Security Settings

The Security Settings page controls how PHP errors are displayed and reported, how users are allowed to access the CMS, and database encryption. It lives at Admin Menu > Advanced Settings > Security Settings. The Security Settings link appears as an indented submenu item (alongside Audit Log) when Advanced Settings is selected.

If you’re recovering from a compromised site, see Restoring Hacked Sites. Hardening the options on this page is one of the follow-up steps it recommends.

Security Tips

At the top of the page, the CMS shows a checklist of tips generated for the current server and connection, such as when developer warnings are enabled, you’re accessing the CMS over an insecure connection, Require HTTPS is off, or there are unreviewed PHP errors in the developer log. When nothing needs attention it shows “None”.

PHP Errors & Warnings

PHP Error Display

How PHP errors are shown to visitors. Three choices:

• Show error message and source file:line — useful for debugging.
• Show error message only — no file paths.
• Hide errors — visitors see (An unexpected error occurred #1234) with the error log number; the full details are recorded in the error log.

Hiding errors keeps error details from being exposed on production servers.

Email PHP Errors

When PHP errors are detected, send the admin a notification email. All errors are logged to the developer error log regardless; this option adds the email alert (sent using the CMS-ERRORLOG-ALERT email template).

Admin Error View

When you’re logged in as an admin, show full error messages with file:line and backtrace, overriding the PHP Error Display setting above. Lets you keep errors hidden from visitors while still seeing details yourself.

Hide Deprecation Notices

Ignore programmer deprecation notices (recommended). These notices are aimed at developers updating code for future PHP versions.

CMS Access

Require HTTPS

Only allow users to log in over secure HTTPS connections. You must be accessing the CMS over HTTPS yourself to enable this. The save is rejected otherwise, so you can’t lock yourself out.

Login Timeouts

Automatically expire login sessions after a set time. Enter a number and a unit (minutes, hours, days, or months). The default is 8 hours.

Check Referer

Warn on external referers/links and require an internal referer to submit data to the CMS. Helps block cross-site request forgery attempts; enabled by default.

Restrict IP Access

Only allow users to log in from a comma-separated list of IP addresses, e.g. 1.2.3.4, 4.4.4.4. The page shows your current IP beside the label, and your current IP must be in the allowed list when you save (another lockout guard).

Database Encryption

Database encryption may impact server performance; only enable it when necessary.

Connections

Encrypt the connection between PHP and the database server (SSL/TLS). This checkbox is disabled when the database server doesn’t support encrypted connections, or when the MySQL hostname is localhost. Encrypted local connections require configuring a hostname or IP address instead, though encrypting local connections is generally unnecessary.

Database Data

The encryption key used for column-level data encryption. The key itself does nothing until you enable Data Encryption on specific fields in the Field Editor. Once any fields are encrypted, the key can no longer be changed. The page shows how many encrypted fields are using it. If settings are loaded from a .env file, the key is set there instead of on this page.

Tips for using an encryption key:

• Save the key somewhere safe. Encrypted data can’t be recovered without it.
• Back up your database before you start encrypting fields.
• Use the same key across all environments (dev, staging, production).