Recent changes
Wednesday November 04 2026
-
Deactivate and move a leaver Updated Markdown page
Step by step - switch on Deactivate and move, create the hidden group for deactivated accounts, and retire a leaver's account reversibly so its content, versions and audit history stay intact.
-
Export the account list for a review Updated Markdown page
Step by step - export every account, or a filtered set, as CSV from Users > Check user accounts for an access review, with what the file contains, who may include e-mail addresses, and how to handle it as personal data.
-
Find accounts not used for months Updated Markdown page
Step by step - list staff accounts nobody has used for a chosen number of days, or never used, with Users > Check user accounts, confirm with the departments, and disable them.
-
Give a colleague cache-clearing rights Updated Markdown page
Step by step - let a web team member clear caches from Setup > Cache management with the single function setup/managecache, without settings or full access, and explain what they should and should not clear.
-
Give an approver rights Updated Markdown page
Step by step - make a colleague an approver of content before publication by adding them to the approvers' group named in the Approve event and making sure the group's role opens the collaboration inbox and pending…
-
Give an auditor read access to the audit trail Updated Markdown page
Step by step - create a read-only "Auditor" role with audit/read limited by channel, masked log access and version reading, assign it to an auditors' group, and check that nothing can be changed.
-
Give log access without admin rights Updated Markdown page
Step by step - let a developer, support engineer or operator read Setup > Log files, the error digest and log health with personal data masked, without full access, and decide separately about managing and unmasking…
-
Help a user who lost their phone Updated Markdown page
Step by step - after verifying the person, switch their two-step sign-in to e-mail codes or off by editing the Two-step sign-in field of their user object, let them sign in and set up the app again, and record it.
-
Keep editors out of the admin siteaccess Updated Markdown page
Step by step - limit the user/login policy of editor roles to the editor or public siteaccess with the SiteAccess limitation, so only the web team and administrators sign in to the administration.
-
Let a contractor edit only one folder Updated Markdown page
Step by step - give an agency or contractor personal accounts in a contract group, a narrow content role assigned to one folder, approval of everything they publish, and a clean end on the contract's last day.
-
Let visitors read a new section Updated Markdown page
Step by step - when a new public section (for example "Public documents") shows nothing to visitors, add it to the Anonymous role's content/read policy, and check the result in a private window.
-
Move a staff member to another department Updated Markdown page
Step by step - move a colleague's account from one department's user group to another so the old department's rights end and the new one's begin, including approver duties and content handover.
-
Remove a leaver Updated Markdown page
Step by step - on a staff member's last day, disable the account so it cannot sign in, hand over drafts and approvals, remove direct assignments, and decide whether to retire the account or remove it for good.
-
Remove a role assignment Updated Markdown page
Step by step - take a role away from a user or a group on the role page with Remove selected, clean up assignments whose user or group no longer exists, and check the access is gone.
-
Reset a password from the command line Updated Markdown page
Step by step - set a new password for any account, including a lost administrator password, with bin/php/resetuserpassword.php, generating a random password so nothing lands in the shell history.
-
Reset a staff password Updated Markdown page
Step by step - help a colleague who cannot sign in, either through Forgot password or by setting a new password on their account page, after verifying who is asking, with what the system does for you afterwards.
-
Set up a review state group Updated Markdown page
Step by step - create a "Review" state group with Draft, In review and Approved, mark existing public content Approved first, then let visitors read only approved content and give authors and reviewers the right state…
-
Set up an approval workflow for a section Updated Markdown page
Step by step - create a workflow with an Approve event for one section, connect it to Before publishing content, make sure the workflow cronjob runs, and test it with a non-approver.
-
Switch on account lockout Updated Markdown page
Step by step - lock accounts after a number of failed sign-ins with MaxNumberOfFailedLogin, exempt trusted office networks, decide what users are told, and plan how locked staff get unlocked.
-
Turn on two-step sign-in for staff Updated Markdown page
Step by step - check the 2FA extension and login handler, add the field to the user class, give every staff role user2fa/setup and user2fa/verify, encrypt the secrets, enroll administrators first, then require it with…