Home/Security

Your data, your server, your rules

Safe by default, with the controls an administrator expects and a command that checks your own installation.

Why you need it

The problems this module removes

Weak sign-in

Without it: passwords are guessed by bots.

With Qorex: attempt limits, honeypot, two-factor and single sign-on.

Over-broad access

Without it: staff can see and change too much.

With Qorex: nine ready roles and a full permission grid.

No trail

Without it: nobody knows who changed what.

With Qorex: an audit log with retention you control.

Layers

Four layers of protection, on from day one

Sign-inAttempt limits, honeypot, minimum-time check, optional Turnstile, two-factor and single sign-on.

AccessNine ready roles, a permission grid, branch limits, IP restrictions and session policies.

DataAudit log, encrypted gateway keys, scheduled backups and separation between companies.

PlatformSigned updates, security headers and a guard that stops calls to private networks.

Built in

Controls an administrator expects, on from day one

Protected sign-in

Failed attempts are limited per email and address, a hidden honeypot catches bots, forms submitted too fast are rejected, and optional Cloudflare Turnstile adds a CAPTCHA.

Two-factor authentication

Authenticator codes with one-time recovery codes. Make it required for everyone or for chosen roles, with a grace period.

Single sign-on

Let people sign in with Google or Microsoft 365, restricted to your domains if you like.

Roles & permissions

Nine ready roles and a grid of view, create, edit and delete across every module. Staff can also be limited to branches.

Sessions & passwords

Idle sign-out, a limit on devices per person, sign out other devices, and a password policy with expiry and no reuse.

IP restrictions

Allow sign-in only from your shop, office or VPN. Add single addresses or ranges and test an address before you save.

Audit log

A record of who did what and when, kept from three months to seven years, with an option to leave out IP and device.

API keys & signed webhooks

Keys with permissions and expiry. Webhooks are signed, logged and retried, with a delivery history.

Signed updates & backups

Updates are verified against a digital signature, install in one click after an automatic backup, and keep your data.

Safe by default

The details that are easy to miss

Qorex ships with these protections already switched on, and a command that checks your own installation.

Forgot passwordAn emailed link valid for 60 minutes. The page never reveals whether an email has an account, requests are rate-limited, and the new password must follow your policy.

Sign-up off by defaultPublic sign-up is switched off. Add your own staff, and turn sign-up on only if you sell Qorex as a service.

Outgoing connectionsWebhooks and custom SMS gateways cannot be pointed at the server itself or a private network, are re-checked when called, and do not follow redirects.

Browser headersStandard security headers on every page, plus Strict-Transport-Security on HTTPS.

Tenant separationCompany data is separated by a rule that blocks access when no company is active.

Security checkRun one command to check debug mode, HTTPS, cookies, headers, sign-up, permissions and leftovers.

Check your own site

One command, plain answers

Pass, warn or fail for the settings that matter, with what to fix.

$ php artisan qorex:security-check
Debug mode off · HTTPS · Secure cookie · Sessions in database · Security headers · Public sign-up · File permissions
All good.

Keep exploring

Ready to run your whole business on one platform?

Try the live demo with a ready-made login, then choose the plan that fits.

See the plans Open the live demo