Login security — what is on by default, and what you decide
Most of login security is already done for you. This lesson is about knowing what's on, so you can explain it to your users, and making the few choices that are yours.
By the end of this lesson
- You'll know which sign-in protections are already on for your site and what your users see because of them
- A welcome email in your own words, and at least one user invited with a set-your-own-password link
- Your administrators enrolled in two-factor authentication with backup codes saved
- A clear decision on whether to make two-factor required, and the one thing to do before you flip it
You'll need
- Admin role — everything here is under Settings
- The Server settings lesson, for Mail Settings — every feature in this lesson sends email
- A phone with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy or 1Password) if you'll enroll in two-factor during the lesson
Background
Open Settings → Server Settings and click the second tab, Security Settings. On most plans you'll see two sections — Self-Service Account Recovery and Two-Factor Authentication. The rest of login security is handled for you and doesn't appear as switches.
- Passwords must be 12+ characters and not a common or breached password
- Five wrong passwords lock the account for 5 minutes
- "Forgot password?" and "Email me a sign-in link" on the sign-in page
- Two-factor available to any user from their profile (Optional mode)
- Text-message codes work out of the box
- The welcome email subject and message
- Whether two-factor is Optional or Required
- Which methods to offer: authenticator app, email code, text message
- Whether to keep password reset and sign-in links on
- Public URL, if you use a custom domain
- Switch password rules and lockout off
- Duo as a two-factor method
- Your own Twilio account or SMS gateway
- Single sign-on (SSO header)
These sections appear on the tab automatically when your plan includes them.
What your users notice
| Situation | What happens |
|---|---|
| Sets or changes a password | A hint under the field asks for 12+ characters; a passphrase of four or five words works well. Short, common or breached passwords are refused with a plain explanation. |
| Types the wrong password five times | The account is locked for 5 minutes. It unlocks itself; you can also unlock it from the Users list. |
| Forgets their password | They click Forgot password?, get an email, and set a new one. No ticket to you. |
| Wants two-factor | They set it up from My Profile → Two-factor authentication and are asked for a code at each sign-in. |
| Is new | If you invite them by email, they receive your welcome message with a link to set their own password. You never see or send a password. |
Existing passwords are not affected by the rules — they apply only when a password is set or changed. Nothing here prompts anyone to enroll in two-factor until you make it Required.
Unsure whether to require two-factor, or worried about an integration that signs in automatically? Email [email protected] with how your users sign in today. Same business day reply.
Before you start
- Admin role. Settings → Server Settings is admin-only.
- Mail Settings working. Welcome emails, reset links and email codes all go through Settings → Scheduler → Mail Settings. The default gateway works without setup; if you switched to Custom SMTP, send yourself a test first. If it's set to Disabled, none of these emails go out.
- An authenticator app on your phone if you'll enroll in Stage C. Any of them work; the app is the method that needs nothing else to be set up.
- A list of accounts that sign in automatically — anything your own application, an embedded dashboard, a script or Server Sync signs in with. You'll need it before Stage D. If you have none, skip this.
Do it
-
Four stages — only A is for everyone
Stage A is a look around and a check. The other three are decisions you can make now or come back to:
Stage A — Tour the Security Settings tab and confirm the defaults match what you want.Stage B — Write your welcome email and invite a user with a set-your-own-password link.Stage C — Enroll yourself and your backup admin in two-factor; save the backup codes.Stage D — Decide whether to make two-factor Required — and what to do first. -
Stage A — Tour the tab
Settings → Server Settings → Security Settings.
Self-Service Account Recovery. Check that Public URL of this site shows your site address — it's the address inside every emailed link. If you've added a custom domain and want links to open there, change it to that domain. Below it, Allow users to reset a forgotten password by email and Allow users to request a one-time sign-in link by email are both on. Leave them on unless all your users sign in through your own identity provider.
If you see an amber Email is not set up notice here, go back to Mail Settings first — the links still appear on the sign-in page, but no email can be sent.
Two-Factor Authentication. Mode is Optional. Under Allowed methods, Authenticator app, Email code and Text message (SMS) are on. Text messages are sent from DashboardFox's number; nothing to configure.
If nothing needs changing, there's nothing to save. If you edited Public URL, click Save.
-
Stage B — Write the welcome email and invite a user
Still under Self-Service Account Recovery, scroll to Welcome email. Edit the Subject and Message. Keep it short — the Set-password button and the expiry note are added below your text automatically. You can use
{product},{username}and{firstname}; they're filled in per user.{product}is the Product name from the first Server Settings tab. Click Save.Now invite someone: Settings → Security → Users → Create New User. Fill in name, login and email, then switch on Email the user a link to set their own password. The password fields disappear. Finish the rest of the form as in Create users and click Save & Apply.
The user receives your welcome email with a link that's good for 72 hours. They choose a password that meets the rules and sign in. If the link expires, open the user and click Send setup link.
Do this for yourself as a test if you like — create a throwaway user with your own email address, then delete it.
-
Stage C — Enroll your administrators
Before anyone else, enroll yourself and your backup admin. Open My Profile, find the Two-factor authentication line and click Set up.
- Choose Authenticator app. Scan the QR code with your app (or type the key shown under it), then enter the 6-digit code it displays.
- Ten backup codes appear once. Download them and store them with your other recovery material — the same place as the backup admin's credentials from Create users.
- Click Done. Sign out and back in to see the code prompt. Tick Remember this device for 30 days on your own computer if you like.
Optionally click Add another method on the profile panel and add Email code as a fallback. At sign-in, Try another way switches between them.
Have your backup admin do the same. Two enrolled admins means one can always Reset 2FA for the other from the Users list if a phone is lost.
-
Stage D — Decide on Required
In Optional mode, two-factor protects whoever turns it on. In Required mode, every user who signs in with a password must set it up at their next sign-in and can't reach the application until they do.
Before you flip RequiredAny account that signs in automatically — your application embedding dashboards, a script using the API, the Server Sync user — will be stopped at the two-factor screen it cannot answer. Mark each of those as a Service account in the user editor first. The next lesson walks it.
Also confirm your administrators are enrolled (Stage C) and that Mail Settings works, if you offer the Email code method.
When you're ready: Settings → Server Settings → Security Settings, set Mode to Required, click Save. Tell your users what to expect — the setup screen appears at their next sign-in and takes about a minute with an authenticator app.
Not ready? Leave Optional and instead open individual users and set Two Factor Authentication to Ask to set up 2FA at next sign-in. Those people see the setup screen with a Skip for now link until they enroll.
You have a working connection. You've seen the tab and enrolled your admins. Below is what to tighten before your whole team signs in.
Make it real
Four habits that keep login security from becoming a support queue.
Invite, don't hand out passwords
Once the welcome email is written, make the invite switch your default for every new user. Nobody has to think of a compliant password on your behalf, nothing sensitive goes through chat or email, and the user's first experience is setting their own password on a branded page.
For an existing user who has forgotten their password, Send password reset link in the user editor does the same thing with a 1-hour link — faster than setting a temporary password and telling them.
Know the three pills on the Users list
The Users list now shows Locked, Disabled and Service pills, and the row menu (⋯) has Unlock and Disable / Enable.
- Locked — five wrong passwords. Clears itself in 5 minutes; Unlock if the user is waiting on the phone.
- Disabled — you turned the account off. Nothing signs in; content and schedules are kept. Use it for leavers instead of deleting.
- Service — an integration account that skips two-factor. Covered next lesson.
Plan for the lost phone
The question you will get: "I got a new phone and can't get a code." Three answers, in order: they use one of their backup codes; they use Try another way if they added email as a second method; or you open their user and click Reset 2FA. Reset removes every method and remembered device; in Required mode they enroll again at their next sign-in.
This is why Stage C saves backup codes and why two admins should be enrolled — so there's always someone who can reset.
Decide what SSO users need
Users who sign in through your identity provider aren't affected by any of this — no password rules, no lockout, no two-factor prompt from DashboardFox. Their identity provider handles it. If everyone signs in that way, you can turn off password reset and sign-in links so the options don't appear on the sign-in page.
Next: Service accounts — the one setting that keeps integrations, embedded dashboards and Server Sync working when two-factor is on.
If you're stuck
The questions that come up in the first week.
A user says they're locked out
Five wrong passwords locks the account for 5 minutes, and it clears on its own. If they can't wait, Settings → Security → Users, find the row with the Locked pill, row menu → Unlock. If it keeps happening, something is retrying an old password — a saved browser password, a phone app, or an embedded dashboard. Fix the stored password, then unlock.
The reset or welcome email never arrives
Check Settings → Scheduler → Mail Settings isn't set to Disabled and, if you use Custom SMTP, that a test send works. Then check the user actually has an email address on their record. Finally, spam folders. The Audit Log shows whether the request was accepted.
The link in the email opens the wrong page
Public URL on the Security Settings tab doesn't match the address your users use — usually after adding a custom domain. Set it to the address they type, including https://, and save. New links use it immediately.
My new user's password keeps being rejected
The rules: 12 to 128 characters, not a common or previously breached password, not containing their login name, no leading or trailing spaces. The message lists every rule that failed. Suggest a passphrase — four or five unrelated words — rather than a shorter password with symbols.
I switched to Required and an embedded dashboard broke
The account your application signs in with is now being asked for a code it can't provide. Open that user, turn on Service account (API integration), save. It works again at the next sign-in. The next lesson explains how to avoid this up front.
I don't see password security or lockout switches
Expected. On most plans those are on for every site and don't appear as switches. The sections appear on the Enterprise plan, along with Duo, your own text-message provider and single sign-on.
None of these match my situation
Email [email protected] with what you were trying to do and what you saw. If the only administrator is locked out of two-factor with no backup codes, say so — we can help.
