> ## Documentation Index
> Fetch the complete documentation index at: https://docs.purpify.host/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure your Purpify account

> Reset your Purpify passwords, use two-factor authentication when available, protect credentials, and recover from unauthorized access.

Use a unique password for Purpify, keep credentials out of server files and messages, and enable two-factor authentication when your account offers it.

## Reset a forgotten password

1. Open the sign-in page for the [game panel](https://panel.purpify.host) or [billing portal](https://payments.purpify.host).
2. Use the password-reset option for that service.
3. Open the reset message only from the email account connected to Purpify.
4. Choose a new password that you do not use on another website.
5. Update your password manager and remove obsolete saved credentials.

The game panel and billing portal are separate services. Reset the password for the account you cannot access.

## Enable two-factor authentication

If two-factor authentication is available in your account security settings:

<Steps>
  <Step title="Start two-factor setup">
    Open your account security settings and choose the available two-factor authentication option.
  </Step>

  <Step title="Register your authenticator">
    Scan the displayed QR code with a trusted authenticator app or enter the setup key manually.
  </Step>

  <Step title="Verify a code">
    Enter a current code to finish activation.
  </Step>

  <Step title="Store recovery codes">
    Save recovery codes in a password manager or another private location separate from the device running the authenticator.
  </Step>
</Steps>

<Note>
  If no two-factor option appears, use a unique password and protect the connected email account with two-factor authentication.
</Note>

## Protect panel and SFTP credentials

* Add people through [Subusers](/panel/team-access) instead of sharing your account.
* Use SFTP only with the host, port, and username shown by the game panel.
* Do not place passwords, database credentials, or tokens in screenshots, public logs, or Discord messages.
* Store secrets in a password manager rather than a shared text file.
* Review downloaded plugin, mod, and add-on files before giving them access to server secrets.
* Sign out on shared devices and do not let an SFTP client save credentials there.

## Handle a compromised account

<Steps>
  <Step title="Secure your email first">
    Change the email password, enable its two-factor authentication, and review its active sessions and forwarding rules.
  </Step>

  <Step title="Reset Purpify passwords">
    Reset the affected game-panel or billing password from a trusted device. End other sessions when that option is available.
  </Step>

  <Step title="Remove unknown access">
    Review shared server users and remove accounts you do not recognize. Rotate database passwords, API keys, plugin tokens, and webhooks that may have been exposed.
  </Step>

  <Step title="Preserve evidence">
    Record unexpected invoices, file changes, console commands, user accounts, and approximate times before restoring data.
  </Step>

  <Step title="Contact support">
    Open a private support ticket from the Purpify website. Include your account email, affected service, approximate time, and evidence. Never include your password or authentication codes.
  </Step>
</Steps>

After recovering access, restore a known-good [backup](/server/backups) if unauthorized changes affected the server.