Security (2FA, IP allowlist)

MyPanel hardens login out of the box (Argon2id, HttpOnly cookies, HSTS, brute-force protection, auditing). The Pro plan adds the extra layers below.

Two-factor authentication (2FA)

Go to Settings → Security → 2FA:

1. Click Set up — the panel shows a QR code.
2. Scan it with an authenticator app (Google Authenticator, Authy, 1Password…).
3. Enter the 6-digit code to enable.

From then on, login also requires the 2FA code. You can disable 2FA again on the same page (requires verification).

Restrict panel access by IP (IP allowlist)

Go to Settings → Security → IP allowlist and enter the IPs/ranges allowed to open the panel. When enabled, any access from an IP outside the list is rejected — sharply reducing your attack surface.

Caution

Only enable the IP allowlist when you’re sure your IP is on the list (especially with a dynamic IP). A mistake can lock you out — you’d then need to fix the config directly on the server.

Per-site permissions

Besides admin and viewer, there’s a Site manager role — it can only operate the websites assigned to it. Permissions are enforced at the API layer (default-deny). See Users & permissions.

API tokens

For automation/CI to call the API without a password — see API tokens.

Sessions & audit

View and revoke login sessions and review the action audit log under Settings → Security — see Users & permissions.