Security Settings on DashboardFox Cloud
DashboardFox Cloud sites start with a security baseline already in place, and some settings are managed for you. This article lists what is on from day one, what you can change, and what needs the Enterprise plan. The feature articles linked below describe how each feature works; this page only covers the Cloud differences.
What is set up when your site is created
Setting | On your site | Can you change it? |
|---|---|---|
Enforce password security (12-character minimum, common-password and breach screening) | On | Enterprise only |
Lock account for 5 minutes after 5 failed sign-in attempts | On | Enterprise only |
Allow users to reset a forgotten password by email | On | Yes |
Allow users to request a one-time sign-in link by email | On | Yes |
Public URL of this site | Your site address, e.g. | Yes |
Outgoing email for reset, sign-in and welcome links | DashboardFox's default mail gateway (sender | Yes — switch to your own SMTP server under Settings → Scheduler → Mail Settings |
Two-factor mode | Optional | Yes — Off, Optional or Required |
Two-factor methods | Authenticator app, Email code, Text message | Yes |
Text messages | Sent from DashboardFox's number | Own provider: Enterprise only |
Duo | Not available | Enterprise only |
Single sign-on (SSO header) | Not available | Enterprise only |
Everything in Managing User Accounts — inviting by email, disabling, unlocking, forced password change, Reset 2FA, service accounts, External users — is available on every plan.
What you see in Security Settings
Open Settings → Server Settings → Security Settings. On the Starter, Growth and Scale plans the page shows two sections:
Self-Service Account Recovery — Public URL, the password-reset and sign-in-link switches, and the welcome-email subject and message.
Two-Factor Authentication — Mode and the Authenticator app, Email code and Text message switches.
Password security, account lockout, the text-message provider, Duo and single sign-on are not shown; they are managed for you as in the table above. On the Enterprise plan the page shows every section, exactly as on a self-hosted server, and you may change any of them — including turning password security or lockout off, which we do not recommend.
Your plan is read from your license automatically; there is nothing to switch on. If you upgrade to Enterprise, sign out and back in to see the additional sections.
Recommended configuration
The defaults are a sensible baseline. Two things are worth doing early:
Mark integration accounts as service accounts before you consider Required two-factor mode — any account your application, an embed, or Server Sync signs in with. See Service Accounts for Integrations and Embedding.
Enroll your administrators in two-factor while the mode is Optional, keep the backup codes somewhere safe, then switch the mode to Required when the rest of your users are ready. See Two-Factor Authentication (2FA).
If your users all sign in through your own identity provider, you can turn the reset and sign-in-link switches off; they only apply to username-and-password users anyway.
Things that work differently on Cloud
Outgoing email uses the default gateway unless you change it. If you set Mail Settings to Disabled, password-reset, sign-in-link and welcome emails stop along with scheduled reports.
Public URL is set to your
dashboardfox.appaddress. If you later use a custom domain, update it so emailed links open on that domain.Account lockout is per site, so the "multi-server" note in the lockout article does not apply.
Text-message codes use a shared DashboardFox number. Delivery to some countries may be filtered by carriers; the authenticator app method is always available as the reliable fallback.
Locked out of two-factor as the only administrator? Another administrator can reset your 2FA from the Users list. If you have no other administrator, contact support.
The built-in
adminaccount is used by DashboardFox for maintenance and cannot be disabled; your day-to-day administrator account is separate.