Account Security Controls and a Better Sign-Up Experience

Two threads of work landed today. The first is account security: controls that should have been there from the start. The second is onboarding: we walked the sign-up to first-gameplay funnel as a new customer would and fixed what was broken.

Delete your account

You can now delete your account from the Account page under Security. Deletion is permanent, removes all your data, and requires password confirmation before it proceeds. This is something every hosting platform should offer, and we should have had it sooner.

Audit log now shows where and what device

Every event in your account audit log now includes the approximate location and browser that triggered it. Failed login attempts are highlighted in red so they stand out from normal activity. If you see a login attempt from somewhere unexpected, you will notice it immediately rather than having to dig through an undifferentiated list.

Email address is masked on the Account page

Your email address on the Account page is now hidden by default, the same way API keys and tokens work elsewhere in the panel. Click the eye icon to reveal it. This reduces the risk of your address being visible if someone looks over your shoulder or shares a screen.

Recovery codes work correctly

The recovery codes page was returning a 404 due to a wrong API path. It now loads and generates codes as expected. If you use two-factor authentication, you can now generate and save recovery codes in case you lose access to your authenticator app.

Registration now takes you to verify your email

After creating an account, you were previously sent to the login page with no explanation of what to do next. You now land on a verification page that shows the address the confirmation email was sent to and tells you what to expect.

Resend link and better hints on the verification page

If the confirmation email does not arrive, the verification page now has a resend button with clear status feedback. It also reminds you that confirmation links expire after 48 hours and suggests checking your spam folder. These are not interesting features on their own, but they matter when something goes wrong and you are trying to get into your account for the first time.

Clearer credentials warning on the dashboard

When your panel credentials are first shown after starting a trial server, the copy now reads "Save these now. You will not see them again." in place of a softer message that understated the urgency. If credentials have already been cleared, the dashboard now shows a fallback block with the support email address rather than a blank space.

Direct Connect note below the server address

The Connect button on the trial dashboard uses a steam:// link, which requires Steam to be running. A note below the button now explains how to use Direct Connect in-game if Steam is not open. A small fix, but it removes a dead end for new customers whose first instinct is to click the button before launching Steam.