@csrf @method('PUT')

Sessions & passwords

Idle session (minutes) Minimum password length Lockout after attempts Lockout duration (minutes)

Require MFA for privileged roles Notify on new device sign-in

Admin IP allow-list (optional)

Comma-separated IPs or CIDRs. Leave blank to allow any IP (not recommended for production).

Allowed admin IPs