A UniFi controller is the master key to your company network. Whoever controls it can create SSIDs, re-map VLANs, weaken firewall rules and redirect traffic. And yet, in a surprising number of installations, it sits behind a forwarded port on the public internet, managed by a single account with no second factor. This guide walks through what UniFi controller security actually depends on — accounts, ports, remote access, roles, updates — and, just as importantly, what the built-in protections can and cannot do.
Start with the attack surface
Before writing any rules, it helps to be clear about how a controller can be reached at all. There are essentially four routes:
- The UI account — the login you use for the console or for Site Manager.
- The web interface — reachable on the network, and often from the internet via port forwarding.
- Device communication — the channel access points and switches use to report in.
- The host itself — operating system, SSH access and the underlying infrastructure in self-hosted setups.
Each route needs its own answer. A strong password covers exactly one of them.
1. Secure the UI account: MFA is now mandatory
Ubiquiti has already made this decision for you. Since 22 July 2024, all users must enable multi-factor authentication (MFA) on their UI Account. Accounts that had no other method configured by that date were automatically switched to email authentication, with sign-in verification prompts going to the account’s primary email address.
Email as a second factor is better than nothing, but it is the weakest option on offer: compromise the mailbox and you hold both factors. MFA is configured and changed at account.ui.com under My Security.
The available methods
- UI Verify app (iOS/Android) — Ubiquiti’s own recommendation, with single-click approval on your phone.
- Third-party authenticator apps — Google Authenticator, Microsoft Authenticator, Authy and similar.
- Email authentication — the automatic fallback.
- Backup recovery codes — for when the device is gone.
The part people miss
Ubiquiti cannot reset your multi-factor authentication. If you lose access to all of your configured methods, you have to create a new account. For a business network that means something very practical: print the recovery codes or store them in your password manager, configure at least two methods, and never let a single personal phone become the single point of failure for network administration.
2. Open only the ports you actually need
Many installations are far more permissive than necessary — usually because adoption failed once and ports were opened wholesale afterwards. For a self-hosted UniFi Network Server, Ubiquiti lists these ports as the ones to allow through the local firewall:
| Port | Protocol | Purpose |
|---|---|---|
| 8080 | TCP | Device-to-application communication (“inform”) — no adoption without it |
| 8443 | TCP | Network application web interface and API |
| 8843 | TCP | Guest portal over HTTPS |
| 3478 | UDP | STUN — keeps the device/application connection alive |
| 10001 | UDP | Device discovery |
The critical distinction is between the local firewall and the internet. These ports need to be reachable on the host. From the public internet, normally none of them should be — with one exception: if devices adopt from a remote site over layer 3, they need a path to port 8080. Even then, restrict that inbound rule to the known source addresses of your sites instead of allowing the whole internet.
The web interface on 8443, by contrast, has no business being exposed. There are better ways.
3. Remote access: VPN or Site Manager, not port forwarding
Ubiquiti compares the two approaches directly in its own documentation. With a VPN, clients must authenticate before gaining access, all data is encrypted, and the internal network stays hidden from public exposure. With port forwarding, the entire security burden falls on the exposed service, and traffic is not encrypted by default.
For administration alone, the more convenient route is UniFi Site Manager at unifi.ui.com: remote management is enabled by default during setup and can be toggled under Settings > Control Plane > Console. That means admin access needs no inbound firewall rule at all. Our guide to UniFi remote access covers the setup in detail.
One option worth a conscious decision is Direct Remote Connection. It speeds up remote sessions, but it requires a UniFi gateway with a public IP address and TCP port 443 not already assigned to a port forwarding rule. If you do not need it, leave it off.
4. Separate admin roles properly
In smaller environments everyone tends to share one account with full rights. It is convenient — and it makes accountability impossible. UniFi draws a clear line between the Owner, the account that originally set up the console and holds the highest level of access, and additional Admins, who reach the management interface either from Site Manager or directly through the local interface.
A Super Admin has full administrative access to a site and can, among other things, restore backups and configure SSH; a few features in UniFi OS and the mobile app remain exclusive to the Owner. From a security standpoint, Super Admins should be treated as equivalent to Owners — so hand out the role sparingly.
Three rules that hold up in practice:
- Every person gets their own UI account. No shared logins.
- Assign admins only to the sites they are responsible for.
- Contractors and temporary staff get a limited role, not Super Admin — and their access is removed the day they leave.
5. Leave SSH closed by default
There is a difference here that regularly causes confusion: UniFi OS consoles have SSH disabled by default (you enable it under UniFi OS > Console Settings > SSH), while UniFi network devices have SSH enabled by default. Their credentials live under UniFi Network > Settings > Advanced > Device Authentication. The two settings are independent of each other.
Ubiquiti itself recommends SSH only when instructed by support as part of advanced troubleshooting, since ill-considered changes can degrade network performance or break the deployment. In practice: leave console SSH off, set the device authentication password to a random value and store it in your password manager, and never expose SSH to the internet.
6. IDS/IPS — and the truth about DDoS
UniFi gateways include threat detection. An IDS (intrusion detection system) monitors traffic for suspicious activity and alerts administrators; an IPS (intrusion prevention system) additionally blocks what it detects. Detection is signature-based and uses deep packet inspection. In current versions the feature is switched on under Settings > CyberSecure > Protection via Intrusion Prevention, with a choice between “Detect Only” and “Detect and Block” — in the latter mode the source of a detected threat is blocked for 300 seconds.
Two things are worth knowing. First, false positives can be handled deliberately: add signatures to the Signature Suppression table, or put source IPs on the Security Detection Allow List. Second — and this is the more honest message — an IPS is not DDoS protection. Signature-based detection helps against exploits and known attack patterns. A volumetric attack, however, saturates your internet uplink before a single packet reaches the gateway, and no device sitting behind that uplink can do anything about it. Volumetric attacks have to be absorbed upstream, at the ISP or in the data centre.
That is a structural argument for keeping the controller out of the office and in a data centre: it no longer shares a connection with day-to-day business. If the office line goes down, the management plane stays reachable — and vice versa.
7. Updates and backups are part of security
Two unglamorous points that decide how bad a bad day gets. Updates close known vulnerabilities in both the network application and device firmware — a controller that has not been updated in two years is a risk regardless of how good your firewall rules are. And a tested backup is the only answer that still works when something genuinely goes wrong. Our guide to UniFi controller backup and restore covers the mechanics. The key word is tested: a backup you have never restored is an assumption, not a plan.
Quick checklist
- MFA enabled on the UI account, preferably via app rather than email, with recovery codes stored safely.
- Individual accounts per person; Super Admin only where it is genuinely needed.
- No management interface on the internet — remote access via Site Manager or VPN.
- Inbound rules kept to the minimum and, where possible, restricted to known source addresses.
- Console SSH off; device authentication password random and documented.
- Updates applied regularly, backups tested regularly.
Conclusion
Most UniFi security incidents do not come from exotic vulnerabilities. They come from three familiar problems: an account without a second factor, a management interface exposed to the internet, and updates nobody installs. All three can be fixed with the tools already in the box — you just have to do it once properly and then keep at it.
Keeping at it is exactly what we take off your plate. clevendo runs managed UniFi cloud controllers in a German data centre, separated from your office uplink, with maintained updates and regular backups — and without you opening a single inbound port. Get in touch if you want to harden or relocate your installation, or take a look at what we do.
Frequently asked questions
Is MFA mandatory for UniFi?
Yes. Since 22 July 2024 all users must enable multi-factor authentication on their UI Account. Accounts with no method configured were automatically given email authentication. An authenticator app is the better choice.
What happens if I lose my second factor?
Ubiquiti cannot reset MFA. If you lose access to all configured methods, you have to create a new account. That is why you should keep backup recovery codes somewhere safe and configure at least a second method.
Do I need to expose port 8443 to the internet?
No. For administration from outside the office, UniFi Site Manager or a VPN is enough, and neither requires inbound access to the web interface. Port forwarding to the management UI is the riskiest of the available options.
Does UniFi IDS/IPS protect against DDoS attacks?
Not really. IDS/IPS detects threats using signatures and can block sources — for 300 seconds in “Detect and Block” mode. A volumetric DDoS attack saturates the internet uplink before the gateway can intervene at all. Those attacks have to be mitigated upstream, at the provider or in the data centre.
Should I disable SSH on my UniFi devices?
On UniFi OS consoles SSH is off by default — leave it off unless you need it. On UniFi network devices SSH is on by default, so set a strong, random password under Settings > Advanced > Device Authentication. Ubiquiti recommends SSH only for troubleshooting with support anyway.
Isn’t a strong password enough?
No. A password protects exactly one of the four routes into your controller — the account. Open ports, outdated software and over-broad admin rights are untouched by it. Security comes from the combination.
