Administrator passwords and security
Qwwwik has one administrator password, used to protect the pages where the website is managed. Qwwwik does not use a database. The password is not stored as readable text, and Qwwwik does not need a separate password-making page.
1. Creating the password when Qwwwik is installed
During the first installation, enter a password and confirm it. PHP turns that password into a secure hash — a one-way representation used to check the password later. PHP handles the salt automatically. The original password is not written into the settings or sent by email.
The hash is saved in /admin/password.php. The file is created for that particular installation and should not be included in a copy of Qwwwik supplied to somebody else. The installer accepts passwords between 12 and 72 bytes long (roughly 12 to 72 characters when using ordinary English letters).
Once that file exists, install.php refuses to install Qwwwik again or replace the password. Setup normally deletes install.php when configuration is complete. The separate installer preview can still be used to check the styling.
2. Logging in and logging out
At the administrator login page, enter the password. Qwwwik asks PHP to check it against the saved hash. If it matches, PHP starts an authenticated session. The browser keeps a session cookie, while the information that permits access stays on the server.
Each Qwwwik installation has its own administrator session, so logging into one installed copy does not automatically log you into another. A login lasts for up to seven days from sign-in, subject to the server retaining the session. Logging out ends the session.
Administrator forms also contain a hidden security token which Qwwwik checks when a form is submitted. This helps prevent another website from causing your browser to submit an administrator action without your knowledge. If a form has become out of date after logging out or changing a password, reload it and try again.
3. Changing a password you still know
While logged in, go to Setup and select Optional new password. Enter the current password, then enter and confirm a different new password.
Qwwwik checks the old password before saving a new hash to /admin/password.php. Any previous administrator sessions are then invalidated, including the one you were using, so you sign in again with the new password. This ensures that someone still using an old login session cannot continue to manage the site.
4. Recovering a forgotten password
On the administrator login page, select Forgotten your password? and submit a reset request. Qwwwik sends a recovery email to the single administrator email address saved under Setup. Because there is only one administrator, you do not need to type an email address into the recovery form.
The email contains a special link which is valid for 30 minutes and can be used once. Following it opens a page where you enter and confirm a replacement password. When the new password is saved, older administrator sessions are invalidated and you can log in again.
The link uses an unpredictable token. Qwwwik keeps only a hash of that token in a temporary recovery-state file; it does not store or email the password. To limit repeated requests, another recovery email is not generated immediately: the interval is five minutes.
Email recovery requires a correctly configured administrator email address, an HTTPS website and working email delivery from the hosting server. Check the spam folder if the message does not arrive. If email recovery is unavailable, access must be restored through the hosting account or with help from the hosting provider.
Which files do what?
/admin/password.php holds the installed site's password hash. /admin/top.php checks login and session status. /admin/change-password.php, forgot-password.php and reset-password.php provide the password screens. /admin/password-recovery-state.php contains the recovery functions; its similarly named .qwwwik-reset-state.php is generated as needed to hold temporary reset information.
The generated password and reset-state files belong to the individual installation, not to the master distribution. Qwwwik's separate facility for password-protecting individual public pages is not the same as the administrator login.
These measures improve protection, but keep using a unique password, HTTPS, current server software and sensible backups. No website security system is a substitute for those basics.