Security

What the Security page does

The Security page brings your platform-wide protective controls together in one place: spam and bot defenses (reCAPTCHA and disposable-email blocking), real visitor-IP resolution for sites behind a proxy or CDN, email-based two-factor authentication policy, and a built-in database backup-and-restore tool. Everything on this page applies across your whole installation, so changes here affect both your admin staff and your customers.

How to reach it

Open the admin panel sidebar and go to Settings. In the settings menu, expand the System group and click Security (the shield icon). The page is one long scrolling form; a Save Settings button sits in the top-right corner and commits every setting on the page at once.

The Backup Now and Restore actions run immediately when you click them and are not tied to the Save button. All the other settings (reCAPTCHA, disposable email, proxy, 2FA policy, and the backup schedule) only take effect after you click Save Settings.

reCAPTCHA v3 (spam protection)

reCAPTCHA v3 silently scores each visitor in the background and rejects submissions that look automated, with no puzzle for genuine users to solve. Use it to keep bots out of your login and registration forms.

1. Turn the reCAPTCHA v3 toggle on (top-right of the section).
2. Paste your Site Key and Secret Key from your reCAPTCHA provider account into the two fields. The Secret Key is masked as you type.
3. Drag the Min Score slider to set the threshold. It runs from 0.1 to 1.0 in steps of 0.1, with a default of 0.5. The current value is shown beside the slider.
4. Tick which forms it protects using the Login and Register checkboxes.
5. Click Save Settings.

A higher Min Score is stricter (more submissions rejected as suspicious); a lower score lets more traffic through. The default of 0.5 is a balanced starting point.

Disposable Email Blocking

This section rejects sign-ups that use throwaway or temporary inbox services (the kind used by bots and tire-kickers) at the moment a customer registers. Mainstream privacy providers such as Proton and Tutanota are not blocked.

1. Turn on Block disposable email domains. The block applies at signup only.
2. Optionally add your own domains to the Also block these domains box. Entries are comma- or space-separated and are added on top of the built-in list.
3. Optionally list domains in Never block these domains to exempt them, even if they appear on the built-in list.
4. Click Save Settings.

Real Visitor IP (trusted proxies)

When your platform sits behind a reverse proxy, CDN, or load balancer (for example Cloudflare), every request appears to come from the proxy rather than the real visitor. This section restores the true visitor IP so that rate limiting, IP bans, and login-attempt tracking work correctly.

Proxy IP Header

The header your proxy uses to relay the real client IP. It defaults to X-Forwarded-For. If you front the platform with Cloudflare, set this to CF-Connecting-IP.

Trusted Proxies

A list of proxy IP addresses or CIDR ranges, one per line. Forwarded headers are only trusted when they arrive from these addresses, which prevents visitors from spoofing their IP. Add only addresses that directly proxy requests to your platform. Private and internal ranges are always trusted automatically, and leaving the box empty enables automatic detection.

Getting this right matters: without trusted-proxy configuration behind a CDN, every visitor appears to share the proxy's single IP, so an IP ban or a rate limit can accidentally block all of your traffic at once. See IP Ban for how blocked addresses are managed.

Email Two-Factor Authentication (2FA)

With email 2FA enabled, a short, time-limited verification code is emailed to the user at login and must be entered to complete sign-in. This adds a second layer of protection on top of passwords for both admin and customer accounts.

1. Turn the Email 2FA toggle on. Additional options appear once it is enabled.
2. Optionally enable Force for All Users (shown in an amber-highlighted row) to require 2FA on every login with no opt-out.
3. Set the policy fields, then click Save Settings.

Email 2FA options

Field	What it controls	Range
Force for All Users	Requires 2FA on every login; users cannot turn it off.	On / Off
Expiry (min)	How long an emailed code stays valid before it must be requested again.	1–30 minutes
Max Attempts	How many wrong code entries are allowed before the attempt is rejected.	1–10
Cooldown (sec)	Minimum wait before a user can request a fresh code.	30–300 seconds

Test your email delivery before forcing 2FA on everyone. The Force for All Users row is highlighted in amber because any account that cannot receive its code (for example, if email sending is broken) will be unable to log in. Confirm your Email configuration is working first.

Database Backup

The platform can email you a compressed backup of your database on a schedule, and you can also trigger one on demand.

1. Turn the Database Backup toggle on.
2. Choose a Frequency of Hourly or Daily.
3. If you chose Daily, pick the Hour (UTC) from the dropdown (00:00 through 23:00). This field is hidden for hourly backups.
4. Enter the Backup Email address that should receive each backup file.
5. Click Save Settings to store the schedule.

To send a backup right away without waiting for the schedule, click Backup Now. The button is only available once a Backup Email is set, and it delivers the file to that same address.

Backups are sent as .sql.gz email attachments, and most email providers cap attachments at around 25 MB. If your database grows beyond that, the backup email may fail to deliver. A Daily schedule keeps each file smaller than frequent backups of a busy database, but for very large datasets you should keep an additional backup method.

Restore Database

The Restore Database tool rebuilds your database from a backup file. This is destructive and irreversible — it drops all existing tables and replaces them with the contents of the uploaded file.

1. Under Backup File (.sql.gz), choose a .sql.gz backup from your computer. The selected file name and size are shown once picked.
2. Click Restore.
3. A confirmation dialog appears showing the file name and a warning that all current data will be permanently replaced. Click Yes, Restore Database to proceed, or Cancel to back out.

There is no undo. Restoring overwrites everything — users, invoices, services, tickets, and settings. Only restore a backup you trust, and ideally take a fresh Backup Now first so you can roll back if the restore is not what you expected. The restore may take several minutes for a large file; leave the page open while it runs.

Common tasks at a glance

Goal	What to do
Block bots on sign-up forms	Enable reCAPTCHA v3, paste your keys, tick Login/Register, Save.
Stop throwaway-email registrations	Enable Block disposable email domains, optionally add extra domains, Save.
Fix wrong visitor IPs behind a CDN	Set the Proxy IP Header and list your CDN/load-balancer ranges in Trusted Proxies, Save.
Require a login code by email	Enable Email 2FA, set Expiry / Max Attempts / Cooldown, optionally Force for All Users, Save.
Schedule automatic backups	Enable Database Backup, pick frequency and email, Save.
Send a backup immediately	Set the Backup Email, then click Backup Now.
Roll back to a backup	Upload the .sql.gz file under Restore Database, click Restore, confirm.

Related

IP Ban · General Settings · Email Settings