Security

Layers that protect sign-in, sessions, data and integrations.

Sign-in protection#

The sign-in form is protected against automated and brute-force attempts out of the box:

The limits live in config/botguard.php.

Turn on Cloudflare Turnstile#

1. Create a free Turnstile site at Cloudflare and copy the Site key and Secret key.
2. Open the .env file in the Qorex folder and add TURNSTILE_SITE_KEY=your-site-key and TURNSTILE_SECRET_KEY=your-secret-key.
3. Clear the cache with php artisan optimize:clear (over SSH) or ask your host to. The security check now appears on the sign-in form.

Forgot password#

The sign-in page has a Forgot password? link. The person enters their email and receives a link, valid for 60 minutes, to choose a new password. For safety:

• The page gives the same answer whether or not the email belongs to an account, so it cannot be used to find accounts.
• Requests are limited per address and protected by the same bot checks as sign-in.
• The new password must follow your Settings → Password policy, including the rule against reusing recent passwords.
• Choosing a new password signs the person out everywhere else.
• Deactivated accounts cannot recover access this way.
• Two-factor authentication still applies after a reset.

The email is sent with your mail settings (Settings → Mail). If the link does not arrive, see troubleshooting.

Public sign-up#

Public sign-up (the /register page, which creates a new company) is off by default. Add your own staff under Settings → Users. Switch sign-up on only if you sell Qorex as a service: set QOREX_REGISTRATION=true in .env. When it is on, the form has the same bot checks as sign-in and is limited to 6 requests a minute. It is always off on a demo site.

Outgoing connections#

Webhooks and custom SMS gateways make your server call an address you type in. Qorex refuses addresses that point at the server itself or at a private network (for example localhost, 127.0.0.1, 10.x.x.x, 192.168.x.x or cloud metadata addresses), checks again when the call is made, and does not follow redirects. A blocked webhook shows the reason in its Delivery history. If you really need to reach a system on your own network, set QOREX_ALLOW_PRIVATE_URLS=true in .env.

Browser security headers#

Qorex sends standard headers on every page: X-Frame-Options (stops other sites framing your pages), X-Content-Type-Options, Referrer-Policy, Permissions-Policy and, on HTTPS, Strict-Transport-Security. Switch them off only if your web server already sets them: QOREX_SECURITY_HEADERS=false.

Security check#

Run this over SSH for a quick health check of the settings that matter:

php artisan qorex:security-check

It checks debug mode, HTTPS, secure cookies, session storage, security headers, public sign-up, file permissions, and whether a leftover demo account exists, and tells you what to fix.

Running a public demo#

Set QOREX_DEMO=true in .env to run a safe public demo. Every business feature stays fully open: sales, POS, products, stock, purchasing, customers, delivery, accounting, HR, reports and printing. Everyday preferences stay open too: tax rates, invoice and receipt layout, POS rules, barcode labels, payment terms, custom fields, loyalty and theme.

Only what could expose the server, send mail to strangers, lock other visitors out or break the demo for the next person is read-only:

• Security and sign-in: API keys and webhooks, IP restrictions, password policy, sessions, two-factor, single sign-on, audit log and data retention.
• People and company structure: users, roles, branches, brands and companies.
• Outgoing connections: mail, SMS, notifications, payment gateways, couriers, printers, scheduled reports and the daily summary.
• System tools: backups, updates, add-ons, licence, import and export, demo data and languages.
• Settings other features depend on: modules, currencies, fiscal years, approvals, document numbering, business hours and branding.
• The signed-in account: profile, password and two-factor. Sign-up and forgot-password are switched off.

Viewing those pages still works, so visitors can see how the product is set up. A changing action shows a friendly popup saying it is a demo site. Never run a demo with real customer data.

Two-factor authentication#

Where Settings → Two-factor authentication

Adds a 6-digit code from an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) after the password. People turn it on from their profile: Profile → Two-factor, scan the QR code and enter the code. Each person also gets one-time recovery codes for a lost phone.

Password policy#

Where Settings → Password policy

Rules every new password must follow at sign-up, password change and in the profile. Start from a strength level, then fine-tune.

Sessions#

Where Settings → Sessions

IP restrictions#

Where Settings → IP restrictions

Allow sign-in only from your shop, office or VPN. Add a single address or a range such as 203.0.113.0/24. Add my IP fills in the one you are on now. You cannot lock yourself out: your own address must stay allowed. Also apply to API keys extends the rule to API access. Check an IP tells you whether an address would be allowed.

Single sign-on#

Where Settings → Single sign-on

Let people sign in with Google or Microsoft. The page shows the exact Redirect URL to copy.

Google (Workspace and Gmail)#

1. Open Google Cloud Console → APIs & Services → Credentials.
2. Create an OAuth client ID of type Web application.
3. Paste the redirect URL into Authorised redirect URIs.
4. Copy the Client ID and Client secret into Qorex.

Microsoft 365 / Entra ID#

1. Open Microsoft Entra → App registrations → New registration.
2. Add the redirect URL as a Web redirect URI.
3. Under Certificates & secrets create a client secret.
4. Copy the Application (client) ID, Directory (tenant) ID and secret into Qorex.

You can restrict sign-in to specific domains. A provider that is set up and switched on appears as a Continue with… button on the sign-in page.

Audit log and data retention#

Where Settings → Audit log settings

A record of who did what and when, for accountability and audits. Choose what to record, whether to record IP address and device (turn off if your privacy policy does not allow it), and how long to keep entries: 3 months, 6 months, 1 year, 2 years, 5 years or 7 years. Old entries are removed every night. Press Remove now to clear them immediately. Open the Activity log to read entries.

Where Settings → Data retention policy

Choose how long other kinds of data are kept and when automatic deletion runs. Run Now triggers the clean-up.

API keys and webhooks#

Where Settings → API keys

Create an API key with a name, permissions (or full access) and an optional expiry. Revoke it at any time. The key is shown only once, so copy it. Treat keys like passwords.

The REST API (version 1) lets other systems read and update data with an API key: me, products (list, view, update), stock, categories, warehouses, customers (list, view, create, update), sales (list, view), sale returns, purchases (list, view) and expenses. The page also links to an API guide.

Webhooks make Qorex call your URL the moment something happens. Each delivery is signed, logged and retried. Add a webhook with a URL and a description, copy its signing secret to verify requests, press Send test, and read the Delivery history. A webhook that fails repeatedly is flagged as unreachable; check that the URL answers with a 2xx status. You can generate a new secret, but your receiving app must be updated.

Hardening checklist#

• Use HTTPS everywhere.
• Keep public sign-up off unless you sell Qorex as a service.
• Turn on two-factor sign-in for administrators and make it required.
• Set a password policy of 12 characters or more.
• Limit sign-in to known networks if you can.
• Turn on Cloudflare Turnstile if your login page is under attack.
• Delete the default demo account on a live site.
• Keep PHP and the database updated.
• Keep regular backups and download them off the server.
• Review the audit log from time to time.
• Run php artisan qorex:security-check after each change.