Security checklist

Once your server has a public address, anyone who finds it reaches your Jellyfin sign-in page, as with any Jellyfin server on the internet. These steps take ten minutes and matter more than anything else.

1. Strong, unique passwords

• Every Jellyfin user needs a password. A user without one can be signed in by anyone who guesses the username.
• Use long passwords (a passphrase of four or more words is good) that aren't used anywhere else.
• Don't share one account among several people: create a user per person (Dashboard → Users).

2. Keep the administrator account at home

1. Use an administrator account with a name that isn't admin or root.
2. For everyday watching, sign in with a normal user, even yourself.
3. In Dashboard → Users, open the administrator, and turn off Allow remote connections to this server. The administrator then only works from your home network.
4. Turn on Hide this user from login screens for the administrator.

3. Limit what each user can do

• Give each user access only to the libraries they need, and leave Allow media deletion off.
• Set Failed login tries before user is locked out to a low number, such as 5.
• Disable or delete users who no longer need access.

4. Keep Jellyfin up to date

Most attacks on Jellyfin servers use known bugs that are already fixed. Update Jellyfin when a new version comes out.

We watch Jellyfin's security advisories. When your version has a known security problem, the plugin page, your account and an email tell you which version to install. For serious problems, servers below the safe version can be blocked from connecting until they are updated; you are told the date in advance.

5. Check your remote-access settings

• Dashboard → Networking → Allow remote connections to this server must be on for Coursier to work. Users with remote connections turned off can still sign in at home.
• If you only want people from certain countries or networks, use Jellyfin's remote IP address filter in the same section. Jellyfin sees each viewer's real address through Coursier, so the filter works.

6. Be careful what you share

• Share the address only with people you invite. If it spreads further than you wanted, change it.
• Never post screenshots that show your address together with a username.

For what the relays already do for you, see What we protect, and what you protect.