Signing in and protecting your account

Sign in

Open the secure Core Panel address supplied by your administrator. Enter your username and password. If multi-factor authentication is enabled, enter the current six-digit authenticator code or an unused recovery code.

Forgot password

The sign-in page offers password recovery when system email is configured and the account has an email address. Reset links are single use and expire after 30 minutes. Completing a reset signs the account out of all existing sessions.

Update your profile and password

Open My account to update your username and email address or set a new password. Security-sensitive changes require the current password. Passwords must contain at least 12 characters.

For a site account, changing the password also changes password-based SFTP and SSH access for that account.

Enable multi-factor authentication

1. Open My account .
2. Under Multi-factor authentication , enter your current password and select Set up authenticator .
3. Scan the QR code with an authenticator app, or enter the manual setup key.
4. Enter the generated six-digit code and select Verify and enable .
5. Download the recovery codes and store them privately and offline.

Each recovery code works once. Recovery codes are displayed only when they are generated. Disabling MFA requires the current password and either an authenticator code or recovery code.

Store and use MFA recovery codes

Download the recovery codes immediately after enabling MFA. Store them in an encrypted password manager or another private offline location that remains available if the authenticator device is lost. Do not keep the only copy on the same phone.

• Use one unused recovery code in place of the six-digit authenticator code.
• Mark a recovery code as consumed after use; every code works only once.
• If the authenticator and every recovery code are unavailable, contact the administrator through an established channel and follow the organization's identity-verification process.

Protect sessions and shared devices

• Confirm the panel hostname and HTTPS connection before entering credentials.
• Do not approve a password-manager fill or enter an MFA code on a look-alike hostname.
• Sign out after using a shared or temporary device, and do not save credentials in its browser.
• Keep the browser, operating system, password manager, and authenticator application updated.

Completing the forgot-password reset signs the account out of all existing sessions. An administrator suspending an operator also ends that operator's active panel sessions.

Secure site-account SFTP and SSH access

When password-based SFTP or SSH is enabled for a site account, changing the panel password changes that server-access password too. Update saved clients and deployment secrets deliberately, then verify access before removing the previous operational path.

Prefer key-based SSH access where the workflow supports it. Keep private keys outside website files, use a separate key for each person or automation boundary, and remove access that is no longer required.

Respond to a suspected account compromise

1. Use a trusted device and the known panel address. If that cannot be established, contact the administrator before entering credentials.
2. Reset the password, review MFA access, and end existing sessions through the password-recovery flow when appropriate.
3. Review the audit log and the affected website's files, users, scheduled jobs, access keys, deployments, and recent configuration changes.
4. Rotate exposed SFTP, SSH, database, application, API, and third-party credentials; changing only the panel password does not rotate unrelated secrets.
5. Record the incident and restore only from a recovery point whose integrity has been verified.