Enterprise-grade security, on by default

Security isn't a feature bolted on later — it's the foundation of MediaPress V6. Failed-login protection, IP restriction, password policy, API rate limits and browser security headers — all managed from the panel and live moments after you save.

Layered security flow: an incoming request (visitor or bot) passes the network layer (IP restriction, rate limit), the identity layer (lockout, password policy, 2FA) and the browser layer (security headers, CSP) before reaching the protected app and data — each layer is independent, so if one is breached the next stops it.

How you manage security in the panel

Server & application hardening

Failed-login protection & admin IP restriction

Repeated failed logins from the same IP are temporarily blocked (brute-force protection); you set the attempt limit, counting window and block duration from the panel. A per-account lock always runs independently. You can restrict admin-panel access to only the IPs you allow (IPv4/IPv6/CIDR), and optionally apply the same restriction to the login API.

Password policy

You define minimum length and uppercase / lowercase / digit / special-character requirements for admin passwords; using the email inside the password is blocked. Rules apply to newly set or changed passwords.

API & rate limit

A max-requests-per-window limit for the general API; authenticated users and media files can be exempted. A separate limit for public form submissions (max submissions per window) protects against spam and automated bots.

Security headers (HTTP)

Browser security headers such as HSTS, clickjacking protection (X-Frame-Options), MIME nosniff, Referrer-Policy and Permissions-Policy are managed from the panel. Once saved, they apply automatically to the site's HTML responses.

Content Security Policy (CSP)

Limits which origins may load scripts, styles, images and iframes on the page, protecting against XSS. Ready-made allowance presets for Google Tag Manager, Analytics and YouTube/Vimeo; enable it in "Report-Only" mode first, then switch to enforcing once the site runs clean.