CMS Access and Security
Plan administrator ownership, staff permissions, recovery, and infrastructure access.
The first administrator controls your installation. Protect that account and use separate accounts for daily staff work so permissions and activity can be attributed to individual people.
Establish the administrator
Confirm the initial email is reachable. Change any provisioned password after the first sign-in and enable two-factor authentication where appropriate. Keep recovery codes in a secure place accessible to the people responsible for recovery.
Do not rely on the portal password or hosting panel login to recover the CMS administrator account; they belong to different systems.
Plan roles before inviting staff
Identify which staff need system administration, which need access to particular modules, and which should only see their own data. Configure roles and permissions in the CMS before onboarding users.
Admin-type roles receive broad permissions, including module permissions synchronized by the system. Use scoped roles when someone needs only a subset of capabilities.
Test with a regular user account:
- Can the user open the intended module and perform the required work?
- Are unrelated settings and administration screens unavailable?
- Is access to private records limited as intended?
- Can the user sign out and recover access through a verified mailbox?
Refer to the installed CMS documentation for the detailed user and role workflows.
Protect the server
Run the application with a service account that can read application files and write only the required persistent directories. Keep database and Redis ports private to authorized hosts. Restrict access to environment files, backup archives, and provider credentials.
The public web root should not expose the full application directory. Route requests through the app and its supported static-file handling.
Prepare recovery
Test email recovery before the first administrator loses access. Retain the current database backup, persistent uploads, public URL, application key source, and service-manager configuration.
If an account cannot recover through email, first inspect the communication provider and its delivery results. Contact support or the server administrator with the error and installation details; do not delete user tables or rerun a fresh installer on an established database.
Review access periodically
Remove departed staff access, rotate compromised credentials, and review administrator assignments. Keep portal ownership, domain ownership, infrastructure access, and CMS administration documented separately so a staffing change does not lock the organization out.