This guide covers all essential security features available in the Security settings of the Reseller Dashboard to protect user accounts and prevent unauthorized access.
Resellers can monitor account activity through Logged-in Devices and Login Activity, enforce stronger authentication using 2FA, OTP, and Email Verification, and manage access via Direct Login with a built-in kill switch.
With the addition of IP Manager, resellers can now control access based on IP addresses— whitelisting or blacklisting login, direct login, and API usagefor enhanced security and control.
To prevent bots and automated attacks, CAPTCHA solutions likeCloudflare Turnstile and Google reCAPTCHA can be configured.
By combining these tools and following best practices, resellers can maintain a secure, controlled, and reliable environment for all users.
Last Updated : 20 Apr 2026
This guide provides a technical overview of all security settings available from the Reseller Dashboard. Each setting can be configured to ensure end-user accounts remain secure and compliant with best practices.
Centralized Privacy and Security Management for Resellers
Logged-in Devices
Location: Settings & Integrations > Security > Logged-in Devices
Description:
The Logged-in Devices feature provides a comprehensive, real-time view of all active sessions associated with a user account. This allows resellers and also end users to monitor exactly which devices are accessing the account, including details about location, device type, browser, and activity times.
By giving visibility into all active sessions, this feature helps identify suspicious or unauthorized logins. Resellers & users can now log out from a specific device, providing precise control over their account access without affecting other active sessions. This action immediately invalidates the selected session on the server, ensuring that the device can no longer access the account.
Information Displayed:
- Last Active:Timestamp of the most recent activity on the session which updates hourly
- First Activity: Date & Time when the session was first initiated
- IP Address:IP used for the session
- Country:Geographic location of the session
- Platform:Operating system (e.g., Windows, OS X)
- Device:Type of device (Desktop, Mobile, Tablet)
- Browser:Browser used for login (e.g., Chrome, Firefox)
- Timezone:Local timezone of the session
- Action:Option to log out the session individually
Reseller Capabilities:
- Monitor all active sessions for the account in real time
- Log out from a specific device to revoke access instantly
- Detect and respond to unusual login activity, such as unexpected IP addresses or unknown devices
Benefits:
- Quickly terminate suspicious or unauthorized sessions
- Maintain real-time control over account access
- Enhance overall account security and prevent unauthorized access
Login Activity
Location: Settings & Integrations > Security > Login Activity
Description:
Login Activity is a real-time audit log that records all account access events, including successful logins, logouts, and access attempts. It provides detailed visibility into when and how an account is accessed, helping identify unusual or unauthorized activity.
Information Displayed:
- Time – Timestamp of the event
- Event – Type of activity (e.g., login, logout, failed login etc)
- IP Address – IP used during the session
- Country – Geographic location of the access
- Platform – Operating system (e.g., Windows, macOS)
- Device – Device type (Desktop, Mobile, Tablet)
- Browser – Browser used (e.g., Chrome, Firefox)
- Timezone – Local timezone of the session
Reseller Capabilities:
- Monitor all login and access events in real time
- Analyze user activity based on device, location, and IP data
- Detect suspicious patterns such as unknown devices, unusual locations or failed login attempts
Benefits:
- Provides full transparency of account access
- Helps identify unauthorized or suspicious login attempts
- Supports security audits and compliance monitoring
Direct Login
Location: Settings & Integrations → Security → Direct Login
Description:Direct Login is a specialized access feature that allows users to log in using a unique, secure URL, without requiring a password or Two-Factor Authentication (2FA).This is primarily designed for developers, system integrations, or controlled team access where quick and seamless entry is required.
How It Works:Direct Login operates through a secure link-based authentication system. Access depends entirely on the global toggle in Security Settings:
| Setting | Status | Result |
|---|---|---|
| Enabled | Active | Users or systems with a valid Direct Login URL can access the account without password or 2FA. |
| Disabled | Inactive | All Direct Login links are immediately deactivated. Access via URL is blocked, and standard login (email & password) is required. |
Configuration Options:
- Enable / Disable Direct Login (Master Toggle)
- Acts as a global control for all Direct Login access.
Reseller Capabilities:
- Enable Direct Login for New Users by Default: Automatically allow Direct Login access for newly created user accounts. If not enabled, new users will not have Direct Login access.
- Allow Admin Direct Login (Support Access): Enable administrators to securely access user accounts via a Direct Login link for support, troubleshooting, or management purposes.
Security Considerations:
The master toggle functions as a global kill switch, instantly disabling all active Direct Login URLs. When not enabled, no existing link can be used to access the account.Direct Login bypasses standard authentication (password & 2FA), so it should only be used in trusted environments
Benefits:
- Enables seamless access for integrations and automation
- Reduces friction for internal team workflows
- Provides instant control over access via a single toggle
Two-Factor Authentication (2FA)
Location: Settings & Integrations → Security → Two-Factor Authentication
Description:Two-Factor Authentication (2FA) adds an extra layer of security by requiring users to complete an additional verification step after entering their password.This ensures that even if a password is compromised, unauthorized access is prevented without the second verification step.
Configuration Options:
- Force 2FA Authentication for Users: When enabled, all users are required to set up and use 2FA for their accounts.
- Hide 2FA Setup Message: Allows you to hide the 2FA setup prompt from the user interface (useful for custom onboarding flows or controlled rollouts).
Reseller Capabilities:
- Force 2FA enforcement for client accounts
- Hide or keep the 2FA setup message for users
Benefits:
- Adds a strong second layer of account protection
- Prevents unauthorized access even if login credentials are exposed
- Improves overall account security across all users
IP Manager
Location: Settings & Integrations → Security → IP Manager
Description:
IP Manager allows you to control access to your platform based on specific IP addresses. By defining whitelist or blacklist rules, you can restrict or allow access to key system functions such as login, direct login, and API requests. This helps protect accounts from unauthorized access, limit usage to trusted environments, and secure integrations.
Configuration overview
To configure IP-based access control, you need to:
Add an IP Address:Specify the IP you want to allow or restrict.
Select Rule Type:
- Whitelist → Allows access for the selected IP
- Blacklist → Blocks access for the selected features
Set Status
- Active → Rule is enforced
- Inactive → Rule is disabled
Select Access Scope
Choose where the rule will apply:
- Login → Controls standard login (email/password)
- Direct Login → Controls access via Direct Login URL
- API → Controls programmatic access (API calls, webhooks, integrations)
How It Works:
Whitelist Rule:Grants access to the selected features from the specified IP.
Blacklist Rule:Blocks access to the selected features from the specified IP.
API Access Behavior:If no IP rules are applied to API access, requests are allowed by default.
Restrictions are enforced only when specific whitelist or blacklist rules are configured.
Example:
Suppose you configure the following:
- IP Address: 192.168.1.100.12
- Rule Type: Blacklist
- Status: Active
- Selected Features: Login, Direct Login, API
👉 Result:
- The user cannot log in from this IP using email/password
- The user cannot access the account via Direct Login URL
- Any API requests or integrations from this IP will be blocked
Reseller Capabilities:
- Define IP-based access rules only for client accounts
- Control login, direct login, and API access separately
- Enable or disable rules instantly using status toggle
Benefits:
- Restrict access to trusted IP addresses only
- Block suspicious or unauthorized sources
- Secure API and integration endpoints
- Enhance overall platform security with granular control
OTP Verification
Location: Settings & Integrations → Security → OTP Verification
Description:OTP (One-Time Password) Verification adds an extra layer of security during user signup by requiring users to verify their identity using a time-sensitive code sent via WhatsApp.This ensures that only users with access to the provided phone number can successfully complete registration.
Configuration Options:
- Force WhatsApp OTP Verification on Signup:When enabled, all new users must complete OTP verification during signup.
- Hide OTP Verification Message: Allows you to hide the OTP message from appearing in the chat interface (useful for cleaner user experience or custom flows).
- WhatsApp Bot Selection:Choose the WhatsApp bot that will send the OTP संदेश.
- Message Template:Select the approved WhatsApp template used to deliver the OTP code.
- Assign Label: Automatically assign a label to users who complete OTP verification.
- Assign Sequence:Add verified users to a follow-up sequence (e.g., onboarding or marketing automation).
Reseller Capabilities:
- Enable or disable OTP verification for client accounts
- Enforce OTP verification during signup
- Configure WhatsApp-based OTP delivery system
- Customize post-verification automation (labels & sequences)
Benefits:
- Prevents fake or spam account registrations
- Adds a strong verification layer using real phone numbers
- Improves lead quality and authenticity
Email Verification
Location: Settings & Integrations → Security → Email Verification
Description:Email Verification adds a verification step during user signup by requiring users to confirm their email address through a verification link or code.This ensures that the email provided during registration is valid and accessible by the user.
Configuration Options:
- Force Email Verification on Signup:When enabled, all new users must verify their email address before completing registration.
- Hide Email Verification Message:Allows you to hide the verification message from the user interface (useful for custom flows or cleaner UX).
Reseller Capabilities:
- Enable or disable email verification for client accounts
- Enforce email verification during signup
Benefits:
- Ensures users register with valid email addresses
- Reduces fake or low-quality signups
- Improves overall account authenticity
- Adds a basic layer of account security
Cloudflare Turnstile CAPTCHA
Location: Settings & Integrations → Security → Cloudflare Turnstile CAPTCHA
Description:Cloudflare Turnstile is a privacy-focused CAPTCHA alternative that protects your application from bots and automated abuse without requiring traditional user challenges.
It works silently in the background to verify whether a visitor is human, ensuring a smooth and uninterrupted user experience.
Configuration Options:
- Turnstile Site Key: Enter the Site Key generated from your Cloudflare Turnstile widget.
- Turnstile Secret Key: Enter the corresponding Secret Key.
- Enable Turnstile: Toggle to activate or deactivate Turnstile protection across your application.
- Hostname: Displays the domain associated with the Turnstile configuration.
Reseller Capabilities:
- Configure Turnstile using Cloudflare-provided credentials (Site Key & Secret Key)
- Enable or disable CAPTCHA protection for client accounts
Benefits:
- Blocks bots and automated submissions
- Provides a frictionless, challenge-free user experience
- Maintains user privacy without tracking or intrusive verification methods
Google reCAPTCHA
Location: Settings & Integrations → Security → Google reCAPTCHA
Description:Google reCAPTCHA (v3) is a score-based security system that analyzes user behavior to determine whether a request is made by a human or a bot.
Instead of showing challenges, it assigns a risk score to each interaction and blocks or allows access based on the defined threshold.
Configuration Overview:
To enable reCAPTCHA protection, you need to:
- Activate Google reCAPTCHA from the settings
- Connect your Google credentials (Site Key & Secret Key)
- Set a minimum score threshold to control how strict the bot detection should be
The configured domain ensures the keys are applied only to your authorized website.
Reseller Capabilities:
- Configure reCAPTCHA using Google-provided credentials (Site Key & Secret Key)
- Enable or disable protection for client accounts
- Adjust security sensitivity using the score threshold
Benefits:
- Provides invisible, frictionless bot protection (no user challenges)
- Uses behavioral analysis to detect suspicious activity
- Allows flexible control over security strictness via score threshold
Security Settings Available to End Users
1.IP Manager
Location: Settings & Integrations → Security → IP Manager
Description:
IP Manager allows users to control account access based on specific IP addresses. Users can allow or block access to login, Direct Login, and API usage from selected IPs.
End-User Capabilities:
Add and manage IP-based rules (Whitelist or Blacklist)
Control access for login, Direct Login, and API individually
Enable or disable rules as needed
Restrict account access to trusted networks or block suspicious IPs
2. Direct Login
Location: Settings & Integrations > Security > Direct Login
Description: Users can manage password-less login links for their own accounts.
Capabilities:
Enable or disable their own direct login access
Use the toggle to instantly block or allow link-based login
3. Login Activity
Location: Settings & Integrations > Security > Login Activity
Description: Users can monitor their own account access history.
Capabilities:
View successful logins, logouts, and failed login attempts
Check IP addresses, geographic location, device type, and browser
Detect unauthorized access attempts
4. Logged-in Devices
Location: Settings & Integrations > Security > Logged-in Devices
Description:
Users can view all devices currently logged into their account. This provides real-time visibility into active sessions, including device type, operating system, browser, IP address, location, and login times. Users can now log out from a specific device, immediately invalidating that session on the server to prevent unauthorized access.
End-User Capabilities:
- View all active sessions for their account
- Log out from any specific device to revoke access instantly
- Detect and respond to suspicious or unauthorized logins
Best Practices for Resellers
- Monitor Logged-in Devices regularly
Check all active sessions for unusual devices, IPs, or locations. Log out any suspicious or unauthorized sessions immediately to prevent account compromise.
- Enable 2FA and OTP verification for all end users
Require Multi-Factor Authentication to add a second layer of security. Force OTP verification on signup to protect accounts from automated attacks.
- Regularly review Login Activity
Audit successful logins, logouts, and failed attempts. Detect anomalies such as unrecognized IP addresses, unusual login times, or repeated failed attempts.
- Use IP Manager to control access from trusted sources
Whitelist trusted IPs (e.g., office or server IPs) to allow secure access, and blacklist suspicious or unknown IPs to block login, direct login, or API usage. This helps prevent unauthorized access and secures integrations. - Use Direct Login sparingly and monitor usage carefully
Ensure temporary access links are only provided when necessary. Disable or restrict Direct Login when not in use to reduce potential attack vectors. - Deploy Cloudflare Turnstile or Google reCAPTCHA to protect forms from bots
Apply CAPTCHA protection on login and signup pages to prevent automated attacks while maintaining a smooth user experience.
- Periodically audit all security settings
Review all configured options, including 2FA, OTP, Email Verification, Direct Login, IP Manager, Login Activity, and Logged-in Devices. Ensure compliance with internal security policies and maintain proactive account protection.
READ MORE:
How to Enable Two-Factor Authentication (2FA) on BotSailor
Configure Google reCAPTCHA v3 in Your BotSailor Reseller Panel
Configure Cloudflare Turnstile CAPTCHA in Your BotSailor Reseller Panel
Frequently Asked Questions
Find answers to common questions about this topic
The Unified Security Dashboard is a centralized interface in BotSailor where resellers and end users can manage all account security settings, including 2FA, OTP verification, Email Verification, Direct Login, Login Activity, and Logged-in Devices.
Resellers can enforce 2FA for all end users via Settings > Two-Factor Auth.
Yes. The Logged-in Devices section allows end users to view all active sessions and log out from any device immediately, revoking access.
Resellers should use Login Activity and Logged-in Devices to track login attempts, IP addresses, locations, and devices. Unrecognized sessions can be logged out to prevent unauthorized access.
Direct Login allows password-less login via secure pre-generated URLs. Resellers can enable/disable it for users, while end users can manage their own Direct Login access and use the toggle to block or allow login links.
OTP (One-Time Password) is a time-sensitive code sent to a user’s mobile device or email. It adds a possession-based authentication layer that prevents unauthorized logins, even if the password is compromised.
Yes. Using Logged-in Devices, resellers can view active sessions for each user, including IP, device type, browser, location, and login times, and can log out individual sessions.
These CAPTCHA integrations prevent automated bot attacks on login and signup forms. Turnstile provides a privacy-first, frictionless solution, while Google reCAPTCHA offers advanced risk analysis and bot detection.
Immediately log out any suspicious sessions from Logged-in Devices, review the user’s login history in Login Activity, and ensure 2FA and OTP are enabled to secure the account.
IP Manager adds an extra layer of protection by allowing access from trusted IP addresses and blocking suspicious or unauthorized sources. This helps prevent unauthorized logins, restrict misuse of Direct Login links, and secure API integrations from unknown environments.
Fatema Khatun
Content Author