A secure Pterodactyl installation depends on more than the panel login. The web panel, Wings on each node, accounts, backups and your update process each need attention. Use this checklist to review a 1.x installation; check the official documentation for your exact version before changing production settings.
Patch the Panel and Wings
Check the Panel releases and Wings releases separately. A current panel does not imply current node software. The Panel 1.15.2 release is a security update, while Wings has its own release history and advisories. Plan a maintenance window, make backups and follow the version-specific update instructions. Our 1.15 update guide covers the panel workflow.
For Wings, record the version on every node, compare it with the compatible release for your panel and read the official Wings upgrade guide. In particular, do not assume a security fix for Wings is included when you update only the panel.
Require two-factor authentication
In the admin area, enable the setting that requires two-factor authentication for users if that fits your operation. Start with administrators, then communicate the change to customers before enforcing it more broadly. The Pterodactyl configuration guide documents the panel's 2FA requirement and an account-recovery command. Keep recovery access limited to trusted administrators and verify your recovery procedure before making 2FA mandatory.
Keep a tested offsite backup
Pterodactyl's default Wings backup driver stores server backups locally on the node. That is useful for restoring a server file, but it does not protect you if the node or its disk is lost. The official backup configuration also supports S3-compatible remote storage. Record where panel database backups and server backups live; they are separate things.
Set a schedule, restrict storage credentials, keep more than one restore point and perform a test restore. If you change the backup driver, retain settings needed to access backups created with the previous driver until you no longer need them. A successful upload is not proof that a restore works.
Review access and integrations
Remove unused admin accounts and API keys, keep billing integrations scoped to what they need, and review logs after an unexpected login or server action. When you upgrade the panel or change its API, test automatic provisioning and suspension on a staging installation. For major-version changes, see the Pterodactyl v2 preparation guide.