the content, and finally configure the switch entry. The structure selection determines all subsequent work: whether it is a multilingual site or a site segmented by market, it directly affects the domain, content, and maintenance boundaries. The full-page HTML translation can cover the text, but template copy, glossary, and product attributes need to be reviewed separately; the switch entry should be released only after the language version can be verified to avoid visitors switching to a half-translated page.

2026-11-01

After the PHP version enters the stage of only fixing security issues, when should the site be upgraded at the latest?

The PHP official policy is to actively support each branch for two years, and then add two more years for fixing only critical security issues. For example, the active support for 8.2 ends on December 31, 2024, and the security support extends to December 31, 2026; the security support for 8.3, 8.4, and 8.5 respectively ends at the end of 2027, 2028, and 2029. The bottom line for a site completing a major version upgrade is the end date of the security support for that branch, and it is a safe practice to start scheduling after entering the security-only stage.

2026-11-01

There are two ways to deploy: one-click panel deployment and image deployment. After going online, check which items first.

The projects to be checked after the one-click deployment of Baota panel and Docker image deployment are the same, just in a different order. First, confirm that the service is running on the default port 8001, reverse proxy the domain, then check if the backend can log in, and then make a full backup and try a recovery on the day of going live, and finally check if the navigation and email reminders take effect in the new environment.

2026-11-01

When the website cannot be opened, which part of the background troubleshooting ability should be checked first

When the website cannot be opened, which part of the background troubleshooting ability should be checked? Determine which layer the request is broken at first according to the process and port, reverse proxy and certificate, data and file three segments, and then configure. The AI Chat intelligent dialogue on AnQiCMS backend can locate the link in a question-and-answer manner, covering the skills of site health check and fault exclusion, which can list the items that can be checked into a list; a recoverable point should be left before making changes.

2026-11-01

How to split the index file when the site map entries reach the upper limit.

When the site map entries reach the limit, the approach is to divide the addresses into multiple slice files by category or time, and then list them with an index file. According to the information checked on the day, the limit for a single file is 50,000 addresses and an uncompressed volume of 50MB, and it needs to be split if exceeded. The index file only assumes the responsibility of the directory, does not directly list the page addresses, and new content after splitting still needs to be actively pushed to accelerate discovery.

2026-11-01

How to supplement the missing content in the package when migrating from another content system

When migrating sites, the exported files usually only cover the main content and some metadata. The body of attachments and custom content types generated by plugins are often missing. The method to make up for this is to first move the media directory separately, then use the content model and custom fields to take over the missing fields, and finally use batch import to fill in the content by category, use 301 redirect rules to converge historical addresses, and avoid the appearance of a large number of invalid pages.

2026-11-01