Stealth Mode

Enable or Disable

1. Sign in to the admin panel as a super administrator.
2. Open Stealth mode using the ghost icon.
3. Change the top switch; it is off by default.

When enabled, signed-out visitors see a generic Sign in form. The real app, JavaScript/CSS, and icons require authentication. Known API and file paths return 404 to unauthenticated requests.

Signing In

Use your existing username and password at the site home page. Older browser sessions may require a fresh sign-in. Signing out returns to the generic home page.

Chat, files, and authenticated Telegram/instance callbacks continue working. Public registration links and unauthenticated client connection endpoints are unavailable; turn the switch off when needed. The demo only previews the switch.

Manual Deployment Settings

Actions includes these settings. Update older manual configurations:

[assets]
directory = "./frontend/dist"
binding = "ASSETS"
not_found_handling = "single-page-application"
run_worker_first = true

All assets pass through the Worker, adding requests and settings reads even with the switch off. Serve assets through the same Worker and honor private, no-store in cache rules.

Stealth mode restricts signed-out access. DNS, certificates, previously downloaded files, and installed PWA icons remain visible.

Disable When the Admin Panel Is Unavailable

Run this in the target D1 database console in Cloudflare:

UPDATE site_settings
SET setting_value = json_set(setting_value, '$.enabled', json('false')),
    updated_at = CURRENT_TIMESTAMP
WHERE setting_key = 'stealth_mode';

This only disables the switch. Users, messages, random entry paths, and encryption keys remain unchanged. Restore D1 availability first if settings cannot be read.