Protected Pages

Protection list

• Select which settings page handles require the super-admin password.
• The protected page list is saved in superAdminProtectedPages.
• The configuration page itself is always protected.

Session flow

• Protected pages redirect to the super-admin login when the session is missing.
• The elevated session lasts 15 minutes.
• After the session expires, the admin must authenticate again before making protected changes.

Open pages

• System report stays open for regular admins.
• Store email, email preview, and store widgets are also available without the super-admin session.
• Use the open pages list to keep operational screens accessible while protecting sensitive configuration.

Environment secret

• The login flow expects YUI_SUPER_ADMIN_HASH to be defined in the environment.
• Keep the hash out of version control and match it to the deployed environment.