Admin Login Page - User Guide

Page Location: ct/admin/ctlogin.php
Menu Path: Direct URL access (login gateway)
Access Level: Public (authentication page)
Last Updated: 2026-01-01

Overview

The Admin Login page is the secure entry point to the ComusThumbz administration panel. It provides password-based authentication with advanced security features including rate limiting, brute force protection, and automatic password hash upgrades. This is the first page administrators see when accessing the backend.

[Screenshot: ctlogin-full-page]

Getting to This Page

Access the login page directly via your browser:

• URL Pattern: https://yourdomain.com/ct/admin/ctlogin.php
• Alternate: https://yourdomain.com/ct/admin/ (redirects to ctlogin.php if not authenticated)

System Requirements

PHP Requirements

Required PHP Extensions

Required PHP Functions

Folder Permissions

Server Requirements

Installation Requirements

This section documents everything the install script needs to set up this page correctly.

Database Tables

<details> <summary>SQL: Create Tables</summary>

-- Settings table (must have id=1 row with adminpassword)
-- Note: tblSettings has many columns - key ones for login:
CREATE TABLE IF NOT EXISTS tblSettings (
    id int(11) NOT NULL AUTOINCREMENT,
    adminpassword varchar(255) NOT NULL,
    version varchar(20) NOT NULL DEFAULT '1.0',
    sitename varchar(100) NOT NULL DEFAULT 'ComusThumbz',
    logins int(10) NOT NULL DEFAULT 0,
    -- ... other settings columns ...
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4unicodeci;

-- Insert default settings row if not exists
INSERT INTO tblSettings (id, adminpassword, version, sitename, logins)
VALUES (1, 'changeme', '1.0', 'ComusThumbz', 0)
ON DUPLICATE KEY UPDATE id = id;

-- Logs table for tracking login attempts
CREATE TABLE IF NOT EXISTS tblLogs (
id int(10) unsigned NOT NULL AUTOINCREMENT,
ip varchar(20) NOT NULL DEFAULT '',
date datetime NOT NULL,
status varchar(30) NOT NULL DEFAULT '',
type varchar(50) NOT NULL DEFAULT '',
info varchar(200) NOT NULL DEFAULT '',
email varchar(100) NOT NULL DEFAULT '',
WebmasterID int(10) unsigned DEFAULT NULL,
WebmasterSiteID int(10) unsigned DEFAULT NULL,
PRIMARY KEY (id),
KEY WebmasterID (WebmasterID),
KEY WebmasterSiteID (WebmasterSiteID)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4unicodeci;

-- Rate limiting table for brute force protection
CREATE TABLE IF NOT EXISTS tblCMSRateLimits (
id int(11) NOT NULL AUTOINCREMENT,
identifier varchar(255) NOT NULL,
action varchar(100) NOT NULL,
attempts int(11) DEFAULT 0,
windowstart timestamp NULL DEFAULT NULL,
blockeduntil timestamp NULL DEFAULT NULL,
PRIMARY KEY (id),
KEY identifier (identifier),
KEY windowstart (windowstart),
KEY blockeduntil (blockeduntil)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4unicodeci;

</details>

Config Settings (dat/config.inc.php)

File Dependencies

Folders Required

External Dependencies

This page has no external service dependencies.

Install Script Checklist

• [ ] Database tables created (tblSettings, tblLogs, tblCMSRateLimits)
• [ ] Default settings row inserted with id=1
• [ ] Initial admin password set in tblSettings.adminpassword
• [ ] ct/logs/ folder created with write permissions
• [ ] RateLimiter.php in ct/includes/security/

Page Layout

[Screenshot: ctlogin-annotated-layout]

Page Elements

Features & Functions

Password Authentication

The login system supports both modern hashed passwords and legacy plain-text passwords for backward compatibility.

Authentication Flow:

1. User enters password and submits form
2. System checks if IP is rate-limited (blocked)
3. If not blocked, retrieves admin password from tblSettings
4. Checks if stored password is a hash or plain text:

• Hashed: Uses passwordverify() for secure comparison
• Plain text: Direct string comparison (legacy mode)

1. On success:

• Upgrades plain text passwords to secure hashes automatically
• Sets session variables for authentication
• Sets legacy cookies for backward compatibility
• Resets rate limiter for the IP
• Logs successful login
• Redirects to main.php

1. On failure:

• Records attempt in rate limiter
• Logs failed attempt
• Shows error message with remaining attempts
• Adds 1-second delay to slow brute force attacks

Rate Limiting / Brute Force Protection

The login page includes comprehensive protection against brute force attacks:

How it works:

1. Each failed login attempt is recorded with IP address
2. After 5 failed attempts within 15 minutes, IP is blocked
3. Blocked IPs see a countdown message
4. Successful login resets the counter for that IP
5. Old records are automatically cleaned up (1% probability per request)

Session Management

On successful login, the following session variables are set:

Legacy Cookies Set:

Login Logging

All login attempts are logged to tblLogs:

Version Check

You can check the software version without logging in:

• URL: ctlogin.php?action=ver
• Response: Version: X.X.X

Step-by-Step Usage

Logging In

1. Navigate to https://yourdomain.com/ct/admin/ctlogin.php
2. Enter your admin password in the password field
3. Click the Sign In button
4. If successful, you'll be redirected to the dashboard

[Screenshot: ctlogin-password-entry]

Handling Failed Logins

If you enter the wrong password:

1. An error message appears showing remaining attempts
2. After 5 failed attempts, you'll be locked out for 15 minutes
3. Wait for the lockout to expire, or:

• Access the database directly
• Delete records from tblCMSRateLimits for your IP

[Screenshot: ctlogin-error-message]

Recovering from Lockout

If you're locked out due to too many failed attempts:

Option 1: Wait

• The lockout expires automatically after 15 minutes
• The countdown is shown in the error message

Option 2: Database Reset

-- Find and delete rate limit records for your IP

DELETE FROM tblCMSRateLimits

WHERE identifier = 'YOUR.IP.ADDRESS'

AND action = 'adminlogin';

Option 3: Reset All Rate Limits

-- Clear all rate limiting (use with caution)

TRUNCATE TABLE tblCMSRateLimits;

Changing the Admin Password

The admin password is stored in tblSettings:

-- Set a new plain-text password (will be auto-hashed on next login)
UPDATE tblSettings SET adminpassword = 'yournewpassword' WHERE id = 1;

-- Or set a pre-hashed password (more secure)
UPDATE tblSettings SET adminpassword = '$2y$10$...' WHERE id = 1;

Troubleshooting

Common Errors

Login Not Working

Problem: Correct password doesn't work.

Solutions:

1. Verify password in database:

SELECT adminpassword FROM tblSettings WHERE id = 1;

1. If it's a hash, try resetting to plain text temporarily
2. Check if rate limiting is blocking you (look in tblCMSRateLimits)
3. Verify session is working (check php.ini session settings)

Session Not Persisting

Problem: Login succeeds but you're immediately logged out.

Solutions:

1. Check PHP session configuration:

phpinfo(); // Look for session settings

1. Verify session save path is writable
2. Check for cookie domain issues (localhost vs domain)
3. Clear browser cookies and try again

Lockout Recovery

Problem: Locked out and can't remember how long to wait.

Solution:

-- Check when you'll be unblocked

SELECT identifier, blockeduntil,

       TIMESTAMPDIFF(MINUTE, NOW(), blockeduntil) as minutesremaining

FROM tblCMSRateLimits

WHERE action = 'adminlogin'

AND blockeduntil > NOW();

Security Best Practices

1. Use Strong Passwords

• Minimum 12 characters
• Mix of uppercase, lowercase, numbers, symbols
• Avoid dictionary words

1. Monitor Login Logs

• Regularly check tblLogs for failed attempts
• Watch for patterns indicating attacks
• Consider implementing IP whitelisting if needed

1. Keep Software Updated

• Password hashing algorithms are regularly improved
• Updates may include security fixes

1. Rename or Protect Admin Path

• Consider using .htaccess to add extra authentication layer
• Use IP whitelisting for admin access if possible

Related Pages

• Admin Dashboard (ct/admin/main.php) - Main admin interface after login
• System Logs (ct/admin/logs.php) - View all login attempts
• Settings (ct/admin/config.setup.php) - Configure site settings

Translatable Strings

The following text strings appear in this page and should be added to backend_translations.md:

Page Elements

• "Admin Login"
• "COMUSTHUMBZ"
• "High Powered Website Automation"
• "Password"
• "Enter your password"
• "Sign In"
• "Version"

Error Messages

• "Invalid password. You have X attempts remaining."
• "Invalid password. Too many failed attempts."
• "Too many failed login attempts. Please try again in X."
• "Database connection failed:"
• "Error: Could not fetch settings from database"

Time Formatting

• "second" / "seconds"
• "minute" / "minutes"
• "hour" / "hours"

Changelog