Hardening guide

Security

YunikEngine includes login throttling, admin route protection, response headers, HTTPS controls, blocked IPs, maintenance mode, audit logs, and comment antispam controls.

Built-In Security Controls

Admin Access

  • Control Center routes use admin authentication middleware.
  • Only users with Control Center access can manage admin modules.
  • Public users are redirected away from protected routes.

Login Protection

  • Configurable maximum login attempts.
  • Configurable throttle decay seconds.
  • Rate limiter keys use email and IP address.
  • Failed attempts are cleared after successful login.

Response Headers

  • X-Content-Type-Options.
  • Referrer-Policy.
  • Permissions-Policy.
  • X-Frame-Options.
  • Optional Content-Security-Policy.

Traffic Controls

  • Force HTTPS option.
  • Blocked IP address list.
  • Maintenance mode with public visitor blocking.
  • Admin and installation routes bypass maintenance mode.

Comment Antispam

Approval Modes

  • Manual approval for every comment.
  • Auto approve comments unless blocked by rules.
  • Trust commenters after one approved comment.

Block Lists

  • Blocked emails.
  • Wildcard email patterns.
  • Blocked IPs.
  • Wildcard IP patterns.
  • Blocked words and phrases.

Spam Checks

  • Maximum link count before spam.
  • Minimum seconds between comments by email/IP.
  • Suspicious comments can be held as spam.
  • Hard-blocked comments are not stored.

Moderation Queue

  • Pending comments await approval.
  • Approved comments render publicly.
  • Spam and blocked comments stay hidden.
  • Bulk moderation actions are available.

Production Checklist

  • Set APP_ENV=production.
  • Set APP_DEBUG=false.
  • Use HTTPS and a correct APP_URL.
  • Use strong database and SMTP credentials.
  • Cache config, routes, and views after deployment.
  • Review blocked IPs and comment security settings.
  • Keep support exports free of secrets and private credentials.