Security

Keep access useful and protection visible.

Run the website with control over who can work on it and visibility into requests that need attention. Cedros combines team and assistant permissions with site-protection activity, lockout management, and explicit access to sensitive tools.

Explore plans /pricing See the platform /about

Protection across the website’s working parts

Give people access for their responsibilities

Use roles and permissions to control which site areas a team member can use. Align publishing, customer data, and operational access with the person’s job. Update access as responsibilities change so the team can work without sharing one all-purpose account.

Choose what an assistant can reach

Configure which business tools an assistant can read or change. External MCP clients use authorized, scoped keys, while actions follow the relevant tool’s permissions and confirmation or release requirements. Delegate useful work with the scope appropriate to that workflow.

Understand protection activity

Review blocked and limited requests, recent events, and breakdowns by route, reason, or action. Inspect active request-rate, login, and honeypot lockouts. This gives your team evidence for investigating unwanted traffic or a legitimate visitor’s access problem.

Manage IP rules and temporary lockouts

Maintain an IP block list and whitelist, or clear an individual active lockout when appropriate. These controls let an authorized operator respond to a specific situation. Whitelisting affects the generic request rate limit; block rules and login lockouts still apply.

Review the access behind an extension

Extensions declare the capabilities and provider access they need. Their server work runs within the supported extension runtime and its limits. Include permissions and custom behavior in your installation review so added functionality fits the information and services your site handles.

Keep sensitive work in the right place

Use restricted business tools for private customer work and the Vault’s credential workflows for secrets. Keep public content separate from private references. Pair these controls with maintained accounts, connected services, and backups appropriate to your business.

Useful to know

Can I see why requests were blocked?

The protection dashboard exposes recent activity and groupings by action, route, and reason. Active temporary lockouts are shown separately from permanent IP rules.

Can I revoke an external assistant’s access?

MCP access uses revocable API keys and account permissions. Revoke a key when the connection no longer needs access, or narrow permissions to the intended work.

Does every kind of custom code have the same isolation?

No. Server extensions and authored browser code have different trust boundaries. Custom React is trusted site-authored code, so access to authoring and reviewing it matters.

Run your website with access you can manage.

Keep team permissions, assistant scope, and protection activity in the same operational workspace.

Talk about your website /contact