General Security Options
The Settings tab covers the admin panel's own protections. Here you set its access address, cookie scope, trusted proxies, iframe protection, website script policy and client password rules.
Opening the Screen
In the left menu, click Settings, then Security. The screen opens on this tab by default; if another tab is active, click Settings in the tab row.
Address: {admin}/settings/security?general=settings
What Is on the Screen
The tab holds a single form. Near the top are the admin access path, an optional IP allowlist for the panel, the cookie domain and the list of trusted proxies. Below that sit a switch for iframe clickjacking protection and two switches for the website script policy. A Password Security block follows them, grouping four related controls: password length, allowed special characters, the automatic reset cycle and a Force Password Reset button. One Save Changes button at the bottom saves the whole tab.
Fields
Tasks
Forcing a Password Reset for All Clients
- Open the Settings tab and scroll to the Password Security block.
- Click Force Now next to Force Password Reset.
- Confirm by clicking Yes, go ahead in the dialog.
Every client password is invalidated, every client is signed out, and each one must set a new password at their next sign-in.
Things to Watch
Use it only after a suspected data breach. A password leaked on another platform may also be in use on your system, and this closes that door for everyone at once. It cannot be undone.
Saving a new value ends every open session once, including your own. You will need to sign in again afterward.
An address added to Trusted Proxies by mistake can claim to be any visitor's real IP address. Add an entry only if the site genuinely sits behind it.
The admin sign-in form counts failed password attempts per hour. Twenty failures from one IP address, or ten against one staff account, lock that address or account for an hour. Further attempts get a "too many incorrect attempts" message. Other staff members and other addresses are not affected. There is no setting for this; the counter resets at the top of each hour. Passkey and code-based sign-in steps are limited separately.
Every form that sets a password compares the new value with the Have I Been Pwned breach list. This covers client sign-up, profile, password reset, invitations, checkout, client details, staff accounts, your own account and the admin API. A match is refused with a "known data breach" message. Only the first five characters of the password's SHA-1 hash leave the installation; the password itself is never sent. At client sign-in the current password is checked the same way, at most once every 7 days. A match opens the password-change prompt on the client dashboard until a new password is set. If the breach service cannot be reached, sign-in and password forms continue without the check. The check is on by default.
Changing the e-mail or phone, saved cards, API keys and licence key reveal ask the client to confirm their identity. The client confirms with their password, or with a code when two-factor authentication is on. A confirmation lasts 15 minutes in that browser session. A trusted device skips it. Five wrong attempts lock the window for the rest of that period. The check is on by default.
Required Privileges
Viewing and saving this tab, and using Force Password Reset, need the SECURITY_SETTINGS privilege.
Related Articles
Спасибо за отзыв!
Наша служба поддержки на связи круглосуточно по всему, чего вы не нашли выше.