Security
Two-factor authentication (store admin)
Admin → Security. Works with Google Authenticator, 1Password, Authy or
anything that scans a QR code. You get eight single-use recovery codes, shown
once and stored hashed — save them somewhere that is not your phone.
Worth turning on: that account can revoke licences and read every customer's
email address, so a password on its own is thin protection.
Passwords
Ten characters minimum. A short phrase you will remember beats a short jumble
you will not.
Forgotten it? Forgotten your password? on the sign-in screen. The link
works once and expires in an hour.
What the platform does for you
- Every form is CSRF-protected
- Sign-in attempts are rate limited
- A Content-Security-Policy blocks injected scripts from running at all
- Passwords are hashed with bcrypt, never stored or logged
- Uploaded files are validated by content, not by filename
- The admin is never cached, so signing out leaves nothing in the back button
What is yours to do
- Delete
install.phpafter installing. The dashboard nags until you do. - Keep PHP patched
- Use a unique password
- Back up
storage/
Hosted plans
Patching, TLS certificates and backups are ours. Each site runs as its own
system user with its own PHP process, so one site cannot read another's files.
Custom HTML on hosted plans has scripts and forms removed. Your site shares a
domain with other studios, and one compromised page would affect all of them.
Embeds from YouTube, Vimeo, Spotify, Google Maps and Calendly all work normally.