Getting started

Headra stores and manages content. Client websites fetch that content and display it, so you edit in one place and every page, menu and sitemap updates on its own.

Signing in

1. Go to /admin/login and enter your email address and password.
2. If your account has two-factor authentication, enter the six-digit code from your authenticator app. Lost your phone? Use one of your recovery codes instead. Each code works once.
3. You stay signed in for up to 8 hours, or 2 hours without activity.

Changing your password

Go to You → Change password in the sidebar (or click your name at the top right, where you'll also find two-factor authentication, help and Sign out). Enter your current password and the new one twice. New passwords need at least 10 characters. Changing it signs you out on every other browser and stops your API tokens working, so you'll need to sign in again there. You stay signed in where you made the change.

Forgotten your password?

1. On the sign-in page, click Forgot your password? and enter the email address you sign in with.
2. Open the email from Headra and click Choose a new password. The link works once, for an hour. Nothing arrived? Check your spam folder; for safety, the page says the same thing whether or not the address has an account.
3. Enter the new password twice (at least 10 characters), then sign in with it.

Resetting your password signs you out everywhere and stops your API tokens working. If you use two-factor authentication, you still need your code (or a recovery code) to sign in. You can also ask your account admin to set a new password for you under Account → Users.

Turning on two-factor authentication

Two-factor authentication means signing in needs a six-digit code from an app on your phone as well as your password, so a stolen password isn't enough to get in.

1. Go to You → Two-factor authentication and click Set up two-factor authentication.
2. In an authenticator app (1Password, Google Authenticator, Microsoft Authenticator, …), add an account and scan the QR code. If you can't scan it, type in the key shown under it.
3. Enter the six-digit code the app shows. If it's refused, check that your phone's clock is set automatically and try the next code.
4. Save the recovery codes shown next, for example in your password manager. They're shown only once. Each one signs you in once if you lose your phone.

Turning it on signs you out of every other browser. To turn it off, go back to the same page and enter your password and a code. When you're running out of recovery codes, turn it off and on again to get a new set.

Choosing a website

An account can have several websites, each with its own content, media, menus and settings. Use the website switcher at the top of the sidebar to choose the one you're working on. Everything under the website's name in the sidebar belongs to that website only.

Light and dark mode

Use the half-circle button at the top right to choose Light, Dark or Auto (follow your device). Your choice is remembered in this browser.

The sidebar

The sidebar only shows what you're allowed to use:

• Content (Posts, Pages and any custom types) is everything published on the site.
• Organise covers media, categories, tags, authors, navigation, SEO, redirects and API keys.
• Insights covers analytics and the activity log.
• Account (account admins) covers websites and users.

If something you expect is missing, either the module is switched off for this website or you don't have permission. Ask your account admin.

Who can do what

Account admins can also give individual permissions per website. See Users and permissions.