What does each protection layer do?
| Control | Purpose | Boundary |
|---|---|---|
| Entry path | Restrict the panel entry address | Does not replace strong passwords and 2FA. |
| IP allowlist | Limit access to selected network sources | A changing public IP can interrupt access. |
| Brute-force protection | Limit repeated failed logins | Plan legitimate access and unlocking. |
| 2FA | Require an additional authentication factor | Protect recovery codes separately. |
Prepare 2FA and recovery codes
Configure two-factor authentication in the account area and store recovery codes in a separate secure location. A single-use recovery code can help when the authenticator is lost. Keep codes out of shared screenshots and support messages.
Password changes can revoke existing API tokens; plan connected automations accordingly. Give people individual accounts and suitable scope instead of sharing credentials, so activity records remain meaningful.
Before applying an IP allowlist
- Verify the client IP the panel sees and consider NAT or proxy behavior.
- Prepare server-console access or another trusted management route.
- List required management addresses and plan for dynamic IP changes.
- After applying the rule, test a new session from the intended network.
- Verify an unapproved network is blocked and customer websites are not unexpectedly affected.
- Record the management change and recovery procedure.
API tokens and AI clients
An AI integration token inherits its owner’s permitted scope. Its plaintext value appears only at creation; revoke and replace a lost token. Keep it out of website content, repositories and logs.
An MCP token and the panel’s cookie-authenticated web API session are different mechanisms. Check the endpoint and authentication method used by a client. Revoke unused credentials and review access periodically.
Lockouts and incident investigation
Login lockout, subscription suspension and network blocking have different causes. Use timestamps and audit records to identify the applied control. Server-side administrator recovery procedures require authorized server access; disabling all protections is not a routine fix.
Include backups and recovery tools in the access plan. If a single person or device is the only way to manage the server, rehearse recovery from losing that access too.
Frequently asked questions
Is the hidden entry path sufficient on its own?
No. Combine it with strong authentication, HTTPS, appropriate roles and network restrictions where needed.
Can I view an API token again later?
The plaintext token is displayed only when created. Revoke and replace it if lost.