Security Pro

Updated by Darryl Waterhouse on 13 October 2026 9 min read

Security Pro protects your site's sign-in and admin. It includes everything in the free Security plugin, and adds two-factor sign-in, a stronger firewall, country rules, breached-password checks, sessions, an audit trail and file checks.

What it does

Health check - checks what could let someone in, with a score and how to fix each problem.
Sign-in lockout - locks an account or address for a while after repeated wrong passwords, longer each time.
Password rules - a minimum length, and refusing common passwords and passwords containing the person's name or email.
Scanner guard - refuses requests for things no Domma site has (WordPress logins, .env files, database dumps) and blocks addresses that keep asking.
Two-factor sign-in - a six-digit code from an authenticator app after the password, with recovery codes. You can require it for chosen roles.
Firewall - longer bans for repeat offenders, known scanning tools blocked on sight, addresses that hit many missing pages blocked, and rate limits per address.
Country rules - allow or block countries for the admin, or for the whole site.
Breached passwords - optionally refuse passwords found in data breaches.
Sessions - every signed-in browser; end one or sign someone out everywhere.
Audit trail - who changed what, and who signed in and out.
Files - compares the CMS's own files with its published release every day.
Weekly summary - every Monday.

Security Pro replaces the free Security plugin. Its sign-in log, blocks and settings are taken over the first time Security Pro starts.

Getting started

Open Security in the sidebar. The Overview tab shows your health score and the checks.
Click a check to see why it matters and how to fix it.
Click the cog in the banner to open Security settings and review them (see Settings below).
Turn on two-factor for yourself: click Two-factor in the sidebar and follow the steps (see below).
Once you have two-factor working, require it for admin roles in Security settings > Two-factor sign-in.

The banner has two buttons: refresh (run the checks again) and the cog (Security settings).

Screens

Overview

Tiles: Health, Need attention, Failed sign-ins, 24h, Blocked now, Probes refused today and Reset requests, 24h.
Checks - worked out every ten minutes, or now with refresh. Click a check to open it. Right-click (or ⋮) for Go there, Run the checks again or Copy.

Sign-ins

Every sign-in attempt, kept for the days set in the settings.

Filter by All, Failed, Succeeded or Resets (password reset requests).
Choose a period: Last 24 hours, Last 7 days, Last 30 days or All kept.
Search by email, address or browser.

Right-click a row (or ⋮) for Only this address, Unlock this account, Block this address... and copy options. Click CSV to download the list.

Blocked

Locked after wrong passwords - right-click one (or ⋮) and choose Unlock, or click Unlock all.
Blocked for probing - addresses blocked by the scanner guard or firewall. Right-click for Unblock or Block for good.
Blocked by hand - type an address or range and a reason, then click Block. Ranges can be written as 192.168.1.*, 10.0.0.0/8 or an IPv6 prefix like 2a00:23c7:*. Right-click a rule for Remove the block.

An address someone signed in from in the last week is never blocked automatically.

Sessions

Every browser someone is signed in on, newest first. Right-click a row (or ⋮) for:

End this session - they must sign in again on that browser.
Sign them out everywhere - for example after a lost laptop.

Signing out, a new password and a password reset also end sessions.

Two-factor

Shows who uses two-factor sign-in. Right-click a person (or ⋮) and choose Reset their two-factor... if they lose their phone and their recovery codes. If their role requires two-factor, they set it up again at their next sign-in; otherwise they sign in with a password alone until they turn it on again. Click Yours to go to your own two-factor page.

Audit

Every change made through the admin, with the names of the fields changed (never their values), plus sign-ins, sign-outs and two-factor events. Admin-issued password resets are recorded too.

Filter by All, Changes, Sign-ins or Two-factor.
Choose a period, and search by who, what or address.
Click CSV or JSON to download.

Right-click an entry for Only that person, Only this address or Copy as JSON.

Files

The CMS's own files are compared every day with the published release for your version. A changed, added or missing file means someone altered the site's code - an update gone wrong, or a break-in. You get a critical notification when new differences appear.

Click Check now to check straight away.
Plugins are compared with how they were when their version was first seen on this site. If you or someone you trust changed a plugin, click Accept plugin changes... to make the current files the new starting point.
The CMS's own files cannot be accepted. Re-install the CMS instead.

Fleet

Only on the Domma site manager. Each site with Security Pro reports here every few minutes. "Not protected" means Security Pro is not on that site; "No report" means it is not running or cannot reach the manager. Right-click a site to open its own Security screen.

An address one site blocked is kept off every site only once the manager has seen it probing too, or a second site reports it - one site cannot block an address for everyone on its own. Each site contributes at most 50 addresses at a time, for up to a day.

Two-factor (your own)

Every user has a Two-factor item in the sidebar, whatever their role. Its badge shows 1 while two-factor is off for you (red if your role requires it) or your recovery codes are running out; once it is on, it shows how many recovery codes you have left.

Click Set up two-factor sign-in.
Scan the QR code with an authenticator app (for example Google or Microsoft Authenticator, 1Password or Authy). If you cannot scan it, type the key shown instead.
Type the six-digit code the app shows and click Turn on.
Save your recovery codes. They are shown only once. Copy or Download them, keep them somewhere safe away from your phone, then click I have saved them.

Each recovery code gets you in once if you lose your phone. When you sign in, you can tick "Trust this browser" to skip the code on that browser for a while (30 days unless changed in settings).

Once on, you can:

New recovery codes - replaces the old ones. You confirm with a code from your app.
Forget trusted browsers - every browser asks for a code again.
Turn off - not shown if your role requires two-factor.

Settings

Click the cog in the Security banner. All settings are in one panel called Security settings. Click Save (or press Ctrl+Enter).

Setting	Default
Lock after repeated wrong passwords	On
Wrong passwords on one account	5
Wrong passwords from one address	20
Counted over (minutes)	15
First lock (minutes); each lock after that is twice as long	1
Longest lock (minutes)	60

Password rules

Applies when a password is set or changed.

Setting	Default
Check new passwords	On
Shortest password	10
Refuse the 10,000 most common passwords	On
Refuse passwords containing the person's name or email	On

Scanners

Setting	Default
Refuse probes, and block addresses that keep probing	On
Probes before a block	5
Counted over (minutes)	10
Block for (minutes)	60
Also treat as probes	Empty
This site does serve	Empty

The last two take one path per line, starting with /. A trailing / covers everything under it. Use This site does serve for real paths that look like probes, for example /legacy/ if you host old .php pages.

Required for these roles - role names, comma-separated (for example super-admin, admin). Someone in one of these roles sets two-factor up at their next sign-in and cannot switch it off.
Trust a browser for (days) - default 30. 0 means always ask.

Firewall

Setting	Default
Longer bans for repeat offenders (15 minutes, an hour, a day, a week; forgotten after 30 days)	On
Block known scanning tools on sight	On
Block addresses that hit many missing pages	On
Missing pages before a block	30
Counted over (minutes)	5

Rate limits (visitors, not admins) - one per line: a path and how many requests one address may make, for example:

/api/forms/ 20/min
/api/search 60/min
/api/search 300/60min

The first two are the defaults. Past the limit, visitors get "429 Too Many Requests". Signed-in admins are not limited.

Countries

Choose a Rule: Off, Allow only these countries or Block these countries.
Choose what it Applies to: The admin and sign-in only or The whole site.
Enter Countries as two-letter codes, comma-separated (for example GB, IE).

Addresses the database cannot place are always let through. Be careful with "Allow only" on the admin: if you travel, you may lock yourself out (see Locked out yourself below).

The country database is downloaded the first time a rule is set (about 8 MB). Until it is on the server, the rule cannot be applied and every country is let through: the health check shows a failing Country rules check and the settings show the same line under Countries. It clears on its own once the download finishes.

Country data: IP geolocation by DB-IP, used under the Creative Commons Attribution 4.0 licence (CC BY 4.0). The free DB-IP country database is downloaded to your server and looked up there; addresses are not sent to anyone else.

Breached passwords

Refuse passwords found in data breaches - off by default. New passwords are checked against Have I Been Pwned. Only the first five characters of a hash of the password leave your server, never the password itself. If the check cannot be reached, the password is allowed.

Audit, summary and fleet

Setting	Default
Keep the audit trail (days)	180
A security summary every Monday (a notification, and an email to every admin when email is set up)	On
Report to the manager	On
Keep addresses blocked on one site off every site (on the manager, for up to a day)	On

The fleet settings only do anything on sites run by the Domma site manager.

Keeping and telling

Setting	Default
Keep the sign-in log (days)	30
Admin unused after (days) - flagged by the health check	90
Notify when an account or address is locked	On
Notify when someone signs in after many wrong passwords	On
Notify when a scanner is blocked	Off
Notify when password resets look like someone trying addresses	On

Locked out yourself?

Run one of these in the site's folder on the server. It clears lockouts and blocks, and the site notices within seconds:

node plugins/security-pro/bin/unlock.js --list
node plugins/security-pro/bin/unlock.js --all
node plugins/security-pro/bin/unlock.js --ip 81.2.69.142
node plugins/security-pro/bin/unlock.js --user you@example.com
node plugins/security-pro/bin/unlock.js --2fa you@example.com

--2fa resets that person's two-factor sign-in.

Permissions and roles

Set in System > Roles, under Plugins:

Permission	Action	Lets someone
Security	View	See the health check, sign-ins, blocks, sessions and who uses two-factor
Security	Manage	Change settings; block, unblock, unlock; end sessions; reset someone's two-factor

The admin role has both by default. The Two-factor sidebar item needs no permission: every user can manage their own two-factor.

Tips

Set up two-factor for yourself and save your recovery codes before requiring it for your own role.
Keep "Allow only these countries" to The admin and sign-in only unless you are sure.
After a suspected account compromise: check the Audit tab for what changed, use Sessions to sign the person out everywhere, and reset their password.
Review the Files tab after any update. Accept plugin changes only if you know who made them.

Limitations

Two-factor needs Domma CMS 0.84 or later. On older versions, lockout and password rules are off until you update (0.83 or later).
Breached-password checks allow the password if Have I Been Pwned cannot be reached.
Country rules cannot place every address; unknown addresses are let through.
Fleet reporting and shared blocks only work on sites run by the Domma site manager.