<TextField> needs PHP 8.4 and nothing else. No Composer packages, no build step, no external service to configure. Fewer moving parts, fewer things that can break between your machine and the server.

The first time you open the panel, there's no password to remember or change. You're asked to set one on the spot, and it's stored as a salted hash, never in plain text. Logging in after that checks the hash with a constant-time comparison, so a slow string match can't leak timing information about the real password.

Two settings in core/config.php matter once a site is ready to go live. devmode controls whether the panel dumps every template variable at the bottom of the page. That's genuinely useful while you're building a theme, and something you turn off before anyone else sees the site. cache controls whether compiled templates get regenerated on every request or just once. Turn it on, and the panel's "Publish" button becomes the one place that clears the cache and pulls in new content. That keeps production fast, and it means a stray click somewhere doesn't reflow the live site by accident.

Everything that writes to the filesystem, saving a field, uploading a file, renaming a page, sits behind the same session check, over a cookie marked HttpOnly and, on an HTTPS site, Secure. Every redirect the panel issues gets checked against the current host first too, so a crafted link can't bounce a logged-in admin off to some other domain.

None of this is exotic. It's the same handful of precautions any small admin panel should have, just applied everywhere instead of only where someone remembered to add them.