Login and Account Security Options
DashboardFox includes a set of security features for sign-in and user accounts. On a self-hosted server all of them are off by default: upgrading does not change how your users sign in until you turn a feature on.
DashboardFox Cloud: several of these are turned on for you when your site is created, and a few are only available on the Enterprise plan. See Security Settings on DashboardFox Cloud for what applies to your site.
This article is the starting point. Each feature has its own article with setup steps, what users see, and troubleshooting.
Features at a glance
Feature | What it does | Default (self-hosted) | Where | Needs |
|---|---|---|---|---|
Minimum length, common-password and breach screening for new passwords | Off | Settings → Server Settings → Security Settings | Internet access for the breach check | |
Blocks sign-in for 5 minutes after 5 wrong passwords | Off | Settings → Server Settings → Security Settings | — | |
Users reset their own password or sign in with an emailed link | Off | Settings → Server Settings → Security Settings | Outgoing email (SMTP), Public URL | |
Second step at sign-in: authenticator app, email code, text message or Duo | Off | Settings → Server Settings → Security Settings | Email for email codes; a text-message provider for SMS | |
Invite by email, disable, unlock, force a password change, reset 2FA | Always available | Settings → Security → Users | Email for invite and reset links | |
Mark accounts used by integrations, embedding or Server Sync so 2FA and forced password changes never interrupt them | Always available | User editor | — |
Recommended order
Confirm outgoing email works (Settings → Scheduler → Mail Settings) and set Public URL in Security Settings. Most features send email.
Turn on Allow users to reset a forgotten password by email. This removes most "I forgot my password" tickets.
Turn on Enforce password security and Lock account for 5 minutes after 5 failed sign-in attempts if your policy requires them.
Mark any integration, embedding or Server Sync accounts as service accounts before you touch two-factor settings.
Set Two-factor mode to Optional, switch on at least one method (Authenticator app is the simplest), enroll a few administrators, then switch to Required when ready.
Who these apply to
These features apply to users who sign in with a DashboardFox username and password. Users who sign in through single sign-on (SSO), Windows authentication, or an external identity provider are authenticated by that system and are not affected by password reset, lockout, or two-factor settings. Service accounts sign in with a password but skip the two-factor and forced-password-change steps.
Audit trail
Every action in these features is recorded in Settings → Audit Log: password resets and changes, link sign-ins, lockouts and unlocks, disables, two-factor enrollments, challenges and verifications, backup-code use, remembered devices, administrator resets, and service-account changes.
Related
Signing In with Two-Factor Authentication (for users)