Wargaming sign-in: security and flow
This page explains in simple terms how Wargaming sign-in protects your Battle-Conquest account.
Redirection to Wargaming for sign-in
- When you click Log in, Battle-Conquest redirects you to the official Wargaming page.
- You authenticate directly with Wargaming.
- Wargaming then sends us a sign-in proof without exposing your password.
No Wargaming password stored by Battle-Conquest
Battle-Conquest never sees or stores your Wargaming password. We only receive the minimum data required to identify your account.
Nonce/state + expiration
- Each sign-in attempt gets a nonce (unique token) tied to your session.
- This nonce is checked when Wargaming redirects back, to confirm the response matches your action.
- The sign-in attempt expires quickly (about 10 minutes) to reduce abuse risk.
Replay attempt rejection
A sign-in response that was already used or is out of time is rejected. This blocks malicious reuse of old sign-in flows.
Limits & user best practices
- Enable two-factor authentication (2FA) on your Wargaming account.
- Always check the website URL before entering Wargaming credentials.
- Never share your credentials or one-time security codes.
- If in doubt, change your Wargaming password and contact support.