Security
Security
Start by protecting your own account, saving recovery codes, and testing a second login. Then choose the control that matches the problem you need to solve.
Login protection guides
- Repeated failed logins: Brute-force protection.
- Unexpected locations or devices: Anomalous logins.
- A different login address: Custom login path.
- Restricting login or admin networks: IP access rules.
- Common usernames under attack: Username hygiene and Attack target reports.
- Password reuse risk: Breached passwords.
- Location information missing from login activity: Geo database.
Investigate a site
- Review Audit Log for the time and account involved.
- Check File Integrity for unexpected file changes.
- Run Known-threat detection for supported threat rules.
- Use Incident response if accounts need to be locked or sessions revoked.
For example, an unexpected location can come from a VPN. Check the account's sessions and recent changes before treating that location alone as compromise.
Move the encryption key to wp-config.php
If Awthy warns that its encryption key is stored in the database, ask the hosting operator to move the existing
key to AWTHY_ENCRYPTION_KEY in wp-config.php. Keep a private recoverable copy before changing configuration.
Do not generate a replacement key: existing authenticator secrets depend on the current key.
After the move, confirm the key notice is gone and a protected test account can still sign in. Keep configuration backups private. Never send the key, authenticator QR codes, or recovery codes to support.
Report a vulnerability
Email suspected Awthy vulnerabilities to security@awthy.com. Include the affected version, the behavior, and safe reproduction steps. Do not send credentials, private customer records, or active recovery links.