Site settings
Admin panel → Site settings, split across several tabs. Only the parts that need explaining are covered here.
General
| Item | Notes |
|---|---|
| Store name / title / keywords / description | Storefront display and SEO |
| Logo, background image | Desktop and mobile can be set separately |
| Storefront theme / user centre theme | Desktop and mobile separately; themes come from the app store |
| Close site | Shows a maintenance page on the storefront; the admin panel still works |
| Registration toggle / method | Turn it off to stop new sign-ups |
| Registration / login / checkout verification | CAPTCHA switches, to keep bots out |
| Email / phone verification | Whether sign-up requires verifying an email or phone number |
| Password recovery method | Email or SMS |
| Username length | Limits for new registrations |
| Session lifetime | How long before an idle user is logged out |
| Admin login verification | CAPTCHA for the admin panel |
Other
Custom payment callback domain
When you need it: the site sits behind a CDN, or the CDN's firewall makes payment callbacks slow or unreliable.
How it helps: bind a second address that reaches the server directly, such as http://123.123.123.123:41823, and enter it here. Callbacks then bypass the CDN entirely — faster and more reliable.
Does it leak my server IP? With providers that redirect through a submitted form, someone capturing traffic can see this address and therefore learn your server IP or your non-CDN domain — that is the whole of the exposure, there is no further risk. With official Alipay/WeChat integrations, or any provider where the QR code or pay URL is fetched by an internal request, the address is never exposed at all.
Either way, configuring a callback domain improves reliability, so it is recommended.
Sub-stores
Main domain, DNS CNAME, and which supplier's products to show. See sub-stores and supplier system.
Withdrawals
Methods (Alipay / WeChat / USDT / balance), minimum amount, and fees.
Top-ups
Minimum and maximum amounts, and bonus rules.
Currency
Currency code, symbol, decimal places and exchange rate. The rate means "how much CNY one unit of the site currency is worth" and applies only when submitting to a payment gateway.
Force login
Requires an account to browse the site at all.
Email
SMTP configuration. Always send a test message and confirm it arrives before enabling email notifications on products — otherwise buyers silently receive nothing and you will not know.
SMS
SMS provider configuration, used for registration verification and password recovery.
Security
| Item | Notes |
|---|---|
| Admin entrance secret | Puts a hidden door in front of /admin; without the secret the panel cannot be opened |
| IP detection mode | Behind a CDN or reverse proxy, this must be set correctly to see real visitor IPs |
| Trusted proxy IPs | Works with the setting above — only forwarded headers from these IPs are trusted |
| CSP mode | Content Security Policy. Enforcing mode blocks most injection attacks but may also block external scripts you added yourself — blocked scripts are recorded, and you allow them from the violation log |
| External link filter / allowlist | Restricts which external domains may appear on the site |
| Request log | Records request details for debugging. Logs are encrypted, with the key stored in the database |
After switching CSP to enforcing mode, click through the storefront and admin panel yourself to confirm nothing broke. Allowing a source is only possible from the violation log — there is no free-text field.
Translations
Manages multi-language strings. The system supports multiple languages, and language packs can be imported and edited here.
File manager
A built-in file manager for viewing and editing site files. Use with care — a bad edit will take the site down.
Operation log
Everything administrators do in the panel is recorded here. Useful once more than one person has access.