Accounts are protected by two-step sign-in, and every important action in the panel goes into a log. Forms are protected against forged requests, and uploaded files are checked by content, not by name.
Sign-in and accounts #
Sign-in takes two steps, and wrong passwords and codes are counted by address, by the typed string and by the account itself, so alternating between email and username does not help a guesser. Sessions can be viewed and closed in the profile.
Action log #
Important actions in the panel are recorded: who changed what and when. The log is not flooded with empty lines, because untouched fields are not written to it on save.
Forms and uploads #
Every form has its own key against forged requests. Uploaded files are checked by content, images are rebuilt from scratch, and nothing in the uploads folder is ever executed.
Content policy #
Each page gets its own script key: foreign inline code will not be run by the browser. Even if something extra slips into a text, it stays just text.
No one has commented yet. Be the first.