Site settings

Admin panel → Site settings, split across several tabs. Only the parts that need explaining are covered here.

General

Item	Notes
Store name / title / keywords / description	Storefront display and SEO
Logo, background image	Desktop and mobile can be set separately
Storefront theme / user centre theme	Desktop and mobile separately; themes come from the app store
Close site	Shows a maintenance page on the storefront; the admin panel still works
Registration toggle / method	Turn it off to stop new sign-ups
Registration / login / checkout verification	CAPTCHA switches, to keep bots out
Email / phone verification	Whether sign-up requires verifying an email or phone number
Password recovery method	Email or SMS
Username length	Limits for new registrations
Session lifetime	How long before an idle user is logged out
Admin login verification	CAPTCHA for the admin panel

Other

Custom payment callback domain

When you need it: the site sits behind a CDN, or the CDN's firewall makes payment callbacks slow or unreliable.

How it helps: bind a second address that reaches the server directly, such as http://123.123.123.123:41823, and enter it here. Callbacks then bypass the CDN entirely — faster and more reliable.

Does it leak my server IP? With providers that redirect through a submitted form, someone capturing traffic can see this address and therefore learn your server IP or your non-CDN domain — that is the whole of the exposure, there is no further risk. With official Alipay/WeChat integrations, or any provider where the QR code or pay URL is fetched by an internal request, the address is never exposed at all.

Either way, configuring a callback domain improves reliability, so it is recommended.

Sub-stores

Main domain, DNS CNAME, and which supplier's products to show. See sub-stores and supplier system.

Promotion

The Promotion switch turns referral commission on or off for the whole site, and is on by default. When it is off, the user centre no longer shows the Promotion centre, referral links stop recording who sent the visitor, and new orders earn no referral commission. Existing referral relationships and commission already paid are not affected. See referral commission.

Withdrawals

Methods (Alipay / WeChat / USDT / balance), minimum amount, and fees.

Top-ups

Minimum and maximum amounts, and bonus rules.

Currency

Currency code, symbol, decimal places and exchange rate. The rate means "how much CNY one unit of the site currency is worth" and applies only when submitting to a payment gateway.

Force login

Requires an account to browse the site at all.

Email

SMTP configuration. Always send a test message and confirm it arrives before enabling email notifications on products — otherwise buyers silently receive nothing and you will not know.

SMS

SMS provider configuration, used for registration verification and password recovery.

Security

Item	Notes
Admin entrance secret	Puts a hidden door in front of /admin; without the secret the panel cannot be opened
Admin Idle Lock	Locks the admin panel after this many minutes without activity; unlocking takes the password or a passkey. 0–1440, default 15; 0 turns it off. See account and sign-in security
IP detection mode	Behind a CDN or reverse proxy, this must be set correctly to see real visitor IPs
Trusted proxy IPs	Works with the setting above — only forwarded headers from these IPs are trusted
CSP mode	Content Security Policy. Enforcing mode blocks most injection attacks but may also block external scripts or embedded players you added yourself — anything blocked is recorded, and you allow it from the violation log
External link filter / allowlist	Restricts which external domains may appear on the site
Request log	Records request details for debugging. Logs are encrypted, with the key stored in the database

After switching CSP to enforcing mode, click through the storefront and admin panel yourself to confirm nothing broke. Allowing a source is only possible from the violation log — there is no free-text field.

Allowing from the violation log

Violation log entries that can be allowed have an Allow button. One click adds the blocked address to the allowlist, and you choose whether to allow just that address, its directory, or the whole domain. Where the rule applies depends on the resource type:

Blocked resource	Applies to
Scripts	The storefront only. The admin panel never loads third-party scripts
Frames (iframes), stylesheets, fonts, audio/video, network requests	Both the storefront and the admin panel

Frames, audio/video and network requests already allow every https address, so what gets blocked is usually an http one — switching it to https is the better fix. Allowed addresses are listed under the allowed external resources, where you can remove them again.

Warnings in the rich-text editor

When you edit a product description or the store announcement in the admin panel, the editor warns you about external content before it causes trouble:

• A link or image uses a domain that is not on the external link allowlist — it would be stripped when you save. Click Add to Whitelist to allow that domain
• Embedded external content would be blocked by CSP (for example a video player on an http address), so visitors would not see it. Click Allow to allow it; this takes effect after a page refresh

Only the main admin account (the one created during installation) can use these two buttons; other administrators just see the warning.

Behind Amazon CloudFront

From 3.8.4, IP detection mode can be set to HTTP_CLOUDFRONT_VIEWER_ADDRESS, which reads CloudFront's CloudFront-Viewer-Address request header. CloudFront fills this header in from the viewer's actual connection, so visitors cannot forge it. Both CloudFront and the site need setting up:

1. Have CloudFront forward the header to the origin. In the distribution's Behaviors, set the origin request policy to the managed policy AllViewerAndCloudFrontHeaders-2022-06, or to a custom origin request policy that includes CloudFront-Viewer-Address. The header can only go in an origin request policy, not in a cache policy.
2. Add CloudFront's origin-facing ranges to Trusted proxy IPs. AWS publishes them in ip-ranges.json: take the entries whose service is CLOUDFRONT_ORIGIN_FACING, IPv4 and IPv6 alike. When the direct peer REMOTE_ADDR is not on the trusted list, no CDN header is read at all and REMOTE_ADDR is used.

This command prints the ranges for step 2, one per line (it needs jq). AWS changes the list from time to time, so check it again now and then:

curl -s https://ip-ranges.amazonaws.com/ip-ranges.json \
  | jq -r '(.prefixes[], .ipv6_prefixes[]) | select(.service == "CLOUDFRONT_ORIGIN_FACING") | .ip_prefix // .ipv6_prefix'

Once both are done, open this settings page through CloudFront: every option in the dropdown is followed by the IP it currently reads. If HTTP_CLOUDFRONT_VIEWER_ADDRESS shows your own IP, step 1 is working.

• Not on 3.8.4 yet: choose HTTP_X_FORWARDED_FOR with the same trusted ranges; that gives the real IP too.
• Do not rewrite CloudFront-Viewer-Address into X-Real-IP and pick HTTP_X_REAL_IP. The header is address:port, and IPv6 addresses come without brackets; only HTTP_CLOUDFRONT_VIEWER_ADDRESS strips the port correctly. Rewritten, every IPv6 visitor shows up as a CloudFront node IP.
• HTTP_CF_CONNECTING_IP is Cloudflare's header and has nothing to do with CloudFront.

Translations

Manages multi-language strings. The system supports multiple languages, and language packs can be imported and edited here.

File manager

A built-in file manager for viewing and editing site files. Use with care — a bad edit will take the site down.

Operation log

Everything administrators do in the panel is recorded here. Useful once more than one person has access.