Skip to main content
Set Your HTTP and Password Reset Security

Choose how secure you want your HTTP/HTTPS and password reset requests to be

Ania Kwak avatar
Written by Ania Kwak
Updated over a week ago

For those who want more control over their LemonadeLXP's security, you can customize your HTTP and password reset settings to suit your needs.

To customize them, log in as an admin, then:

  • SELECT "SETTINGS"

  • SELECT "Config"

Menu bar Settings/Config highlighted

Scroll down the first page until you reach the section titled "Security Settings":

Config Security Settings section

HTTP Settings

Always use HTTPS

To ensure all users find themselves on the correct page, checkmarking this box will redirect all attempts to use an "HTTP" URL to its "HTTPS" equivalent. This means users will find themselves on your instance regardless if they use HTTP or HTTPS in the URL!

If this is not enabled, users who enter your LemonadeLXP link as an HTTP will not be able to access your instance as they will have to proactively change HTTP to HTTPS for it to function.

HTTP Strict Transport Security (HSTS)

Enabling this setting has LemonadeLXP enforce the web security policy for your website. This means it will keep your site extra secure via cyber means, much like how doors, locks, keys and walls keep your home secure.

Referrer Policy Header

Choose how your LemonadeLXP is viewed by outbound links, from completely hiding information to revealing everything without a second thought! Simply choose the option that works best for you, then SAVE your changes.

Referrer Policy Header drop-down menu showing all available options

Password Reset Settings

Perform browser fingerprinting during password change requests

Checking this option off will require users to submit and complete their password change request using the same browser.

For example: if a user initializes the reset using Internet Explorer, then opens the emailed reset link URL in Chrome, the reset will not work. The user must open the reset link in the same browser for it to work; in this case, in Internet Explorer

Perform IP validation during password change requests

Enabling this setting will ensure users start and complete their password reset request from the same location/device they started it.

For example: should a user start the reset process on their personal computer, then attempt to complete it on their company computer, it will not work! They must either start and finish on their personal computer, or start and finish on their company computer.

Did this answer your question?