TabRe Guard - V4U.VN

Account and site security for FlatBB in one plugin: two-factor sign-in, sign-in alerts, IP bans, a scanner report and
a security check-up.

Settings → Security (one tab in the normal settings page):

Turn on two-factor authentication: scan a QR code (or type the key) into Google Authenticator, Aegis, 1Password,
Bitwarden or any other TOTP app, confirm one six-digit code, and the plugin shows eight one-time recovery codes.
The codes are stored only as password hashes and each one works once.
After the password, the sign-in asks for the six-digit code (or a recovery code) on /guard/2fa. A code is accepted
for ±30 seconds of clock drift and never twice.
Generate a new set of recovery codes, or turn two-factor off — both ask for the current password and a current code.
Sign-in alerts: an email after each sign-in with the time, IP address and browser. It can be switched off per
account; the site-wide switch lives in the plugin settings.

Admin → Plugins → Security:

Security check-up: HTTPS, clean URLs, staff accounts without two-factor, sender address, registration policy,
active bans and the last 24 hours of misses.
Blocked networks: block a single address or a CIDR range (IPv4 or IPv6) with a note and an optional expiry.
Bans are enforced in app.boot, before any handler runs. Staff are never blocked, so a wrong range cannot close
the panel; loopback and /0 ranges are rejected.
Missed addresses (scanner report): every 404 with the address, the path, the browser and a hit count, plus a
one-click Block button that prefills the CIDR range. Clearing the report is one click.

The scanner report keeps at most 5,000 rows (least visited are pruned) and drops rows older than the retention time.

Setting	Default	Meaning
Enable TabRe Guard	on	Master switch for all features.
Offer two-factor authentication	on	Show the Security tab and ask for codes at sign-in. Existing two-factor users keep their codes when this is off.
Email a notice after each sign-in	on	Site-wide switch for sign-in alerts (members can also switch their own off).
Remind staff to turn on two-factor	on	Banner on admin pages for staff without two-factor.
Enforce IP bans	on	Block banned ranges.
Record missed addresses	on	Fill the scanner report.
Keep the scanner report for (days)	60	Cleanup runs daily through the `cleanup` cron job.

The second step uses the core contract: account.login_challenge returns the URL and the plugin finishes with
login_pending_user() + login_user(). The pending sign-in expires after five minutes.
Sign-in alerts are sent with mail_send(), so a mail plugin (SMTP) takes over automatically.
When the site runs behind a proxy, set trusted proxies in the site settings so client_ip() sees the visitor's
address; bans and the report use the same address.
Two-factor secrets and recovery hashes live in plugin_tabre_guard_user. Removing the plugin deletes the tables,
which also removes everyone's two-factor setup.
The QR code is drawn locally by qrcode-generator 1.4.4 (MIT,
copyright Kazuhiko Arase), vendored in assets/vendor/. No request leaves the site while setting up.