🧠Locking the club's front door
Pavilion holds every member’s name, address, telephone number and date of birth. Half an hour, once, and the obvious ways in are shut. Nothing here should ever be noticed by an ordinary member — that is the test of whether it has been done right.
1Turn the login guard on
Settings → Data & GDPR → Locking the front door. Everything is on by default; check it is, and leave it alone. Wrong passwords get slowed, the login page stops saying which half was wrong, and the list of usernames stops being handed to anybody who asks.
↓
?Decide about XML-RPC
Off is right for nearly every club — it exists for desktop blogging software nobody here uses, and one request to it can carry hundreds of password guesses.
You use Jetpack or an old mobile app → leave that one box ticked on, and accept it. | You do not know what it is → you are not using it. Leave it off. |
↓
3Look at who holds an officer account
Members → Roles. Anybody who can see the membership records is now held to a real password. Fewer people with that permission is worth more than any setting on this list — a treasurer who left in 2019 and still has a login is the likeliest way in of all.
↓
4Get the officers onto passkeys
This is the one that actually ends the problem. A passkey signs in with a fingerprint and leaves no password to guess, to phish, or to reuse somewhere that has already leaked. Each officer sets one up on their own profile — five minutes, on their own phone.
↓
5Check the club's email actually works
Send yourself something from Settings → Notifications. The sign-in alerts and the confirmation for the full data download both go by email, and a club whose email is silently going to spam has protections it cannot use.
↓
6Take a copy of everything
Settings → Data & GDPR → Take all your data with you. Now, while nothing is wrong. It costs nothing and it is the half of a backup that matters most.
💡 Tip: If somebody is locked out and needs in now, the password reset link on the login page still works and clears the lock. Otherwise it lifts by itself after a quarter of an hour.