Ghost Staff Logins Expand the Public Attack Surface, Security Review Finds

A Ghost website can serve public pages while also exposing a staff administration login, and the two share infrastructure despite carrying different risks. The article recommends inventorying where the staff path is reachable and checking whether identity controls can handle a compromised or departed staff account. Ghost added device verification and email-based two-factor authentication for staff logins in April 2025, though these depend on a working email path and sound verification procedures. Rotating site authentication in Ghost resets API keys and staff passwords and signs out all sessions, which is a strong but disruptive containment step. The author also advises owned sites to be tested for login, removed users, and key rotation, while warning against probing third-party installations found through search.