Security

Security protects your site with no set-up. It checks what is weak and tells you how to fix it, locks out repeated wrong passwords, enforces sensible password rules, logs every sign-in and turns away scanners. It is free and comes with Domma CMS, switched on.

What it does

• Health check: a list of checks, each with why it matters and how to fix it.
• Sign-in lockout: after repeated wrong passwords, the account or the address is locked for a while, longer each time.
• Password rules: new passwords must be long enough, not a common password, and not contain the person's name or email.
• Sign-in log: every sign-in, failed or successful, and every "Forgot your password?" request.
• Scanner guard: requests for things no Domma site has (WordPress, .env files, database dumps and the like) get an empty "not found". An address that keeps probing is blocked for a while.
• Blocks: block an address or range by hand, and see and clear lockouts and blocks.
• A badge on the Security sidebar entry: the number of health checks needing attention. It turns red only when a failing check is critical.

Getting started

Security is on from the start. To review it:

1. Open Security in the sidebar.
2. Read the Health card on the Overview tab. Click a check to see why it matters and how to fix it.
3. Fix what you can. Use Go there in a check's menu where it offers one.
4. Click the cog in the banner to review Security settings.

Screens

The screen has three tabs. The banner has Run the checks again and Security settings (the cog).

Overview

• Health: a score and the list of checks, grouped under People, Sign-in, Server, Web and Plugins.
• Tiles: Need attention, Failed sign-ins, 24h, Blocked now, Probes refused today and Reset requests, 24h.

Right-click a check for Why, and how to fix it, Go there, Run the checks again and Copy.

The checks include:

Group	Checks
People	Unused admin accounts, How many admins, Accounts never used
Sign-in	Sign-in lockout, Password rules, Two-factor sign-in, Email for resets and alerts
Server	Domma CMS up to date, Production mode, Visitor addresses, Listening address
Web	HTTPS certificate, Security headers, HTTPS, Private files not served
Plugins	Plugin licences

A check the plugin cannot confirm shows as information, never as a pass. Results are kept for 10 minutes; Run the checks again refreshes them.

Sign-ins

• Filters: All, Failed, Succeeded and Resets.
• Period: Last 24 hours, Last 7 days, Last 30 days or All kept.
• A search box for email, address or browser.
• CSV downloads what is shown.

Right-click an entry for Only this address, Unlock this account, Block this address..., Copy the address and Copy the browser.

The Resets filter lists "Forgot your password?" requests and what happened to each.

Blocked

• Locked after wrong passwords: current lockouts. Unlock all clears every one. Right-click one to Unlock it.
• Blocked for probing: addresses blocked by the scanner guard. Right-click for Unblock or Block for good.
• Blocked by hand: your own blocks. Enter an Address or range and an optional reason, then click Block. Right-click a block for Remove the block.

An address can be written as:

81.2.69.142        one address
192.168.1.*        a trailing wildcard
10.0.0.0/8         an IPv4 range
2a00:23c7:*        an IPv6 prefix

If a block would cover your own address, you are warned first. The server itself cannot be blocked. Blocked addresses get an empty "forbidden" for every request.

Settings

Click the cog in the banner to open Security settings. Click Save (or press Ctrl+Enter).

Sign-in lockout

Setting	Default
Lock after repeated wrong passwords	On
Wrong passwords on one account	5
Wrong passwords from one address	20
Counted over (minutes)	15
First lock (minutes)	1. Each lock after that is twice as long
Longest lock (minutes)	60

While locked, even the right password does not get in. The message never says whether the account exists. A successful sign-in clears the account's count.

Password rules

Setting	Default
Check new passwords	On
Shortest password	10 (8 to 64)
Refuse the 10,000 most common passwords	On
Refuse passwords containing the person's name or email	On

Passwords are checked when they are set or changed. Existing passwords keep working until then. While the rules are on, a password that uses only one or two different characters (such as aaaaaaaaaa or abababababab) is always refused.

Scanners

Setting	Default
Refuse probes, and block addresses that keep probing	On
Probes before a block	5
Counted over (minutes)	10
Block for (minutes)	60
Also treat as probes	Your own extra paths, one per line, starting with /
This site does serve	Paths that look like probes but are real on your site, for example /legacy/

An address someone has signed in from in the last 7 days is never blocked automatically. Requests from the server itself are never touched.

Keeping and telling

Setting	Default
Keep the sign-in log (days)	30 (7 to 365)
Admin unused after (days)	90. The health check flags admins who have not signed in for this long
Notify when an account or address is locked	On
Notify when someone signs in after many wrong passwords	On
Notify when a scanner is blocked	Off
Notify when password resets look like someone trying addresses	On

The last one fires when one address asks about 3 different accounts within an hour, or when 10 requests in an hour name accounts that do not exist.

Locked out yourself

If you cannot sign in because of a lockout or a block, someone with access to the server can clear it. In the site's folder, run:

node plugins/security/bin/unlock.js --list
node plugins/security/bin/unlock.js --all
node plugins/security/bin/unlock.js --ip 81.2.69.142
node plugins/security/bin/unlock.js --user sam@example.com

--list shows what is locked or blocked. --all clears everything. --ip clears one address and --user one account. The site notices within a few seconds, with no restart.

Permissions and roles

In System > Roles, Security adds the permission Security with two actions:

Action	Label	Meaning	Granted by default to
read	View	See the health check, sign-ins and blocks	Admin
manage	Manage	Change settings; block, unblock and unlock	Admin

Super Admins always have both. Someone with View only sees the screens, but the unlock and block actions are switched off.

Security adds no roles.

Tips

• Keep the health check clear. The sidebar badge tells you when something needs attention.
• Give only a few people admin rights. The health check flags admin accounts that are not used.
• Set up outgoing email under Settings > Email, so password resets and alerts can be sent.
• On a site behind a proxy, check Visitor addresses in the health check. If the site cannot see real visitor addresses, lockouts and blocks apply to the proxy's address.
• The CSV export is safe to open in a spreadsheet: cells that could run as formulas are neutralised.

Limitations

• Lockout and password rules need Domma CMS 0.83 or later. On older versions the screen says so and only the scanner guard and health check work.
• Reset requests are only logged on Domma CMS 0.88 or later.
• No two-factor sign-in. Security Pro adds it, along with more protection. When Security Pro is installed it takes over from Security.