Rugby Xplorer Login

Q: How do I, as an individual, login into Rugby Xplorer?

All individuals will need to sign up to Rugby Xplorer before they can login. Steps on the creating an account process is available here. 

You can login via:

• Rugby Xplorer App (available in Apple and Google Play stores). 
• Rugby Xplorer Portal: https://myaccount.rugbyxplorer.com.au/. 
• Enter your email address and password, plus verification code.

Login Process

What has changed?

• The "remember me for 30 days" option is no longer available on the login screen.
• Sessions on the Rugby Xplorer website now last 24 hours. After that, you'll need to login again with your email address and password, plus your MFA verification code if your account uses one.
• Your password has not changed. Your verification settings have not changed. Nothing about your account, your registrations or your records has changed.

Why did we make this change?

• A session keeps you logged in. When you login, Rugby Xplorer gives your browser a temporary pass, so it doesn't have to ask for your password on every page. That pass is what keeps you signed in and how long it lasts is one of the most important security settings on the platform.
• Shorter sessions mean stronger protection. The shorter a session lasts, the smaller the window in which it could ever be misused. That's why session length is one of the simplest and most effective ways we can protect your account.
• Administrator accounts need our strongest protection. The Rugby Xplorer portal, the admin portal and the memberships portal currently share a single login in the same browser, so one session length applies across all three. Administrator accounts can access sensitive member information, including children's names, dates of birth and contact details, so we set that shared session length to match the protection this information deserves.
  • Reducing the maximum session from 30 days to 24 hours meaningfully strengthens that protection for every user of the platform.
• This is part of a broader investment in security. We know a shorter session means logging in more often, and we don't take that trade-off lightly. It's a deliberate step to better protect the people and information you're responsible for, while we build the improvements below so that longer, more convenient sessions can return safely.

How long will I stay logged in now?

• The 24 hour limit is set by the platform. It is not a preference, and it cannot be extended by you, by an administrator, or by your browser.
• If you use the portals in more than one browser, you'll need to login separately in each one. Logging in on your laptop does not log you in on another computer.

Can I log in less often?

• Yes. We recommend using the Rugby Xplorer mobile app. It's also protected by Face ID (or your device's fingerprint or screen lock), keeps you signed in for far longer than the website can, and for most users it removes the need to sign in daily altogether.
• Why can the app do what the website can't? A phone has protected storage that a browser does not, and the app adds Face ID (or your device's fingerprint or screen lock) on top of it. The app's long-lived renewal key is kept inside that protected, Face ID-gated storage, and only a short working pass, valid for about an hour, is ever used outside it, renewed quietly in the background. So even someone holding your unlocked phone would still need your face, fingerprint or PIN to reach the key that keeps you logged in.
• A website doesn't have that same protected storage, which is why a 30-day website session carried more risk, and why we've reduced it while we build a safer alternative.

What's coming next?

• We're rebuilding how login works across Rugby Xplorer, with the goal of safely bringing back longer sessions as soon as possible.
• Your actual device will be recognised. Rather than issuing a pass that works for whoever holds it, the new system ties your login to the device you logged in on. A copy taken from your computer would simply not work anywhere else. That removes the reason the length had to be short.
• You will be able to see where you are logged in. A list of your own devices, with the ability to log out one of them on its own. If you lose a phone or use a shared computer and forget to log out, you will be able to deal with it yourself rather than waiting for a pass to expire.
• Passkeys instead of passwords. A passkey lets you login with the face scan, fingerprint or PIN you already use to unlock your device. There is nothing to remember, nothing to type, and nothing that can be handed over to a fake login page, because a passkey only works on the real Rugby Xplorer site. We intend to make passkeys available generally and to require them for administrator accounts, which carry the most access.
• Suspicious logins will be challenged. If a login appears from somewhere that doesn't fit your normal pattern, we'll ask you to confirm it's really you.
• Please note: this is a significant piece of work and will be rolled out application by application. We don't have a release date yet, but we'll keep you updated as it progresses.

Frequently Asked Questions?

• Has something happened? Has my account been accessed?
  • No, nothing has happened to your account. This change came from our own proactive security testing, not from an incident. We identified an opportunity to strengthen protection and acted on it straight away.
• But I only ever use my own computer.
  • This change isn't about who's at your desk. It's about limiting how long a session could ever be used if it were copied, wherever that happened, which protects you even if you only ever use your own device.
• Why not keep the option for parents and players, and remove it only for administrators?
  • The Rugby Xplorer portal, the admin portal and memberships portal currently share one sign-in in the same browser, so one setting applies to all of them. Giving each its own session length is part of the rebuild described above.
• Why does the app get to keep me signed in when the website does not?
  • A phone can protect a login in ways a browser cannot, and the app only holds a working pass for about an hour at a time. See above for additional information.
• Will the 30 day option come back?
  • Yes, that's our intention, once your device can be recognised as described above. There's more work to do first, so we don't have a release date yet, but safely bringing back longer sessions is very much the plan.
• I am not receiving my verification code.
  • Check your junk or spam folder first. You can switch between receiving codes by email and by text message under Security on your My Profile page. Entering an incorrect code too many times locks the account for 10 minutes, after which you can try again. More information is available here.
• Can I turn MFA off so I login more quickly?
  • Administrator accounts can't turn off MFA, because of the sensitive information they can access. Accounts without administrator permission can turn MFA off, but we'd strongly encourage you to leave it on, it's what protects you if your password is ever guessed or reused from another site.