WHMAZ serves two separate interfaces from the same installation, each with its own login page.

Client portal

https://yourdomain.com/auth/login

This is where your customers register, order services, view their invoices and open tickets. The login page offers Remember Me, Forgot Password and a Register link for new accounts.

Admin portal

https://yourdomain.com/whmazadmin/authenticate/login

This is your staff interface — customers, orders, packages, invoices, tickets and settings. If you have configured Google reCAPTCHA in Settings → General, the admin login also shows an I am not a robot checkbox.

Keeping the admin portal quiet

• Do not link to the admin URL from your public website.
• Enable reCAPTCHA on the admin login — it is the single cheapest defence against credential stuffing.
• Consider restricting the admin path by IP address at the web server level if your staff work from fixed addresses.

Built-in protections

• CSRF protection on all forms
• Output sanitisation to prevent cross-site scripting
• Database-backed session storage
• bcrypt password hashing with strength requirements
• Login attempt limiting against brute force