So Outside Technology Security CMS
AnQiCMS
Online Demonstration

The backend entry of the public trial site can be tried at will, and how to narrow the login page of your own site

📅 2026-10-25 👁️ 0

The back-end entry of the public demo station can be tried at will, and how to narrow the login interface of your own site, the answer is to narrow it in three layers: entry exposure method, account permission boundary, and machine behavior protection. The value of the demo station (demo site) lies in allowing people to see the functions without entering the back-end; copying this level of openness for a self-built site with real data and real accounts will bring back the area that can be tried.

Why does the demo station need to open the back-end entry

AnQiCMS provides an online experience site, the background address is fixed at /system path, the role of this demonstration entry is to reduce the threshold for trial: people who want to see the effect do not need to deploy first, nor do they need to apply for an account first. The demonstration site contains sample content and sample accounts, and the changes affect others' browsing, not the production data. It is precisely this premise that makes the 'public entry' acceptable. On the other hand, once the site contains real orders, real member information, and real attachments, the same degree of openness is no longer equivalent.

What are the ways to expose the entry step?

There are three options for exposure, with risks arranged from low to high: whether the path is guessable, whether to allow unlogged-in access to the login page, and whether to add access restrictions to the entry. A fixed path is convenient to use and also easy for scanners to hit, so it is common practice to keep a memorable address for the team on the self-built site instead of following the default address of the demonstration site. Site-wide operations (backups, upgrades, multi-site management) are high-risk actions, and the exposure range of such capabilities is closed by default, and it needs to be explicitly enabled to be available externally, which is exactly opposite to the orientation of the demonstration site "showing everything to everyone."

Which layer should the user group and VIP group be collected first

The way to control the boundary of authority is to group first and then give the scope, instead of assigning it individually to each person. User management supports division by user group, and VIP grouping can set different access permissions for different groups, downloading range, visible content, and background menus are all condensed by group. Operation, editing, and external proxy maintenance fall into different groups, and the interface that can be seen is naturally different: the account for writing articles does not need to be able to change the template, and the account for accounting does not need to be able to delete documents. This level is first tightened up, even if the login credentials are leaked at some stage, the range of capabilities that can be used is also blocked by the group boundary.

Who controls the machine behavior at the form and login ports?

Machine behavior protection is divided into two places: login port and external forms. Forms such as messages, orders, and subscriptions can be connected to reCAPTCHA verification codes to block repeated submission scripts before writing to the database; the login port relies more on the authentication mechanism itself, AnQiCMS has built-in JWT authentication, the session status is maintained by tokens, and attempts of abnormal login will not be replaced by a long-term valid credential. The verification code is placed on the side of the form to solve flooding, and tokens and permission groups are placed on the back-end side to solve over-privilege, and the two do not substitute each other.

Why is the content layer protection also considered as a login page?

Behind the back-end entry, there is also a layer that is easily overlooked: the procedural entry. SQL injection and XSS take advantage of holes outside the login interface to enter the system, and built-in filtering and protection are responsible for this section; sensitive word filtering and keyword replacement in content security settings, interference codes to prevent collection, belong to the content layer rather than the authentication layer, but they determine whether external submissions can rewrite data within the site. If the upgrade action is to fix this type of entry, the upgrade action itself is also part of narrowing the login interface.

How to allocate the three layers, which one to look at first

Hierarchy The approach of the experience site The tightening action of the self-built site The order of what to do first
Entry exposure Fixed address is public, convenient for direct viewing Replace the default address visible to the outside, keep the default closed at the whole site level First step, the lowest cost of change
Permission boundary Public trial account, all features are open Divide the access range according to user groups and VIP groups, one person per group Second step, decide the radius of impact after leakage
Machine behavior Unrestricted, allow repeated attempts Form accepts reCAPTCHA verification code, login relies on JWT token and session control The third step, blocking automated attempts

Common questions

Changed the back-end entry address, will the editor not be able to enter?What will change is the access path, not the account and permissions. Send the new address to the internal collaboration group in advance, and finish updating the bookmarks, and the transition period is over once.

The site is maintained by only two people, do we need to group?Yes, but only two groups: those who can change content and those who can change settings. The purpose of grouping is not the approval process, but to limit the scope of impact after accidental operations and credential leaks.

Will the captcha affect the normal user's submission?The cost of reCAPTCHA on the normal submission path is a single verification, comments and order forms can be opened as needed; if real human submissions are blocked, check the form integration method first, and then decide whether to open up or retain.

Can the public entry of the demonstration site be directly copied to your own site?It is not recommended. The public of the demonstration site is a product behavior, the premise being that there is no real data; the data, accounts, and orders of the self-built site are all real, and the same entry exposure does not have the same premise.

Related articles

Is the slow page response really affecting the ranking, and which indicator should you look at first

Determine whether the page response time affects performance, first look at the interaction response indicators in the real user data: A good value is at least the 75th percentile of visits within 200 milliseconds, and over 500 milliseconds is considered poor. This article explains the difference between laboratory data and field data, how to read thresholds, and gives three items that can be changed on the server side, as well as how to write performance in a verifiable manner.

2026-10-25

What should be the sequence of handling after the login credentials of the content management system are forged

The handling sequence after the login credentials are forged is: first stop bleeding (tighten the entrance and limit the flow), then break the chain (rotate the signature key and make existing sessions invalid), then change the password and clear the permissions, finally use backups and logs to check if a backdoor has been left. This article takes the AnQiCMS v3.6.6 fixed site switching login credential forgery issue as an example and provides an executable emergency response list.

2026-10-25

The content system has its own template and decoupling solutions, how does the human resources input of a small team compare?

The system of bringing built-in templates and the decoupling scheme of only leaving interfaces, the difference does not lie in the number of functions, but in the distribution of manpower: the latter leaves the front-end and integration work within the team. This article breaks down the working hours of the small team into three stages: site construction, daily version updates, and content operation, citing the official definitions of the two architectures by Strapi, and explaining how content models, AI-assisted template modification, and deployment methods affect investment.

2026-10-25

AI summaries appear in about 48% of search results, is the natural click-through rate enough?

The statistics show that AI abstracts have appeared in about 48% of search queries, and the natural click-through rate will drop significantly when they appear. These numbers show that the click-through rate is no longer a conclusion available on its own: This article provides the three types of angles that webmasters should check (brand word search volume, AI recommended conversations, and data source), and explains how llms.txt, site maps, and keyword libraries can be used to observe them inside the site.

2026-10-25

After PHP releases 8.5.12 and four security versions, what should WordPress sites do first?

The PHP official released the 8.5.12, 8.4.27, 8.3.36, 8.2.35 and other fixed versions on October 21, 2026, to address two severe vulnerabilities with a CVSS score of 9.2. Sites running PHP need to take action in order: first confirm the current runtime version, then make a reversible backup, then verify the compatibility of the program and extension in the test environment, and finally check the access logs for any detected traces. If an immediate upgrade is not possible, tighten the entrance first and then schedule the window.

2026-10-25

If llms.txt is installed but not referenced by AI, is the direction wrong?

Two public measurements do not support the assumption that "if llms.txt is placed, it will be referenced": in a sample of 300,000 domain names, only about one-tenth have this file, and there is no correlation between it and AI references; another experiment on 83 sites only recorded OpenAI reading 7 times. It solves the issue of "whether to read" rather than "whether to get an answer by reading". What really affects being referenced is whether the paragraph can stand alone as an answer, and whether the site map and robots have left the right path.

2026-10-25

Is AI search optimization and traditional SEO optimization for the same page?

Optimization is for the same page, but not the same thing required. Traditional SEO cares about whether the page can be crawled, indexed, and ranked in the results; AI search cares about whether a certain paragraph can be extracted as an answer. The two paths share the same crawling entry, but the division of labor from paragraph writing to in-site links is different. Site maps, link push, anchor text, and llms.txt each serve one link, and if the objects are matched incorrectly, neither side will be effective.

2026-10-25

When a website is not accessible, is my website still being indexed by search engines?

If a website is down for a short period of time, it usually will not be immediately removed from the index. Search engines will retain the existing index and try to crawl again, but the crawling pace will be slowed down; only when it is consistently unavailable will new pages not be indexed and old pages gradually become cold. The troubleshooting order is from outside to inside: parsing, port listening, reverse proxy, program startup, and then confirm whether robots have been accidentally narrowed in the maintenance page configuration, and after recovery, use link push to make up for the new content of this period.

2026-10-25