Security Suite

Four layers of protection for your site and its admin panel — set up in minutes, no server configuration required.

Two-factor authentication (TOTP)

After the password, sign-in asks for a 6-digit code from any authenticator app (Google Authenticator, Aegis, 1Password, Microsoft Authenticator). The check runs before any admin request is processed — not a single click slips through without it.

• Setup in two steps: add the secret (setup key or an otpauth:// link that opens the app directly on a phone), confirm with a code.
• 10 one-time backup codes for a lost phone — shown once, stored hashed.
• Per-account: every panel user protects their own sign-in.
• Clock drift of ±30 s is tolerated; a documented server-side reset exists if all codes are lost.

Audit log

Every POST request to the panel is journaled: sign-in attempts (with the entered email), sign-outs, every change, 2FA events. Request bodies are never stored — no passwords in the log. Records auto-expire after 90 days.

Security headers

One-click hardening headers on every page: X-Frame-Options (clickjacking), X-Content-Type-Options: nosniff, Referrer-Policy, optional Permissions-Policy. No .htaccess or nginx edits.

File integrity monitoring

sha256 of every core PHP file against a saved baseline. Plugins and themes are excluded on purpose — they change legitimately on marketplace updates, and noise would bury the signal.

• Scan now shows changed / new / removed files.
• Cron URL for scheduled checks: on changes the plugin writes an audit event and emails the administrator.
• After a legitimate core update — one click to accept the new baseline.

Everything works through the plugin's early bootstrap: no core files are modified, and sign-in rate limiting already built into Celena is not duplicated.