Principles
- Secrets only in config.php with HTTP access denied
- Prepared statements for all database queries
- CSRF protection on state-changing forms
- Least privilege for admin roles
Daily habits
- Prefer MFA on admin accounts
- Review Activity Logs after staff changes
- Do not paste tokens into tickets or screenshots
- Rotate credentials if exposure is suspected
Related pages
See Security Settings for account controls, OAuth Configuration for login apps, and Troubleshooting for common failures.
← Back to Documentation
