Security

Two-step verification (2FA) adds a second check to the Mailix sign-in: after the password, Mailix asks for a six-digit code that an authenticator app on the phone creates every 30 seconds. Someone who learns the password still cannot open the mail.

Setup takes about a minute in Settings → Security:

1. Scan the QR code with an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.
2. Enter the code from the app to confirm the setup.
3. Save the 10 single-use recovery codes by copying, downloading or printing them.

Suggested after the first sign-in. Mailboxes without 2FA see Protect your account after signing in. Not now postpones the suggestion for 14 days.

Recovery codes. Each code works once and replaces the phone when it is lost. New codes can be created at any time.

Remember this device for 30 days. A trusted browser skips the code for 30 days. Trusted devices are listed with their last use and can be removed one by one or all at once.

Attempt limits. Five wrong codes from one network pause code entry for 15 minutes, and 30 wrong codes from all networks pause the mailbox for 15 minutes. The counters start only after a correct password, so strangers cannot lock a mailbox.

2FA also works when Mailix opens from cPanel Webmail: the password is already checked there, and Mailix asks only for the code.

Signed-in devices lists every browser where the mailbox is open in Mailix, with the browser and system, the IP address and the last activity. Any other device can be signed out, or all of them at once with Sign out everywhere else.

Sign out from cPanel Webmail. In cPanel Webmail, Sign out also ends the Webmail session and returns to cPanel's own sign-in page, so the open Webmail session cannot reopen Mailix on a shared computer. With several accounts open, signing out of one account leaves the others open.

On standalone installations, a new device can also sign in with a QR code that a signed-in device approves:

The approving device chooses a two-digit number shown on the new device from three numbers, and a wrong choice cancels the request. A code is valid for 2 minutes and works once.

QR sign-in is not available in cPanel Webmail, because every Webmail address belongs to one Webmail session. There, new devices sign in to cPanel Webmail with the password.

HTML mail is cleaned on the server against an allow-list before it is shown. Scripts, frames, forms, embedded objects and event attributes are removed, CSS is filtered and links keep only safe addresses.

Locked frame. The cleaned message is shown in a sandboxed frame that runs no scripts, under a strict Content Security Policy (CSP), so it cannot touch the Mailix page.

External images. Images from the internet are hidden until the user chooses Show images or Always show from this sender, because loading them can tell the sender that the message was opened.

Attachments. Only images and PDF files open in the browser; every other file downloads.

• The mail password is encrypted in the server session with AES-256-GCM. The key lives only in a separate browser cookie, so the session file alone reveals nothing.
• Every change carries a CSRF token, a check that the request really came from the Mailix page.
• Failed sign-ins are limited per IP address and per mailbox.
• The 2FA secret and the company AI key are stored encrypted; recovery codes are stored only as one-way hashes.
• Mailix uses no tracking or advertising cookies.
• Settings → Mailix holds About, Terms of use, Privacy policy, AI notice and Third-party software in English, Turkish and Arabic. The terms cover archives, imports and AI replies, and the privacy policy says that an imported account's password is never saved and that imported files are read in the browser.

Server administrators should back up the Mailix storage together with its key files, because the 2FA secrets cannot be read without them.