Secure Your Moonetix Account: A 5-Minute Checklist

How do you secure your Moonetix account?

To secure your Moonetix account, set a strong password, turn on Login verification so every login from a new device needs a 6-digit code from your email, and keep a second way to log in, such as Google or Discord. Then trust only your own devices and check the Trusted devices, Sessions and Recent security activity cards now and then. Everything is on the Account page and takes about five minutes.

This guide is the checklist and the reasons behind it. Each step links to a guide with the exact buttons. Everything below was checked against the dashboard on November 4, 2026.

Why it is worth five minutes

A publisher account holds your earnings and the payout method they are sent to, and your apps hold the API keys and link hash salt your integration depends on. Anyone with access could try to change where your payouts go, change your postback settings, or create a new link hash salt and break your offerwall in your name. Login codes, password reset codes and important notices all go to your account email, which makes your mailbox part of your security too.

Most account takeovers do not need clever hacking. They start with a reused password or a code someone was tricked into sharing. CISA’s guide on turning on multifactor authentication makes the key point plainly: even if an attacker steals your password, they cannot meet the second step and get into the account. That second step is what Login verification gives you on Moonetix.

What the Account security box checks

At the top of the Account settings page, the Account security box counts two things: Password set and Login verification on. With both done it shows 2/2 and Strong. With one done it shows Good, and with none, Needs attention. A missing item has a Set one or Turn on link that jumps to the right setting. Next to it, the summary shows how you sign in (Signs in with), your Payout method, and your Last login with a partly hidden IP address.

The box is a good start, not the whole list. The checklist below adds the habits it cannot measure.

The checklist

1. Use a strong password you use nowhere else. Moonetix requires at least 10 characters with uppercase and lowercase letters, a number and a special character, and the password cannot contain your email address. Longer is better: CISA’s advice on using strong passwords suggests at least 16 characters, a different password for each account, and a password manager to remember them. Signed up with Google or Discord? Add a password anyway, so you have a way in if that account is ever unavailable. How to change or set your password shows where.
2. Turn on Login verification. One click on the switch in Sign-in & security. From then on, a new device needs a code from your email, even if someone knows your password. Turning it off needs a code as well. Login verification, trusted devices and sessions walks through each click.
3. Keep two ways to log in. A password plus Google or Discord means one lost login does not lock you out. Moonetix does not let you unlink your only sign-in method: the Unlink button stays greyed out until you set a password or link the other account. Log in with Google or Discord covers linking.
4. Trust only your own devices. When you enter a login code, untick Trust this device for a year, so it does not ask for a code again on a shared or public computer. A trusted device skips the code for 365 days, and each one is listed with its partly hidden IP address, the date it was added and when it expires.
5. Use Keep me logged in only on your own device. The Keep me logged in for 30 days box on the login page keeps a browser logged in for 30 days. Without it, closing the browser logs you out.
6. Protect your email. Use a strong password and two-step login on the mailbox itself, since it receives every code. Google’s help page on 2-Step Verification explains how to add that extra layer to a Gmail account. To move your Moonetix account to a new address, click Change email on the Account page and confirm with a code, as How to change your username or email explains.
7. Check your payout method. Make sure the address in the Payout method section is yours (more on this below).
8. Look at Recent security activity once in a while. It lists logins, failed logins, wrong codes and changes from the last 180 days, so a login you do not recognize stands out.

How your payout method is protected

Your payout method is where your earnings go, so it has its own safeguards. In the Payout method section of the Account page you choose PayPal or one of the listed cryptocurrencies, and enter the address: a crypto wallet address on the network you picked, or the email address of your PayPal account.

• A code confirms every change. When you click Save payout method, nothing is saved yet. The method shows as Not saved yet until you enter the 6-digit code we email to your account address, under Enter the code from the email to save this payout method. A stolen password alone cannot change where your money goes. Why account changes need a code explains the idea.
• You are told every time. After a change, you get an email titled “Your Moonetix payout method was changed” (or “was added” the first time) with the new address, and a Payout method changed notification under the bell icon. The change also appears in Recent security activity.
• Double-check the address. The form warns that crypto sent to a wrong address or network cannot be recovered, and that a PayPal email must be the exact address of your PayPal account. Copy and paste it rather than typing it.

If you get a payout method email you did not expect, act on it right away, as described below.

What Moonetix does on its side

• Security notifications. Turning login verification on or off, a new trusted device, a password change or reset, an email change, linking or unlinking Google or Discord, a payout method change, and a new API key, postback secret key or link hash salt each create a notification under the bell icon. A password change, a new password and a payout method change are also confirmed by email.
• Other devices are logged out when you change your password or email address, or turn on login verification.
• Attempts are limited. After several wrong passwords or codes, you have to wait or request a new code.
• Codes expire. Every emailed code works for 15 minutes.
• Suspicious logins are blocked. If a stolen “keep me logged in” cookie is reused, the login is refused and shows as Suspicious login blocked in your activity.

Your app secrets need the same care. How to keep your app secret safe covers the API key, postback secret and link hash salt.

What to do if something looks wrong

A login you do not recognize, a security notification you did not trigger, or a change you did not make: act in this order.

1. Change your password, or reset it with Forgot password? on the login page if you cannot log in.
2. Click Log out everywhere in the Sessions card. It ends every session, including yours.
3. Click Revoke all in the Trusted devices card. Log out everywhere does not remove trusted devices on its own.
4. Check the Google account and Discord account rows, and unlink anything you do not recognize.
5. Check the Payout method section and make sure the address is yours.
6. Turn on Login verification if it was off.
7. Tell us: click Chat with us under Need help? in the dashboard sidebar. If you cannot log in, use the contact form or write to support@moonetix.com from your account address, with what you noticed and when.

The full recovery path, including what to do if someone changed your email, is in What to do if your Moonetix account is compromised. How to contact Moonetix support lists every way to reach the team.

Frequently asked questions