The panel shows every visitor, page and address on your site, so it is never served without a password. With no credentials configured it answers 503 and refuses to serve — an analytics dashboard left open on the internet is a data breach, and defaults decide outcomes.
HTTP Basic. Every tool that speaks HTTP signs in the same way, so curl --user and monitoring checks work.
Loghound’s own form, a real session with an idle timeout and an absolute one, and a Sign out button that destroys the session on the server. Required for two-factor and for staying signed in.
Chosen during setup, changeable afterwards in Settings › Sign-in without setting the password again. Changing it applies to the next request.
Session mode keeps its session files in the directory the FPM pool names. If you switch to it on a host where it has never been used, create that directory and give it to the service user first — the permission model has it at mode 0700, because a session file is a signed-in session.
Timeouts
Session mode only, and both enforced by the application on every request rather than left to PHP’s session garbage collector, which is best-effort by design and runs on somebody else’s request:
- Idle timeout — thirty minutes by default. Ends a session that has done nothing for that long.
- Absolute timeout — twelve hours. Ends one that long after sign-in, however busy.
An expired session is destroyed on the spot and you land back on the sign-in page, so a timeout is a door that reopens rather than a dead end.
Eight failed sign-ins from one address inside fifteen minutes lock that address out until the window passes. It applies to both modes, to the two-factor step, and to a request arriving with a stay-signed-in cookie — a stolen cookie is not a way round it.
A global counter on a login form is a denial-of-service primitive handed to anyone who can reach it: a few thousand wrong passwords from a botnet would trip it and lock the legitimate operator — whose password is correct and whose address has zero failures — out of their own panel for as long as the attacker cared to keep going. Per address, an attacker can only lock out the address they are attacking from. The cost is that a distributed guesser is not slowed by the lockout at all, only by a randomised delay and by whatever entropy is in the password. Put the panel behind an address allowlist or a VPN if that matters to you.
The counter is a file with addresses stored hashed. Nothing clears it faster than the window except deleting that file; restarting PHP-FPM does nothing to it. If the ledger cannot be written, sign-in is refused rather than allowed — a check that cannot be performed is a failed check.
In session mode the form also refuses to say which half was wrong, so it cannot be used to enumerate usernames, and a failed Basic attempt sleeps a randomised fraction of a second to blunt online guessing.
The sign-in page mode also offers Stay signed in and two-factor authentication.
Signing in
- Sign-in modes & lockout
- Stay signed in
- Two-factor