Security Features

sERP v1.11 introduces enhanced security features including multi-factor authentication for administrator accounts and automated database backups.

Multi-Factor Authentication (MFA)

Administrator accounts (access level 1) are required to complete two-factor authentication (2FA) at every login. After entering the correct username and password, a 6-digit One-Time Password (OTP) is sent to the administrator’s registered mobile number via SMS.

MFA Login Process

  1. Enter your username and password on the login page and click Login

  2. sERP verifies your credentials. If your account has administrator access (level 100), you are redirected to the OTP verification page

  3. Check your registered mobile number for the SMS containing your 6-digit OTP

  4. Enter the OTP on the verification screen

  5. Click Verify OTP to complete login

Note

OTPs expire after 5 minutes. If the OTP expires before you enter it, return to the login page and log in again to receive a fresh OTP.

Configuring a Mobile Number for MFA

Administrator accounts must have a mobile number registered in order to receive OTP codes. This is managed from the Change Password page.

  1. Log in as the administrator

  2. From the welcome menu, click Change Password

  3. In the MFA Phone Number pane, enter or update the mobile number

  4. Click Save Phone

Warning

If no mobile number is configured for an administrator account, the OTP is displayed on-screen as a temporary fallback. This is intended for development and initial setup only. Always ensure a valid mobile number is configured before going live.

Note

MFA is applied to administrator accounts only. Standard staff, teacher, student, and parent accounts log in with username and password only.

Automated Database Backups

sERP can perform scheduled automated database backups to protect against data loss.

How Backups Work

Backups are generated by the script at cron/backup.php. When executed, it:

  1. Runs a MySQL dump of the full sERP database

  2. Compresses the output as a .sql.gz file

  3. Saves the file to temp/backups/ with a date-stamped filename (e.g. serp_backup_2026-02-27.sql.gz)

  4. Automatically deletes backup files older than 30 days

Scheduling Automated Backups

To run backups automatically, add the following line to your server’s cron configuration (crontab -e):

0 2 * * * php /path/to/serp/cron/backup.php

This runs the backup daily at 2:00 AM. Adjust the schedule as appropriate for your environment.

Note

Replace /path/to/serp/ with the actual filesystem path to your sERP installation (e.g. /var/www/html/serp/).

Manual Backups

A manual backup can be triggered at any time from the admin panel:

  1. Navigate to Tools > Backup Database

  2. Click Download Backup — a database dump is generated and downloaded to your browser

Tip

For production deployments, consider storing automated backups in an off-site location (e.g. cloud storage bucket or a remote server) in addition to the local temp/backups/ directory.