So Outside Technology Security CMS
AnQiCMS
Online Demonstration

When starting a site with a container image, should the default port and background address be changed together?

📅 2026-11-01 👁️ 0

When starting a station with a container image, you do not need to change both the default port and the background address at the same time. These two things solve different problems. The prerequisite for changing the default port is that it is directly exposed to the public network; if the site is placed after the reverse proxy, as long as the container listens to port 8001 and matches in the proxy mapping, the public network access goes through the port listened to by the proxy, changing the default port will make the deployment description inconsistent with the official document. What needs to be considered is the exposure of the background address, as well as whether the built-in protection is enabled.

Should the default port be changed?

In three cases. Providing services directly to the public network, the container port is the public port, and it has a certain significance to change the default value at this time, but the significance is limited - the port can be scanned. What truly determines security is the authentication and rate limiting at the back-end entry. Placed after Nginx or Caddy reverse proxy, the port accessed by users is the proxy port, and the container port is only visible within the internal network. Keeping the default value is more convenient, and it is easier to troubleshoot and debug when there is one less place for customization. When multiple sites share a machine, the port allocation should be in table form, and changing the default value is easy to leave inconsistent records on machines.

The point of judgment is 'whether this port can be directly connected externally'. Only if it can be directly connected should we discuss whether to change it or not, and if not, we should first confirm the mapping and firewall.

How to view the port after reverse proxying?

The three items must be confirmed one by one. Whether the target address and port of the proxy forwarding point to the container, whether the address changes after the container is rebuilt; whether the visitor's real IP is transmitted to the application through the forwarding header, which affects the accuracy of traffic shaping and logging; whether the site address and the links in the generated content are output according to the external domain name, otherwise the preview in the background is normal, but the front-end resource path is with the internal network address.

After modification, it must be verified once from the external network instead of testing within the container. Use the HTTP client to go through the homepage, article page, and backend login page from the public network, and all three paths are accessible before the port link is considered properly configured.

How to restrict the exposure surface of the backend address

The back-end entry address is not about hiding, but about limiting the reachable range: restrict the addresses outside the office exit according to the source IP, and block them at the proxy layer;The login authentication, captcha, and rate limiting have been enabled. AnQiCMS's technology stack is GoLang with Iris framework, GORM, built-in JWT authentication, content sensitive word filtering, and anti-crawling interference code, used to prevent SQL injection and XSS attacks;The form can integrate reCAPTCHA verification code to prevent robots, and there are options such as disabling selection, copying, and right-clicking in the access restriction configuration. The default states of these switches are different, and it is more effective to confirm each item after the site is launched than to change the address.

High-risk capabilities are converged by domain. Backup, upgrade, and multi-site operations of this kind of full-site operation are closed by default on the interface side, and need to be explicitly enabled - narrow the exposure range according to the intent domain, which is more practical than opening them all and praying that no one calls them.

How to choose among several deployment methods

The Baota panel and aaPanel can be deployed with one click, suitable for system administrators not familiar with command lines; LNMP command deployment is suitable for old projects with existing standard environments; Docker image anqicms/anqicms is suitable for sites that require consistent environments and can be reconstructed, with upgrades and rollbacks being done at the level of images. The methods are different, and the points where configuration items are applied are different: changing the configuration file in the container requires rebuilding the image or mounting a volume, and changing it in the panel is the site settings, do not mix the two sets of cognition.

Checklist for protection before going online

Go through this list: Data and static file backups are configured and can be restored (backups and restores are the premise of rollback); SMTP and email notifications are available, and someone can receive site events in case of emergencies; sensitive word filtering and content review are enabled; backend login authentication and captcha are effective; traffic throttling thresholds are set according to real traffic; high-risk interface domains remain closed. Finally, verify once from the external network whether the backend address is only accessible as needed.

Common questions

Is it safer to change the default port?Limited. The port will be scanned, and security depends on backend authentication, throttling, and exposure range; changing the port in a direct connection scenario only reduces noise.

Can localhost be used for verification inside the container?It cannot replace external network verification, issues with forwarding headers, domain names, and certificates are only exposed on public network paths.

Will the configuration be lost during image upgrade?It depends on whether the configuration and data are mounted outside the container, write a clear mount list and verify it once before going live to ensure recovery.

Related articles

How to plan the column structure and classification for a single backend to manage multiple sites without conflict

When managing multiple sites with a single backend, the place where column structure and classification are most likely to interfere with each other is when reusable definitions and isolated data are mixed together. This article explains by separating the shared layer and the isolation layer: the definition of the content model can be reused across multiple sites, the classification tree, column aliases, and visibility range should be planned independently for each site, batch operations at the whole-site level are disabled by default and explicitly enabled per site, and a landing sequence and a corresponding table are provided.

2026-11-01

Can deleted articles be retrieved, and how are drafts, pending publication, and recycling stations divided?

Deleted articles can usually be retrieved: In the AnQiCMS backend, deleting formal documents is not a physical deletion, but moving them to the recycle bin, from which they can be restored. Each of the four document statuses has its own boundaries - formal documents are visible to the public, drafts are only in the background and preview links contain the preview tag, pending publication waits for the set time to take effect, and the recycle bin accommodates deleted content. This article explains the appropriate operations for each and the safe sequence for bulk cleaning.

2026-11-01

How to import articles from the old station table once, if the fields do not match

The order of handling the mismatch of fields when importing the exported table of the old station to the new system is: first select the channel and then discuss mapping, the three columns of fixed title, alias, and category must be mapped, then determine the default value strategy for custom fields, and finally use title search to check if it already exists to avoid repeated imports and sample check the import results

2026-11-01

For articles sent at scheduled times, should the page cache be refreshed again?

Set the article for timed publishing to be released on time, and check whether the main content page, list and home page cache, and sitemap are in sync. Static generation and state transition are two steps, the cache of the list page is often behind the detail page, and the new address also needs to enter the sitemap and cooperate with link push, so that the timed publishing can truly be seen.

2026-11-01

Several thousand articles need to be moved, should it be imported using a compressed package or a table?

When moving thousands of articles, the basis for choosing between compressed package import and table import is not the quantity but the material form: batch import using ZIP compression packages for text with attachments and rich text, and batch import using Excel tables for neatly organized fields. First align the content model and custom fields, and then use the import interface for title duplication check to control duplicates, and only the failed batches can be safely rerun.

2026-11-01

When the sitemap exceeds the limit, it can only be split into files, and before splitting, you need to clear which type of address.

The site map exceeds the single file limit and must be split into multiple files using an index file for aggregation, but before splitting, it is necessary to clean up three types of addresses: pages with error status codes, redirect addresses, and pages with屏蔽 marks that are written into the map. The cleaning order is wrong, and the each file after splitting is still wasting crawling quota, the collection efficiency will not improve.

2026-11-01

The active push protocol is only supported by a few search engines, does another one count as a push?

The active push protocol informs search engines about which URLs have changed, requests priority crawling, but only a few participate. The one that does not participate will not change the crawling and inclusion judgment just because you have sent a notification. You need to separate discovery and inclusion, follow the engine's分流 actions, let the sitemap be responsible for the bottom line, push for incremental, and then use each result to check whether it has really entered the index after the push.

2026-11-01

The page shows that it has been crawled but not indexed, is it a broken link or a quality demotion?

Being crawled means the crawling link is working, and not being indexed is often the result of quality judgment: the system may reduce the number of indexed pages when it is worried about the quality of the entire site. The handling is in order, first分流batch pages by subject, then decide to rewrite, merge, or withdraw, while cleaning up the low-quality content collected, converging the repeated carrying pages and anchor text in the keyword library, and finally resubmitting and keeping a record for observation.

2026-11-01