What this screen is for
Signing in to an existing account, so you can reach your panel. You do not need an account to run the domain check - that is free and anonymous, and it stays that way.
What each control does
- Email address
- The address the account was created with.
- Password
- At least 12 characters. There are no character rules - length is what matters, so a memorable phrase beats a short scramble of symbols.
- Sign in
- Submits. On success the panel appears on this same page rather than navigating - see the note below, that is deliberate.
- Forgotten your password?
- Goes to a page that explains your options. Self-service reset is not built yet and that page says so rather than showing a form that would do nothing.
- Send the verification link again
- Appears only if the failure was an unverified email address. It resends the verification mail.
When it will not let you in
- The failure message is the same either way
- A wrong password and an address with no account produce identical wording, on purpose. A message that distinguishes them tells an attacker which addresses are registered.
- Too many attempts
- The account locks temporarily. The lock lifts by itself after about 15 minutes - waiting is faster than anything else you can do.
- Not verified
- Use the resend link, then follow the mail. See verifying your email.
- Nothing else works
- Email support@mailguardhq.com from the address on the account.
What this screen does not do
A browser refresh signs you out
The session credential is held in memory only and is never written anywhere a script could read it. That is a deliberate security decision, and its cost is that reloading the page ends the session. It is why signing in reveals the panel on this page instead of navigating to another one - a page load would end the session you just created.
The proper fix is for the API to set the session as an httpOnly cookie. That is not built yet.