General Security Options

96 Aufrufe Markdown

The Settings tab covers the admin panel's own protections. Here you set its access address, cookie scope, trusted proxies, iframe protection and the password rules your clients must follow.

Opening the Screen

In the left menu, click Settings, then Security. The screen opens on this tab by default; if another tab is active, click Settings in the tab row.

Address: {admin}/settings/security?general=settings

What Is on the Screen

The tab holds a single form. Near the top are the admin access path, an optional IP allowlist for the panel, the cookie domain and the list of trusted proxies. Below that sits a switch for iframe clickjacking protection. A Password Security block follows it, grouping four related controls: password length, allowed special characters, the automatic reset cycle and a Force Password Reset button. One Save Changes button at the bottom saves the whole tab.

Fields

Admin Access Path

Required. Shows the folder name your panel currently uses. Changing it moves the panel to a new address. It cannot be left empty or set to admin, and it cannot match a folder that already exists.

Admin Area IP Restriction

Optional. Empty by default (no restriction). The check runs only on the sign-in, sign-out, forgot-password and reset-password pages. Other admin requests never recheck it. An already-open session keeps working from any address until it needs one of those pages again. Do not use it if your own IP address is not static.

Cookie Domain

Optional. Empty by default, which keeps a session valid only on the host that started it. Enter a shared parent domain (such as example.com) to sign a visitor in across every subdomain this installation serves. The value must be this site's own domain or a parent of it.

Trusted Proxies

Optional. Ships with 127.0.0.1, ::1. One address or CIDR range per line. Only add an entry if the site truly sits behind another proxy or load balancer. Cloudflare's ranges are trusted automatically and do not belong here.

Iframe Clickjacking Protection

On by default. Stops malicious sites from showing your site inside their own page to trick visitors.

Whitelist

Shown only while Iframe Clickjacking Protection is on. Lists the sites you trust to display your site inside an iframe, one per line.

Password Length

Required. Default: 12. The minimum number of characters a client password must have.

Special Characters

Required. Default: + - * _. At least one of the listed characters must appear in a client password.

Password Reset Cycle

Required. Default: 3 months. Forces clients to change their password once this many months have passed. Enter 0 to turn the cycle off.

Tasks

Forcing a Password Reset for All Clients

Open the Settings tab and scroll to the Password Security block.
Click Force Now next to Force Password Reset.
Confirm by clicking Yes, go ahead in the dialog.

Every client password is invalidated, every client is signed out, and each one must set a new password at their next sign-in.

Things to Watch

Force Password Reset affects every client at once

Use it only after a suspected data breach. A password leaked on another platform may also be in use on your system, and this closes that door for everyone at once. It cannot be undone.

Changing the Cookie Domain signs everyone out

Saving a new value ends every open session once, including your own. You will need to sign in again afterward.

List only your own proxies

An address added to Trusted Proxies by mistake can claim to be any visitor's real IP address. Add an entry only if the site genuinely sits behind it.

Required Privileges

Viewing and saving this tab, and using Force Password Reset, need the SECURITY_SETTINGS privilege.

War das hilfreich?

Vielen Dank für Ihre Rückmeldung!

Brauchen Sie weitere Hilfe?

Unser Support-Team ist rund um die Uhr für Sie da, wenn Sie oben nicht fündig werden.

Kontakt aufnehmen Ticket eröffnen