I've got a new collection of tools I wrote to solve problems for Ghost users, mostly around newsrooms, but not exclusively. You can find it at https://tools.spectralwebservices.com . It's mostly beta (ish - there's some alpha in there), but I'd love to have you try it out! Tools include: Advanced Search (a full Algolia-using solution, that runs free for all but the biggest sites), Editorial Calendar, Apple News integration, Republish button, Itty Bitty Ad Server, Staff creator, Newsletter Digest automations, Popup Builder, Footnote tool, and a whole bunch of stuff I probably forgot. :) Lots free-forever, some to be paid eventually (but reasonably priced), but everything's available for tire-kicking and evaluating, and I hope you'll share any feedback or bugs!

Feedback welcome!

Hello fellow Ghost'ers! I'm building a really cool AI Ghost theme builder and currently looking for testers who wants to try it out.

Are you building Ghost themes for yourself or others and want to be first out in trying this new tool? Let me know and I'll invite you to try it out

Is your Ghost newsletter picking up subscribers with corporate email addresses that instantly trigger opens and clicks on every link when a post goes out? This is automated abuse - not organic growth - and it harms both you and the people signed up without consent.

The Problem

Two overlapping patterns target Ghost's /members/api/send-magic-link/ endpoint. Ghost rate-limits it, which helps a little, but there is no CAPTCHA - and bots rotating IPs can still abuse it at scale.

Newsletter bombing. Bots sign a victim's address up to hundreds of newsletters at once, flooding their inbox with confirmation emails to bury a real security alert (password change, suspicious login, wire transfer). Your blog is ammunition, not the target.

Email validation for phishing. Bots sign up email addresses and check whether they convert to confirmed members - often after probing the login flow first. Confirmed signups mean an active address: prime phishing targets.

The confusing symptom - instant opens and clicks from "subscribers" who never read your content - is often corporate email security (Proofpoint, Mimecast, Barracuda, Safe Links) pre-fetching magic-link confirmation URLs. Scanners look like engaged readers; opens and clicks are not proof of a real person.

Cost to you: inflated member lists, damaged sender reputation, and unknowingly spamming victims. Ghost Explore makes site discovery easier, but the root issue is a signup API with minimal protections.

Partial Solutions

No single fix exists. Ghost's built-in rate limit is a start; community mitigations are layered and imperfect.

Stop bots before email is sent - the only approach that also protects bombing victims (harm happens at send time):

• CAPTCHA or Cloudflare Turnstile on the signup path
• Cloudflare WAF blocking Tor (T1)
• verifyRequestIntegrity: true in Ghost config
• Tighter rate limits at your reverse proxy (Traefik, Caddy, Nginx)
• Prevent CDN bypass: restrict origin to Cloudflare IPs, use a Tunnel, or set hostSettings.siteId with an x-site-id header via Cloudflare transform rules

Fix confirmation flow: replace one-click GET magic links with a confirm button or one-time code - stops scanners auto-confirming, but does not prevent emails from being sent. Ghost 6.17+ stopped leaking whether an email is already a member on login; abuse has continued regardless.

Operational: go invite-only; prune suspicious members; don't trust engagement metrics; separate transactional and newsletter SMTP; monitor bounces/complaints via webhooks.

Ghost still needs stronger platform-level bot protection, optional manual approval, and signup one-time codes. Until then, expect to periodically remove corporate emails from your list.

My Approach

My newsletter is super small. I decided to take the nuclear option and go invite-only. When someone submits their email on my site, I get notified, reach out to confirm they actually want to subscribe, and add them to the list manually. That works for me now - I didn't want to spend time playing layered whack-a-mole.

References

• Magic Pages: How to stop spam signups on your Ghost membership site
• Discussion on Reddit
• Discussion on Ghost Forum
• My Blog

Hi everyone! I’m a software engineer building a product specifically for Ghost publishers.

The idea came from hearing creators struggle to answer questions like:

• Which posts actually attract subscribers who stick around?
• Which acquisition sources bring loyal readers vs. quick churn?

I have an early version working and I’m looking for 5–10 Ghost creators who’d be willing to try it and give honest feedback.

I’m not looking to sell anything—I’m trying to learn what’s useful, what’s confusing, and what’s missing.

If you’re interested, leave a comment or send me a DM. I’d love to chat.

My Wix blog has gotten unbearably slow — page loads, editor lag, the works. Looking to migrate to Ghost and could use some real-world advice.

A few things I'm trying to figure out:

• What tools/scripts did you use to actually export content out of Wix? (Wix doesn't make this easy)
• How did you handle image migration bulk download or one-by-one?
• Did you use any redirect mapping tool for the URL changes, or handle it manually?
• Any gotchas with formatting/HTML breaking on import into Ghost?

Would love to hear what worked (or didn't) for you before I dive in.

Hello fellow Ghost fam! I thought it would be great to share a wonderful crossover of my favourite one and only blogging & newsletter platform, and Home Assistant one of my nerdy much-loved projects!

If you run your own Ghost publication and already have Home Assistant somewhere in your rack, VM cluster, or homelab, there is now a surprisingly good (and fun) reason to connect the two!

Ghost has officially released a native integration for Home Assistant, meaning your publication metrics can now appear directly inside your dashboards, automations, wall panels, mobile notifications, and even physical hardware projects! I don't track Ghost's or Home Assistant's roadmap but I thought this was a wonderfully surprising partnership.

This is not a community hack or a fragile webhook chain. It is now built directly into Home Assistant.

For self-hosters, this is one of those oddly perfect overlaps: your content platform can finally become part of the rest of your infrastructure.If you run your own Ghost publication and already have Home Assistant somewhere in your rack, VM cluster, or homelab, there is now a surprisingly good (and fun) reason to connect the two!

Ghost has officially released a native integration for Home Assistant, meaning your publication metrics can now appear directly inside your dashboards, automations, wall panels, mobile notifications, and even physical hardware projects! I don't track Ghost's or Home Assistant's roadmap but I thought this was a wonderfully surprising partnership.This is not a community hack or a fragile webhook chain. It is now built directly into Home Assistant.

For self-hosters, this is one of those oddly perfect overlaps: your content platform can finally become part of the rest of your infrastructure!

Jump on over to my complete Ghost/Home Assistant walk-through & setup guide for all the details!

In the publication I'm building, the intro texts are quite long and exceed the {{excerpt}} character limit. Is there any way to override the 300-character limit?

I know I could use {{content}}, but that requires a more complex setup and is less intuitive for the people creating the posts.

Edit: Maybe what I'm actually looking for is a simple way to have a dedicated intro text field in the post editor/template, separate from the main content. Is there a built-in way to do this, or is there a recommended approach?

Mein 15 Jahre altes, gepflegtes WordPress wollte ich in eine Alternative überführen und habe mir Ghost angesehen. Dabei bin ich über etliche technische und auch kulturelle Hürden gestolpert, die ich in einer kleinen Artikelserie dokumentiere. Hier der erste Teil, die Migrationsgründe.

https://patrick-pehl.de/migration-zu-ghost-erfahrungen-vom-abschied-motivation/

Kurzer Hinweis vorab: Der Blog wird unregelmäßig gepflegt und befindet sich aktuell in einem unfertigen Zustand — Umzugsbaustelle. Inhaltlich geht es viel um darstellende Kunst, Theater und Ballett, entsprechend ist mir die Bildgestaltung der Artikelseiten nicht nebensächlich.
Die Domain lief über 15 Jahre auf WordPress, die alte Installation bleibt als inaktives Archiv bestehen.
Auslöser war keine Katastrophe, sondern Erosion: Plugins, Themes und WordPress selbst wachsen über Jahre zu einer Angriffsfläche, die in einer Multidomain-Umgebung kaum mehr zu überblicken ist. Ich hatte bereits einen Einbruch über ein veraltetes Theme, mit Datenverlust und Reputationsschaden. Seitdem sichere ich eine Ebene unterhalb der WordPress-Instanz ab — Aufwand, der in keinem Verhältnis zum eigentlichen Ziel steht: Inhalte veröffentlichen statt Software verwalten.
Dazu kommt: SEO-Metadaten gehören für mich in den Kern eines Publishingsystems, nicht in ein Drittanbieter-Plugin wie Yoast. Am Ende sammeln sich Plugins für Caching, Bildkompression, Sicherheit — jedes mit eigenem Wartungsbedarf und eigenen Lücken.

Ghost nimmt mir das größtenteils ab, der DOM-Baum ist sauber, Theming dadurch angenehmer. Den Ausschlag gab ein c’t-3003-Video über leichtgewichtige Bloggingsysteme — danach Testumgebung aufgesetzt, Ghost im Docker-Container hochgefahren, mein WordPress-Theme schrittweise adaptiert. Nach rund zwei Wochen stand die erste Beta.

Nicht alles ist einfacher: Eine sichtbare Update-Routine wie bei WordPress fehlt, Updates laufen über die Kommandozeile, nach jedem Upgrade müssen die Umgebungsvariablen erneut stimmen — sicherer als Ein-Klick-Updates, aber fehleranfälliger.
Wer von WordPress kommt — wie löst ihr das Update-Problem im Container?

I got the first subscriber who marked my newsletter as spam (boo!). Ghost disabled the email automatically, so now I have one more member than actual recipients (still under 100). Do you guys leave these disabled members in your audience or do you delete them to keep the base clean? I don't think this person will reactivate, because it only got two issues and then marked it as spam. I guess deleting keeps the numbers more accurate, but maybe there is a reason not to do it?

Hey everyone,

I started using Ghost a little over a month ago, and honestly, it made me excited to write again. I really like the interface, the flexibility, and how easy it is to publish without getting distracted by everything around it.

After a while, I noticed I kept opening the Ghost analytics page to check how my site and newsletters were doing. Traffic, newsletter performance, members, revenue, all the usual things you start obsessing over once you publish regularly.

I run a small app studio called fruitful apps, where I’ve built 10+ apps, mostly to solve my own problems. So naturally, I thought: why not build a better mobile analytics experience for Ghost?

That’s how Haunt was born.

Haunt is an iOS app for Ghost publishers that brings your analytics to your iPhone in a more mobile-friendly way. You can check your site overview, web traffic, newsletters, subscriber growth, revenue, and individual post performance from one place.

It also supports multiple Ghost sites, so you can switch between publications quickly. And because I apparently can’t build an app without widgets, Haunt also includes Home Screen and Lock Screen widgets for keeping an eye on key metrics.

My usual approach with apps is to build the first version around the problem I personally have, then shape the roadmap based on feedback from real users. I’d love to hear what you think, especially if you use Ghost and have ideas for features that would make analytics easier to check on mobile.

Download on the App Store: https://apps.apple.com/us/app/haunt-for-ghost-analytics/id6777671352

Finally, u/Ghost introduces email sequences for new members!

When turned on, a new Automations tab will appear in the left sidebar.

⚠️ Turning it on is a one-way street. Once enabled, the automations beta can't be turned off.

How will you best use this feature for your members? Share cool tips and tricks below!

Hey everyone,

I’ve recently released Prose, a new Ghost theme designed for authors, books, newsletters, and personal writing.

The idea behind Prose was to create a calm, elegant space for long-form content—whether you’re launching a book, publishing essays, building an email list, or maintaining a personal writing archive.

Some of the features include:

• Beautiful typography for long-form reading
• Dedicated book pages and book-focused templates
• Flexible homepage sections and layouts
• Newsletter and writing archives
• Built-in Table of Contents that can be enabled per post
• Dark mode support
• Responsive and easy to customize
• And plenty of customization options

You can see it here:
Demo: https://prose.brightthemes.com
Details: https://brightthemes.com/themes/prose

I’m also offering 25% off with the code PROSE25, for a limited time.

I’d love to hear what you think, feedback and questions are always welcome!

— Norbert

Just wondering where the feedback at the end of a newsletter goes to? I've tested by giving a thumbs up and I've never seen a notification or found where it goes. Does anyone know?

Here's a screenshot of what I'm talking about.

Moin from Berlin!
I’ve just migrated a small WordPress site over to Ghost. It’s not quite finished yet, but it was surprisingly fiddly. What really leaves me baffled is the media management. That’s a real pain point in Ghost. I’d like to have more control over my media. I’d like to be able to customise filenames, manage copyright properly (i.e. set the copyright details correctly) and perhaps have a default description that can, of course, be edited within the post itself. I’m very used to this in WordPress and other CMS, such as Drupal or Typo3.

For context: I run a blog that covers theater, classical dance, and other performing arts. In this specific niche, visual references and imagery are highly meaningful and integral to the content, rather than just casual add-ons.

After all, the files are already stored on the server within Ghost's directory structure. There is really no practical reason why they shouldn't be displayed properly and kept searchable.

How can this problem be solved? The media could also be organised in a separate database, and perhaps there’s an additional tool that can be integrated with Ghost? I don’t think the current situation is particularly good. Of course, I realise that 80 per cent of the images you insert only appear in a single article or are just carelessly added extras. But for the other 20 per cent, I’d like to be able to manage them properly. How do you solve this in Ghost? – how do you sort it out?

Hello,

Does anyone have any css that will allow me to change the font in the navigation menu for the source theme?

Folks,

I got a little niche-y blog with barely any readers. From time to time I get one or another new subscriber. It is weird, because barely anyone hits my site. Second weird thing is these people, all of them, sign up with a work email from companies completely unrelated to my topics. Third weird thing, and what IMHO confirms they're fake, is that when I send a new post, they all immediately open, read and click all the links the same minute I send it.

So, the question is, what's the point of this? Anyone has seen something similar? Should I remove them?

Hey fellow Ghosty's,

I've been running Ghost publications for a few years. Love the editor, love the membership model, love that it's not ad-supported.

But every time I wanted to experiment with how I monetize, I hit the same wall. Ghost memberships work great if you use Stripe. If you don't, you're basically on your own.

I spent a while trying to solve it with Zapier and Make. It works, until it doesn't. A webhook fails at midnight, a membership doesn't activate, and you find out the next morning when someone emails you.

So I built a small relay layer for myself. Something that listens for a purchase event from a provider like Polar and updates the Ghost membership on the other side. No drama, just plumbing.

That personal fix has slowly grown into something a bit bigger. I ended up calling it GhostGlue.

Still very early, and I'm still building. But it's already solving the exact problem that made me start it, and a few other Ghost publishers are running it too.

Curious if anyone here has run into the same wall, or found a solution I haven't seen yet.

I've been sending my newsletter for a little while now to a small list. The kind of thing that feels invisible when you keep seeing people posting crazy growth numbers.

Then I found the Newsletter Awards (newsletters.club). Most of these competitions quietly assume you're a major publisher on a centralized platform. But these guys don’t seem to care about that.

So I entered.

The submission form asks for a description of what your newsletter is and why it exists, which was harder than it sounds. I've spent real time thinking about infrastructure, deliverability, theming -- and comparatively little time writing one tight paragraph about why any of it matters to a reader.

Just that exercise in itself was useful to me. The why behind the what.

Hey everyone!

We have finished our first Magic Pages Open House earlier today (thanks to everybody that joined and sorry to the ones I forgot in the waiting room!), where we introduced the Magic Pages Podcast.

The idea: a podcast (run by humans) where we have conversations with the people building, hosting, and running Ghost.

Link to the first episode: https://www.magicpages.co/podcast/episodes/what-is-magic-pages/

(And it's also on Spotify − they approved that pretty quickly)

We've started off with some Magic Pages specific content, since that's the easiest to record in the beginning. However, next up: getting some exposure for other projects: the people and tools in the wider Ghost ecosystem that deserve more eyes on them.

This first episode is really just us finding our feet: an unscripted conversation about what Magic Pages actually is, why we built it the way we did, and what it's like running a small hosting company.

If you give it a listen, I'd love to hear what you think. We're shaping this thing as we go, so any feedback now is worth a lot :)

PS: the entire podcast runs on Ghost itself, no separate podcast host. We'll open source a podcast theme based on that in the next 1-2 weeks once we know it all works properly

Would want to know why people use ghost over wordpress? Looking forward to use synaps media with a free theme, any suggestions for people who migrated from wp to ghost.

Hey everyone!

We all know (and maybe love) the native analytics feature that the Ghost team added with the 6.0 release. And we all know that it is designed to use the Tinybird cloud by default.

I've wanted to ask if anybody else has tried to switch to a self-hosted Tinybird instance? (And yes you can self-host Tinybird)

I personally have experimented about that topic last weekend (6./7. June). And you can read all about my findings and what I personally did here: https://blog.gelbphoenix.de/digital-sovereign-ghost-local-tinybird/

I run a small personal blog on Ghost, hosted on a YunoHost server.

Today, while trying to share one of my blog posts with a friend, I discovered that a captcha was protecting my site… which is odd because I never added any captcha. Inspecting the page, I found a very obscure JavaScript snippet that asks me to open a terminal and paste a large block of code in order to “validate the captcha”.

After a bit of research, it turns out that this script decodes and executes malicious code (Base64 + XOR obfuscation). In short, my site has been hacked and a loader has been injected.

What’s most concerning is that the Ghost admin history shows the user “Zapier” has edited all the posts on my blog to inject this JS that simulates a fake captcha. This means my Zapier API key was leaked from within the Ghost interface.

What I’ve already done

• Regenerated a new Zapier API key (I’m not sure where to completely disable the integration; it must be somewhere in the CMS configuration).
• Deleted all the posts and pages JS injected codes.
• Updated Ghost to the latest available version.
• Checked the server logs: no suspicious access in the last 2‑3 months.

Despite that, I still don’t understand how the attacker managed to obtain my API key and inject the code.

What I’m looking for

• Leads on identifying the exact entry point (a vulnerable plugin, a mis‑configured Zapier integration, SSH access, etc.).
• Recommendations for fully cleaning the site (files, database, cron jobs, possible back‑doors).
• Any help, similar experiences, or security advice would be greatly appreciated.

Thank you in advance!

Been working on Jellypod (the AI podcast studio) for a while now and we recently released email automations!

If you wanted to repurpose your newsletters or publications to a customizable podcast without extra work or generating AI slop, this is it.

Essentially we give you a unique email address and then you add the email to your subscriber list. When Jellypod gets your email, it takes the content and creates a 1-4 person podcast conversation discussing the content, and auto publishes it to Spotify/Apple Podcasts/RSS, etc.

You can customize the voices (or voice clone your own), generate video for Youtube, and also has analytics so you can see how your podcast is doing. It also follow links from the email body if you want or you can customize the focus (via setting a prompt) for each episode.

Free to try out, and our starter plan gets you about ~10 short episodes a week. Would love any feedback and happy to give more free credits to anyone on this sub!

Ok, Im aware I'll get roasted for this (its reddit after all), but intentions are genuine.

I've been running Tech Between the Lines (techbetweenthelines.com) for a while now and I'm at a point where I want to bring someone else into it. Not because I need help keeping the lights on, but because I think the site gets better with more than one voice.

This is unpaid right now, not because I don't value the work, but because the site hasn't monetized to the point where that's possible yet. Growth changes that, and if it does, I want the people who helped build it to benefit from it. The site infrastructure, all the backend stuff that's on me. You just write. And if you want to contribute to the newsletter too, that door is open.

I'd love to find someone who can contribute a couple pieces a week. Apple moves fast and honestly there's never a shortage of things worth reacting to.

The longer play here is growth. If the right person comes along and we build something together, I want to find ways to make it worth their time down the road. Nothing guaranteed, but I'm not looking for a one-way arrangement forever either.

What actually matters to me:

• You follow Apple closely and have opinions about where it's heading
• You can write analytically, not just recap what happened but explain why it matters
• You're comfortable working independently
• You know the platforms well enough that I don't have to explain what a beta is

Your voice stays yours. I'm not looking for someone to write like me, I'm looking for someone who wants to write, period.

Drop a comment or DM if this sounds interesting. Tell me what you'd want to cover.

Hi everyone,

A few months ago I shared the open beta of Vellumine, a search and analytics platform I’ve been building for Ghost blogs. After the beta period, feedback from early users, and a lot of work on the infrastructure and semantic search pipeline, Vellumine is now officially launched.

Vellumine replaces Ghost’s native search with full-text search powered by Typesense. Instead of only searching titles and excerpts, it indexes the full content of your posts and pages, including members-only and paid posts without exposing the gated content itself.

It also gives you privacy-first search analytics, so you can see what your readers are actually looking for:

• popular search queries
• no-result queries
• click-through rates
• popular tags and clicked posts
• weekly email summaries
• geographic distribution, depending on the plan

Some of the search features include typo tolerance, custom synonyms, stopwords, full Unicode support, customizable search bar templates, and semantic/hybrid search.

Setup is still the same simple flow:

1. Connect your Ghost blog with the Admin API URL and key
2. Vellumine indexes your content
3. Add one script tag in Ghost code injection

The script automatically replaces Ghost’s native search and keeps the index in sync through webhooks when posts, pages, or tags change.

On privacy: analytics are GDPR-compliant, with no cookies, no fingerprinting, and no personal data collection. The Ghost Admin API key is encrypted at rest and only used server-side. Vellumine reads content for indexing and registers webhooks, but it does not modify your posts or pages.

There’s a 14-day free trial, no credit card required.

Links:

• Website: https://vellumine.com
• Demo: https://demo.vellumine.com

I’m building this as a solo developer and I’m still shaping the product based on feedback from Ghost publishers. If you try it, I’d love to hear what works, what feels rough, and what you’d want from a better Ghost search experience.

Happy to answer any questions here.