Ports 80 and 443 are your shop window. Port 81 is the office where the keys, the safe combination and the alarm code live. Treating them the same is the most common NPM mistake there is.
The NPM admin panel can create hosts, read every internal address you own, and change where your domains point. In the wrong hands it is not one compromised app — it is all of them at once. This page explains why port 81 must never be reachable from the public internet, why the first-login step makes timing critical, and three honest ways to reach the panel safely when you need it.
Public ports serve your finished services to visitors — that is their job, and they are built for strangers. The admin panel is a management tool built for you, protected by a single password. Internet scanners sweep the entire IPv4 space continuously, and an exposed login page collects password attempts around the clock. NPM's login is decent, but no password-only door deserves that exposure when keeping it private costs nothing. Rule of the whole series: publish services, never publish management.
Remember the account setup from the install guide. Older builds shipped with a well-known default login that every public guide prints; newer builds removed it and make the first visitor the administrator. Either design has the same moral: between 'container started' and 'my strong password set', your panel is claimable by whoever reaches it first. If port 81 is already forwarded to the internet during those minutes, you are racing the scanners. Set the admin account up immediately, from your own LAN, before any router forwarding exists.
The simplest pattern: in your router, forward only ports 80 and 443 to the NPM server. Port 81 stays un-forwarded, so the panel answers only inside your home or office network. Most people administer NPM from the same desk the server sits near, and for them this is the complete solution — zero extra tools, zero extra risk. If you ever find yourself 'temporarily' forwarding 81 to fix something from outside, treat that as what it is: opening the safe to the street. Use one of the next two options instead.
You can order Docker to publish the panel only on the server itself by changing the compose line to '127.0.0.1:81:81'. The panel then answers nowhere except the server's own loopback — not even the LAN. To use it from your laptop, open an SSH tunnel: ssh -L 8181:127.0.0.1:81 user@yourserver, then browse to http://localhost:8181. Your traffic rides inside the encrypted SSH connection, and to the internet the panel simply does not exist. This is the professional pattern for rented VPS servers, where there is no trusted LAN at all.
If you regularly manage things from outside, put the server and your phone or laptop on the same private mesh VPN — tools like Tailscale or WireGuard. The panel then answers on the server's private VPN address from anywhere in the world, while remaining invisible to the public internet. This is the most comfortable option for a small office: no forwarded management ports, nothing to tunnel by hand, and the VPN login becomes a second lock in front of the NPM password. Whichever option you chose, finish with the same two habits: a unique strong password on the NPM admin account, and a real email address on it so certificate warnings reach you.
The install in the video gets NPM running; this page keeps it yours. Watch the video for the build, then run the phone test in the red box above.
▶️ Watch Full VideoNot automatically — but change the NPM admin password now, remove the forward, and check the proxy host list for anything you did not create. Treat an exposed management panel as a reason to verify, not to panic.
No. Ports 80 and 443 keep working exactly as before; only the admin panel's reach changes. Your sites never depended on port 81 being public — only your convenience did.
Security by obscurity only. Scanners check thousands of ports, and NPM is easy to fingerprint on any of them. A hidden port slows nobody down; a private port stops everybody. Bind or VPN it instead.