Security and operations

Turn on two-factor sign-in for administrators Two-factor protects the accounts that can refund money and read every client record. It takes ten minutes; plan how a lost phone is recovered first.

Administrator roles and permissions Every administrator has their own account, and every account carries a role: a named set of 181 permissions, grouped by area.

What the shipped .htaccess protects Since 1.11.0 WBAMS ships protective rules in the root .htaccess, outside the managed-rules markers so they survive when WBAMS rewrites its own rules.

Sign-in and password-reset limits Wrong client sign-ins are limited wherever they come from: the sign-in page, the cart and the client API.

Troubleshooting: where to look first Most problems announce their cause in a log. Reproduce precisely, read the logs, then change the smallest thing.