XFileSharing Pro

Self-hosted File Hosting Script for High-Traffic Websites

XFileSharing: Security mod

Protect member accounts from takeover. Two-step sign-in with an authenticator app or SMS, a list of active sessions users can manage themselves, and e-mail alerts when someone signs in from somewhere new.

Google Authenticator & SMSSession controlLogin alertsWorks with any TOTP app

What your users get

Two-step verificationA 6-digit code from Google Authenticator, Microsoft Authenticator, 1Password, Authy or any TOTP app. Optional for users, or mandatory for everyone.
SMS codes & phone checkRequire a mobile number at registration and confirm it by SMS before the account is activated.
Active sessionsUsers see every device signed in to their account and can terminate unwanted sessions with one click.
Unusual-country checkSign-ins from a country the user has not used before need an e-mail confirmation first.

How sign-in is protected

Login +passwordNew country?e-mail confirmationSecond factorTOTP app or SMSSessioncreatedvisible in My accountMy fileslogin alert e-mail

For your users

Everything lives under My account → Password & security: change the password, see the security status at a glance and switch on two-step verification in about a minute. Changing the password signs the user out on all other devices.

My account · Password & security
Security status, password change and two-step verification in My account.
UserSecurity status, password change and two-step verification in My account.

For you, in the admin area

All options are in Admin → Settings → Mods → Security. Choose the method (SMS or Google Authenticator), decide whether two-step is disabled, optional or mandatory, and set how strict session handling should be.

Admin · Settings · Mods · Security
Two-factor method and mode, session list, single-IP sessions and login notifications.
AdminTwo-factor method and mode, session list, single-IP sessions and login notifications.

Settings at a glance

  • Two-factor method — SMS or Google Authenticator (any TOTP app).
  • Two-factor mode — Disabled, Optional or Mandatory for all users.
  • Require phone number at registration.
  • Session list in My account, with an option to let users terminate sessions; idle sessions are removed after a set time (72 hours by default).
  • Restrict sessions to a single IP — a stolen cookie is useless from another address.
  • Login notifications by e-mail and confirmation of sign-ins from an unusual country.
SMS delivery is billed through your SibSoft client area — top up the balance before enabling SMS, otherwise users will not be able to sign in. Google Authenticator needs no balance.
SecurityInstall from the Install Center
SibSoft

سكربتات مستضافة ذاتيًا لاستضافة الملفات والفيديو والصور. نطورها منذ عام 2006.

© 2026 Sibsoft Ltdجميع الحقوق محفوظة