# General Security Options

https://docs.wisecp.com/es/general-security-options

The Settings tab covers the admin panel's own protections. Here you set its access address, cookie scope, trusted proxies, iframe protection and the password rules your clients must follow.

## Opening the Screen

In the left menu, click **Settings**, then **Security**. The screen opens on this tab by default; if another tab is active, click **Settings** in the tab row.

Address: `{admin}/settings/security?general=settings`

## What Is on the Screen

The tab holds a single form. Near the top are the admin access path, an optional IP allowlist for the panel, the cookie domain and the list of trusted proxies. Below that sits a switch for iframe clickjacking protection. A Password Security block follows it, grouping four related controls: password length, allowed special characters, the automatic reset cycle and a Force Password Reset button. One **Save Changes** button at the bottom saves the whole tab.

## Fields

- **Admin Access Path**: Required. Shows the folder name your panel currently uses. Changing it moves the panel to a new address. It cannot be left empty or set to **admin**, and it cannot match a folder that already exists.
- **Admin Area IP Restriction**: Optional. Empty by default (no restriction). The check runs only on the sign-in, sign-out, forgot-password and reset-password pages. Other admin requests never recheck it. An already-open session keeps working from any address until it needs one of those pages again. Do not use it if your own IP address is not static.
- **Cookie Domain**: Optional. Empty by default, which keeps a session valid only on the host that started it. Enter a shared parent domain (such as **example.com**) to sign a visitor in across every subdomain this installation serves. The value must be this site's own domain or a parent of it.
- **Trusted Proxies**: Optional. Ships with **127.0.0.1, ::1**. One address or CIDR range per line. Only add an entry if the site truly sits behind another proxy or load balancer. Cloudflare's ranges are trusted automatically and do not belong here.
- **Iframe Clickjacking Protection**: On by default. Stops malicious sites from showing your site inside their own page to trick visitors. Turning it off lifts that protection from the rest of the site, and a warning appears next to the switch to say so. Sign-in, password and confirmation pages stay protected either way.
- **Whitelist**: Shown only while Iframe Clickjacking Protection is on. Lists the sites you trust to display your site inside an iframe, one per line.
- **Password Length**: Required. Default: 12. The minimum number of characters a client password must have.
- **Special Characters**: Required. Default: **+ - * _**. At least one of the listed characters must appear in a client password.
- **Password Reset Cycle**: Required. Default: 3 months. Forces clients to change their password once this many months have passed. Enter 0 to turn the cycle off.

## Tasks

### Forcing a Password Reset for All Clients

1. Open the **Settings** tab and scroll to the Password Security block.
2. Click **Force Now** next to Force Password Reset.
3. Confirm by clicking **Yes, go ahead** in the dialog.

Every client password is invalidated, every client is signed out, and each one must set a new password at their next sign-in.

## Things to Watch

> **Force Password Reset affects every client at once**
> 
> Use it only after a suspected data breach. A password leaked on another platform may also be in use on your system, and this closes that door for everyone at once. It cannot be undone.

> **Changing the Cookie Domain signs everyone out**
> 
> Saving a new value ends every open session once, including your own. You will need to sign in again afterward.

> **List only your own proxies**
> 
> An address added to Trusted Proxies by mistake can claim to be any visitor's real IP address. Add an entry only if the site genuinely sits behind it.

## Required Privileges

Viewing and saving this tab, and using Force Password Reset, need the **SECURITY_SETTINGS** privilege.

## Related Articles

- [Security Settings Overview](https://docs.wisecp.com/en/security-settings-overview)
- [Authentication Security](https://docs.wisecp.com/en/authentication-security)
- [BotShield](https://docs.wisecp.com/en/botshield)