Ghost Backup Fails with Device Verification Enabled.

The problem affected ghost backup, preventing some self-hosted Ghost installations from creating backups when staff device verification was enabled.

The error reported in the original issue was HTTP 403 (Forbidden), although other users encountered different HTTP errors. The underlying problem was an authentication incompatibility between Ghost and Ghost-CLI.

The Error

Running the usual backup command may produce an error similar to this:

✖ Backing up site
An error occurred.
Message: 'Response code 500 (Internal Server Error)'

A 403 (Forbidden) response was also reported. The exact error can vary, so check the debug output to help identify the cause.

Why Does It Happen?

In April 2025, Ghost introduced staff device verification, which requires an email verification code when a staff member signs in from a new or unrecognized device. Ghost also introduced an optional setting to require email-based two-factor authentication (2FA) for every staff login. These are separate security features.

The changes exposed an authentication problem in Ghost-CLI's backup process.

The important update: Ghost-CLI subsequently received a fix for this issue. The change was merged on July 21, 2025, introducing token-based authentication for backups on newer Ghost versions. Therefore, disabling device verification should not be your first response to this error.

The Recommended Fix

Before changing your security settings, check your installed versions:

$ ghost version

Update Ghost-CLI using the installation method appropriate for your environment. For a standard npm-based installation:

$ sudo npm install -g ghost-cli@latest

Then, from your Ghost installation directory, retry the backup:

$ ghost backup --verbose

If the problem persists, check the debug output and compare your Ghost and Ghost-CLI versions with the official GitHub issue and its associated fix.

Temporary Workaround: Disable Device Verification

If you cannot update Ghost-CLI immediately and have confirmed that device verification is causing the problem, you can disable this feature on a self-hosted installation.

Edit config.production.json in your Ghost installation directory and add the following setting inside the existing security object:

"security": {
  "staffDeviceVerification": false
}

Important: If your configuration already contains a security object, modify it rather than adding a duplicate. Ensure the JSON remains valid.

Restart Ghost to apply the change:

$ ghost restart

This disables verification codes for logins from new or unrecognized devices. It does not necessarily disable every form of 2FA.

Disabling device verification reduces protection for staff accounts. Treat this as a temporary workaround, not a permanent solution. Restore the setting once you have resolved the underlying issue.

Backups Are Not Optional

Your posts, images, themes, and other publication data represent years of work. Reliable backups are essential for disaster recovery, migration, and protection against data loss.

Security improvements should not disrupt essential administrative workflows. When authentication changes break existing tooling, the solution is to update the tooling—not permanently weaken account security.

We hope this guide helps you troubleshoot Ghost backup failures, understand the impact of staff device verification, and keep your publication secure with reliable backups.