diff --git a/.env.example b/.env.example
index 1d28c89..fbc64b9 100644
--- a/.env.example
+++ b/.env.example
@@ -7,8 +7,10 @@ BOT_USERNAME=YourBot_robot
 # Telegram user IDs allowed into the bot's admin menu and the web panel, comma-separated
 ADMIN_IDS=111111111,222222222
 
-# Web panel login password (change it any time with: mbs pass)
-ADMIN_PANEL_PASSWORD=change-me
+# Web panel login password — must be a real random string, min 8 chars
+# (panel refuses to start on "change-me"/"admin"/etc). Generate one: openssl rand -base64 12
+# Change it any time with: mbs pass
+ADMIN_PANEL_PASSWORD=
 
 # Domains — point all three A records at this server's IP (see README)
 PANEL_DOMAIN=panel.example.com
diff --git a/config.py b/config.py
index 7d66490..3f3e06c 100644
--- a/config.py
+++ b/config.py
@@ -27,7 +27,14 @@ def env(key, default=None, required=False):
 BOT_TOKEN = env("BOT_TOKEN", required=True)
 BOT_USERNAME = env("BOT_USERNAME", required=True)
 ADMIN_IDS = {int(x) for x in env("ADMIN_IDS", "").split(",") if x.strip()}
+
 ADMIN_PANEL_PASSWORD = env("ADMIN_PANEL_PASSWORD", required=True)
+if ADMIN_PANEL_PASSWORD in ("change-me", "changeme", "admin", "password") or len(ADMIN_PANEL_PASSWORD) < 8:
+    raise RuntimeError(
+        "ADMIN_PANEL_PASSWORD в .env слишком слабый или дефолтный — поставь случайный пароль "
+        "(например: mbs pass)"
+    )
+
 PANEL_DOMAIN = env("PANEL_DOMAIN", required=True)
 SUB_DOMAIN = env("SUB_DOMAIN", required=True)
 SITE_DOMAIN = env("SITE_DOMAIN", required=True)