Staff users and roles

Staff users

Open Staff Management from the menu under your name (top right). Only a Super Admin sees it and can use it. The page has two columns: the Add Staff form on the left (name, email, password and the roles to give) and the list of staff on the right.

• What staff see: when staff sign in they see and can open only what their roles allow. Their roles are shown under their name at the top.
• Edit: change the name, email, password or roles. Changing the password signs the person out of every open session.
• Restrict: blocks the person from signing in and ends any open session straight away, but keeps their account and everything they did. Their activity logs stay until you clear the logs. Use Allow sign-in again to undo it.
• Delete: removes the account. Their activity logs are kept with their name.
• You cannot restrict or delete your own account, or the last active Super Admin.

Give each person their own account. Shared accounts make the activity log useless.

Roles and permissions

Settings > Security & Roles lists the roles. A role is a set of permissions. WHBMP ships with Super Admin and Support Staff; you can create more.

• Super Admin always has every permission and cannot be edited.
• A permission is a checkbox. If it is unchecked, the person does not get access: the menu entry is hidden and the page returns "forbidden" even if they type the address.

The permissions are grouped:

• Sections: Clients, Orders, Services, Domains, Billing, Support, Reports and Plugins.
• Settings pages: each page under Settings has its own checkbox, so a role can open Servers but not License, or Support Departments but not Payment Gateways.
• Dashboard cards: which cards the role sees on the dashboard.

A person with none of these can still sign in, see the dashboard and change their own account.

Dashboard setup

Every staff member can choose which dashboard cards they see and in what order from the dashboard's Dashboard Setup page. A card also needs the matching section permission.

Security for staff

• Turn on two-factor authentication with the Google Authenticator 2FA plugin. See Google Authenticator 2FA.
• Optionally let staff sign in with an email code (General Settings > Security > Email OTP Login).
• Restrict logins by IP with Whitelisted IPs.
• Failed sign-ins ban the IP for the time you set.

Good practice

• Keep one Super Admin for emergencies and use named accounts for daily work.
• Give support staff the Support section and nothing in Settings.
• Review Settings > System Logs > Activity to see who did what.