Starting Out

 Admin Login Page - User Guide

Page Location: ct/admin/ctlogin.php
Menu Path: Direct URL access (login gateway)
Access Level: Public (authentication page)
Last Updated: 2026-01-01

Overview

The Admin Login page is the secure entry point to the ComusThumbz administration panel. It provides password-based authentication with advanced security features including rate limiting, brute force protection, and automatic password hash upgrades. This is the first page administrators see when accessing the backend.

[Screenshot: ctlogin-full-page]

Getting to This Page

Access the login page directly via your browser:

• URL Pattern: https://yourdomain.com/ct/admin/ctlogin.php
• Alternate: https://yourdomain.com/ct/admin/ (redirects to ctlogin.php if not authenticated)

System Requirements

PHP Requirements

Required PHP Extensions

Required PHP Functions

Folder Permissions

Server Requirements

Installation Requirements

This section documents everything the install script needs to set up this page correctly.

Folders Required

Page Layout

[Screenshot: ctlogin-annotated-layout]

Page Elements

Features & Functions

Password Authentication

The login system supports both modern hashed passwords and legacy plain-text passwords for backward compatibility.

Authentication Flow:

1. User enters password and submits form
2. System checks if IP is rate-limited (blocked)
3. If not blocked, retrieves admin password from tblSettings
4. Checks if stored password is a hash or plain text:

   - Hashed: Uses passwordverify() for secure comparison    - Plain text: Direct string comparison (legacy mode)

1. On success:

   - Upgrades plain text passwords to secure hashes automatically    - Sets session variables for authentication    - Sets legacy cookies for backward compatibility    - Resets rate limiter for the IP    - Logs successful login    - Redirects to main.php

1. On failure:

   - Records attempt in rate limiter    - Logs failed attempt    - Shows error message with remaining attempts    - Adds 1-second delay to slow brute force attacks

Rate Limiting / Brute Force Protection

The login page includes comprehensive protection against brute force attacks:

How it works:

1. Each failed login attempt is recorded with IP address
2. After 5 failed attempts within 15 minutes, IP is blocked
3. Blocked IPs see a countdown message
4. Successful login resets the counter for that IP
5. Old records are automatically cleaned up (1% probability per request)

Step-by-Step Usage

Logging In

1. Navigate to https://yourdomain.com/ct/admin/ctlogin.php
2. Enter your admin password in the password field
3. Click the Sign In button
4. If successful, you'll be redirected to the dashboard

[Screenshot: ctlogin-password-entry]

Handling Failed Logins

If you enter the wrong password:

1. An error message appears showing remaining attempts
2. After 5 failed attempts, you'll be locked out for 15 minutes
3. Wait for the lockout to expire, or:

   - Access the database directly    - Delete records from tblCMSRateLimits for your IP

[Screenshot: ctlogin-error-message]

Recovering from Lockout

If you're locked out due to too many failed attempts:

Wait

• The lockout expires automatically after 15 minutes
• The countdown is shown in the error message

Troubleshooting

Common Errors

Login Not Working

Problem: Correct password doesn't work.

Solutions:

1. Verify password in database:

   SELECT adminpassword FROM tblSettings WHERE id = 1;

   

1. If it's a hash, try resetting to plain text temporarily
2. Check if rate limiting is blocking you (look in tblCMSRateLimits)
3. Verify session is working (check php.ini session settings)

Session Not Persisting

Problem: Login succeeds but you're immediately logged out.

Solutions:

1. Check PHP session configuration:

   phpinfo(); // Look for session settings

   

1. Verify session save path is writable
2. Check for cookie domain issues (localhost vs domain)
3. Clear browser cookies and try again

Lockout Recovery

Problem: Locked out and can't remember how long to wait.

Solution:

-- Check when you'll be unblocked

SELECT identifier, blockeduntil,

       TIMESTAMPDIFF(MINUTE, NOW(), blockeduntil) as minutesremaining

FROM tblCMSRateLimits

WHERE action = 'adminlogin'

AND blockeduntil > NOW();

Security Best Practices

1. Use Strong Passwords

   - Minimum 12 characters    - Mix of uppercase, lowercase, numbers, symbols    - Avoid dictionary words

1. Monitor Login Logs

   - Regularly check tblLogs for failed attempts    - Watch for patterns indicating attacks    - Consider implementing IP whitelisting if needed

1. Keep Software Updated

   - Password hashing algorithms are regularly improved    - Updates may include security fixes

1. Rename or Protect Admin Path

   - Consider using .htaccess to add extra authentication layer    - Use IP whitelisting for admin access if possible

Changelog