Security

TubePress is hardened by default — CSRF protection on every form, rate limiting on sensitive actions, modern password hashing and session regeneration are all built in. On top of that baseline, a handful of controls let you lock the admin down hard.

This page walks through two-factor authentication, CAPTCHA, moving the admin login to a secret URL, the age gate, transport security, and finishes with a hardening checklist. Most of these live under Settings → Security.

Security overview

Good security is layered: no single control is enough on its own, but together they make your site a hard target. The controls you manage from the Security settings are:

• Two-factor authentication — a one-time code on admin login.
• CAPTCHA — keeps bots off your public forms.
• A custom admin URL — hides the login from scanners.

Underneath, the framework already hashes passwords with Argon2id (or bcrypt where Argon2 is unavailable), validates a CSRF token on every state-changing request, regenerates the session on login, and throttles repeated login, registration and password-reset attempts.

Two-factor authentication

Two-factor authentication (2FA) adds a time-based one-time code (TOTP) to admin sign-in, so a stolen password alone is not enough to get in. It works with Google Authenticator, Authy, 1Password or any TOTP-compatible app.

To enrol, open Settings → Security and:

1. Click Enable 2FA to generate a secret.
2. Scan the QR code with your authenticator app, or type the shown key in manually.
3. Enter the current 6-digit code to verify and switch 2FA on.

The secret is stored against your individual account, so each administrator enrols their own. Disabling 2FA later requires a current code, and the gate is fail-closed: once a code is set, the admin panel demands it on entry even if you authenticated through the public login form.

CAPTCHA

A CAPTCHA stops automated abuse of your public forms. Pick a provider in Settings → Security:

Paste the provider's site key and secret key, choose a light or dark widget theme, then pick which forms to guard — Registration, Comments and the Contact form are each toggled independently and are on by default once a provider is set. The CAPTCHA stacks with the comment anti-spam suite described in Comments.

A custom admin URL

Automated scanners hammer well-known paths like /admin/login. You can move the login form to a secret slug so those probes hit nothing. In Settings → Security, set a custom login slug (3–50 characters, lowercase letters, numbers and hyphens). Your login then lives at /your-secret-slug instead of /admin/login; the dashboard itself stays at /admin, still protected by authentication.

Age gate

For adult sites, the bundled Age Gate plugin puts a full-screen age-verification wall in front of your content, with multiple verification modes, an optional RTA meta tag, and links to your Terms, 2257 and Privacy pages. It is enabled and configured from /admin/plugins.

Because it is part of your moderation and compliance setup, the full walkthrough lives on the Moderation page.

HTTPS & headers

Always serve your site over HTTPS — it protects passwords and session cookies in transit. A free certificate from Let's Encrypt (Certbot) is enough. If TLS is terminated upstream at a proxy or load balancer, forward the scheme (for example an X-Forwarded-Proto header) so the application knows the request is secure.

For production, also turn off PHP's display_errors (so stack traces never reach visitors) and expose_php (so the version is not advertised). The health check flags all three of these for you.

Hardening checklist

Run through this list before — and periodically after — you go live:

1. Set a long, unique administrator password.
2. Enrol 2FA on every staff account.
3. Move the login to a custom admin URL.
4. Enable a CAPTCHA on registration, comments and contact.
5. Serve everything over HTTPS.
6. Turn display_errors and expose_php off.
7. Give staff the least role they need — prefer moderator over administrator.
8. Keep PHP and TubePress up to date, and run regular backups.

Next steps