| docs

Appearance

Security ​

The Security page is where an administrator changes their own password and adds a second step to their sign-in. It covers your own account only; other administrators are managed on Admin Management.

Overview ​

URL: /admin/security-settings

The page is reached from the Security entry in the panel navigation.

The admin security page with two-factor authentication and passkeys

Change Password ​

Sets a new password for your administrator account.

Administrator accounts are owned by the panel and have their own passwords, kept separate from the server's system accounts. On an existing installation the root administrator is asked to set a panel password at its next sign-in.

Two-factor authentication ​

Enable authenticator app adds a one-time code to your sign-in, from an authenticator app such as Google Authenticator, 1Password, or Authy.

Setting it up produces single-use recovery codes. Keep them somewhere you can reach without this panel. They are how you get back in when the device holding the authenticator is lost, and an administrator locked out of the panel is a bigger problem than a locked-out customer.

Changing the second factor or regenerating the recovery codes asks for a fresh code first, so a signed-in browser someone else reached cannot quietly replace your second factor.

A challenge left open expires on its own, and failed attempts are logged so the panel's login protection acts on them.

Passkeys ​

A passkey signs you in with Face ID, Touch ID, Windows Hello, or a security key instead of a code. Add passkey registers one. Removing a passkey asks for a fresh second-factor code first.

A passkey lives on the device that created it, so register a second one, or keep the recovery codes, before relying on a single device.

Resetting another administrator's second factor ​

An administrator can reset another account's second factor from Admin Management, and confirms with their own second factor to do it. That is the path for a colleague who has lost both their device and their recovery codes.