An SMM panel administrator can change service rates, manage customer balances and configure provider connections. Protect that access as part of running the business. ExcelPanel includes administrator two-factor authentication, staff permissions, device checks and activity logs that help you control and review access.
Use a unique administrator password
Use a long, unique password and store it in a password manager. Do not reuse the password from a provider account, email inbox or another panel. Protect the email account used for account recovery with its own strong credentials.
A shared administrator login makes it harder to understand who changed a setting. Give staff separate access with the permissions appropriate to their work instead.
Enable administrator two-factor authentication
ExcelPanel supports time-based one-time passwords for administrator authentication. Complete the setup with an authenticator app and verify that the second step works before ending your current session.
Keep any recovery information provided during setup in a secure place. Do not put the setup QR code or secret in a support screenshot: someone who can reproduce that secret may be able to generate the same codes. Confirm the recovery process before relying on it.
Give staff only the access they need
Review permissions against actual duties. Someone answering order tickets may not need access to payment settings, provider credentials or balance adjustments. Test the staff account to confirm what it can view and change.
- Create a separate account for each staff member.
- Review access when someone changes role.
- Remove access promptly when someone leaves.
- Keep sensitive administrative actions limited to responsible operators.
Review devices and activity records
Use device checks and activity logs to investigate unfamiliar access and important configuration changes. Look at the account, time and action together. An unfamiliar device record deserves investigation, but a log entry alone does not explain the full circumstances.
Make a habit of reviewing changes to provider connections, payment settings and customer balances. Keeping a short internal record of planned maintenance makes unexpected changes easier to spot.
Handle API keys as credentials
Provider and reseller API keys can authorize actions in their respective accounts. Keep them out of public repositories, browser screenshots and shared documents. Use the correct key for each connection rather than copying a single credential across unrelated accounts.
When replacing a key, update the integrations that rely on it and test an eligible request. A rotation that leaves an old integration running can interrupt orders. Review the provider connection checklist when reconnecting a service.
Prepare a response to unexpected access
If you suspect unauthorized access, secure the affected account and recovery email, revoke or replace exposed credentials and review recent changes. Preserve the relevant records so the team can investigate. Check provider and payment configurations before returning to normal operation.
These controls reduce exposure; they are not a promise that an account cannot be compromised. For help checking your panel configuration, contact the ExcelPanel team without sending passwords, authenticator secrets or complete API keys.
