Admin security and changing your password
Change the default password first. Then read what the script does to keep your website safe.
Change your password
- Open Settings and scroll to Administrator account.
- Optionally change the username (3-40 characters: letters, numbers and . _ @ -).
- Enter your current password. It is always required.
- Enter the new password twice. At least 8 characters; use a long phrase.
- Click Save Changes. Leave the new password empty to keep the old one and only change the username.
What protects your website
| Protection | What it does |
|---|---|
| Encrypted passwords | Passwords are stored with bcrypt hashing, never as plain text. Old hashes are upgraded automatically at login. |
| Login lockout | 5 wrong attempts block an address for 15 minutes. |
| Protected sessions | Cookies are hidden from scripts, restricted to your site and expire after 2 idle hours. |
| CSRF tokens | Every form in the admin panel carries a secret token, so other websites cannot make your browser change things. |
| Cleaned content | Text from the editor is filtered, links are checked and dangerous code is removed. |
| Safe uploads | Files must be real images. They are re-encoded, renamed and can never be run as scripts. |
| Blocked folders | The included .htaccess files hide your data files, config.php and includes from the web. |
| No error leaks | Visitors never see PHP error messages; details go to the server log. |
| Private admin | Admin pages are marked "noindex" and are never cached. |
Your part
- Use HTTPS for the whole website.
- Use a unique, long password and do not share it.
- Keep PHP updated on your hosting.
- Make regular backups.
- Log out on shared computers.
Last updated