Review site and administrator security

Archived guide for existing Fusion Owned License installations; use the instructions for your installed build.

Review Settings > Security

The documented controls are specific to the legacy site, not the DHRU V2 sign-in service.

| Setting | Historical purpose |

| --- | --- |

| **Maximum login failed attempt** | Limit failed sign-ins; the source says blocked clients contact the site administrator |

| **Site SSL link** | Configured secure site address |

| **Master pin** | Require the configured PIN when placing an order |

| **User can reset API IP** | Control client API-IP resets; a configured IP limits the connection, while the source says the first sync can set a blank value |

| **User can generate temporary password** | A historical temporary-access feature described as lasting two hours |

| **User password expired on** | Configured password-age interval |

| **Blocked account** | Country-mismatch account control |

| **Required Captcha On Login** | Login CAPTCHA control |

| **Send Email on Country mismatch** | Country-change verification email option |

| **Admin E-mail Notification on Blocked Account** | Administrator notification option |

| **Password security** | Password-strength setting for registration |

| **Automatic Security Check** | Scheduled script-check reporting |

Use the protected settings form for sensitive values. Do not post a PIN, temporary password or API credential in chat.

Move writable storage out of the public directory

The historical hardening guide allows **downloads** and **templates_c** to be placed outside the publicly served directory. After moving them, open **Settings > Security** and update **Template Compiler Path** and **Download Directory Path** to the actual locations.

The article's example values are `../templates_c/` and `../download/`. Note that its download example is singular even though its source folder is called `downloads`; choose the path that actually exists. Grant the web process the necessary access without world-writable permissions, then test template compilation and an authorized download.

Admin directory and configuration file

The hardening article describes renaming the admin directory in place, not moving it elsewhere, and setting `$customadminpath` in `/configs/config.php` to the matching directory name. The installation article instead names `$admindirpath`; verify which setting is defined by the installed build.

For a shared host, the source suggests file permission `600` for the configuration file, although it alternates `config/config.php` and `configs/config.php` as the path. Use the real file and ensure the application process can still read it; preserve a backup before changing either the path or permission.

Restrict admin access by IP

Use **Settings > Security Settings > Admin Allowed IP**. The historical input accepts individual addresses separated by spaces and CIDR ranges. For example, the form of `203.0.113.10 198.51.100.20 192.0.2.0/24` illustrates two individual addresses plus one range; replace every example with your authorized network addresses.

Keep a copy of the previous access configuration and verify access from an allowed network before closing the existing session. If a change locks you out, have the authorized hosting administrator restore the known configuration rather than disabling unrelated security controls.

Encryption-key changes affect authentication

The source's **Encryption Key** setting is not a routine repair switch: it warns that replacing the key affects existing passwords. Preserve the key and investigate the actual issue before any planned change. Account recovery, key changes and temporary access need an authorized person; never send the key or authentication secrets in a support message.