How do I sign in for the first time and secure the console?

Open https://<server-ip>:8087 in a browser. Use the server's public IP on a cloud server.
Accept the certificate warning once. The certificate is self-signed and lasts about 20 years.
Sign in as admin with the password the installer printed.

If you opened BackupWall from WHM or DirectAdmin, you are already inside the same console. On a server with no panel, open the address the installer printed (plain HTTP on port 80 unless you installed with a DOMAIN).

The left menu lists Dashboard, Backup jobs, Backup points, Accounts, Restore, Migration, Destinations, Audit log and Settings.

Change the admin password

Open Settings → Profile.
Choose Change password. The new password must have at least 12 characters.

The console does not force a password change and does not force two-factor login.

Create a second admin

Make a second administrator so a lost password does not lock you out. BackupWall has no forgotten-password flow and no command that resets a lost admin password.

Open Settings → Users.
Create a user with the role Admin.

Open Settings → Security.
Follow Two-factor authentication to add an authenticator app (Google Authenticator, Authy, 1Password or similar) and confirm with a 6-digit code.

Two-factor login has no recovery codes and no admin reset. If an administrator loses their authenticator, the second admin cannot reset it from the console; recovering means editing the database by hand. Keep the authenticator's backup safe.

Secure a server with no panel

On a server with no panel, a console installed without a DOMAIN is plain HTTP on port 80, so the admin password crosses the network in clear text. Do not sign in over an untrusted network until you do one of these:

Install again with a domain (your settings, database, jobs and admin password are kept): point a DNS A record at the server, make sure ports 80 and 443 are reachable, then run DOMAIN=backup.example.com bash install.sh from the release folder. The console is then at https://backup.example.com/.
Or use the HTTPS console on port 8087: open the port in the server firewall and the cloud firewall, browse to https://<public-ip>:8087 and accept the certificate warning.

Restrict port 8087

The console listens on every IPv4 interface on port 8087. Restrict the port in the firewall to your own addresses. Another BackupWall server needs to reach it only if you use migration.

Do these two things next

Add a destination and set the Disaster Recovery passphrase. Until DR is set up, the Dashboard shows a warning and every page carries a "DR not set up" badge. See Set up Disaster Recovery.
Check the licence. A banner at the top of the console appears only in the Grace and Unlicensed states. See Activate or move your licence.

Sign out

Choose Sign out at the top right. Inside WHM and DirectAdmin there is no Sign out button: use the panel's own logout.