Security
Bans with a ban page or a fake error, IP blocks, captcha, change cooldowns and registration.
Bans
Stratum → Users & Security → Bans. Ban a user, an IP address or an email address, for a set time or for good.
- A banned visitor sees a ban page with the reason, or a fake error page if you do not want them to know.
- Bans apply on every page and API call.
- Lifting and deleting bans are separate permissions.
Security settings
Users & Security → Security:
- Captcha on sign-in and sign-up (or Cloudflare Turnstile).
- IP blocks: block single IPs or ranges.
- Change cooldowns: how often a user may change things like their email, password or server name. Stops abuse and mistakes in a row.
The SSH key page of user accounts can be turned off under Appearance → Account page, if you do not use SFTP keys.
Registration
Appearance → Account page (or System → Features → Registration): let people create accounts themselves at /register. Limit sign-up to certain email domains if you like. Referral links use the same page.
Suggestions
Use the fake error page for ban evaders. They tend to try again less when they think the panel is broken.