diff --git a/frontend/src/views/components/ConfigSettings/ConfigForm/ConfigForm.js b/frontend/src/views/components/ConfigSettings/ConfigForm/ConfigForm.js
index b5cb87a..c553d48 100644
--- a/frontend/src/views/components/ConfigSettings/ConfigForm/ConfigForm.js
+++ b/frontend/src/views/components/ConfigSettings/ConfigForm/ConfigForm.js
@@ -105,17 +105,6 @@ const baseGroups = [
       show: config => config.http?.tlsMode !== 'proxy' && !!config.http?.httpsEnabled,
       hint: '默认使用 443；需要避开端口占用时可手动修改。'
     })
-  ]),
-  group('security', '通行密钥站点信息', '外部邮箱与通行密钥服务默认可用，由用户在安全设置中自行选择。留空时使用当前站点的安全默认值；密码算法和加密密钥由系统维护。', [
-    field('security.webAuthnRpId', '通行密钥站点域名', 'text', {
-      placeholder: '默认使用网页访问域名',
-      hint: '已绑定通行密钥后不要随意更换域名，否则原密钥可能无法使用。'
-    }),
-    field('security.webAuthnRpDisplayName', '通行密钥显示名称', 'text', { placeholder: 'Smail' }),
-    field('security.webAuthnRpOrigins', '通行密钥允许的来源', 'list', {
-      placeholder: 'https://mail.example.com',
-      hint: '每项填写不含路径的完整 HTTPS 来源；反代使用非标准外部端口时，请显式填写端口。'
-    })
   ])
 ]
 
diff --git a/test/frontend/config-form.test.mjs b/test/frontend/config-form.test.mjs
index 2d24f3f..3a12df7 100644
--- a/test/frontend/config-form.test.mjs
+++ b/test/frontend/config-form.test.mjs
@@ -10,17 +10,16 @@ const { readFormConfig, getFieldGroups, updateFormConfig, validateFormConfig } =
   source.replaceAll('export function ', 'function ') + '\nreturn { readFormConfig, getFieldGroups, updateFormConfig, validateFormConfig }'
 )()
 
-test('站点安全配置不再依赖旧全局开关，用户权限仍由账号设置管理', () => {
-  const config = { security: { webAuthnEnabled: false, externalEmailEnabled: false } }
+test('基础配置不再展示冗余安全选项与开关，通行密钥由系统默认解析，用户权限仍由账号设置管理', () => {
+  const config = { domains: { web: 'mail.old.com' }, security: { webAuthnEnabled: false, externalEmailEnabled: false, webAuthnRpId: 'mail.old.com' } }
   const groups = getFieldGroups('base', config)
   const security = groups.find(group => group.id === 'security')
-  assert.ok(security)
-  const keys = security.fields.map(field => field.path.join('.'))
-  assert.deepEqual(keys, ['security.webAuthnRpId', 'security.webAuthnRpDisplayName', 'security.webAuthnRpOrigins'])
-  const updated = readFormConfig(updateFormConfig(JSON.stringify(config), 'base', ['security', 'webAuthnRpId'], 'mail.example.com'))
-  assert.equal(updated.security.webAuthnRpId, 'mail.example.com')
+  assert.equal(security, undefined)
+  const updated = readFormConfig(updateFormConfig(JSON.stringify(config), 'base', ['domains', 'web'], 'mail.example.com'))
+  assert.equal(updated.domains.web, 'mail.example.com')
   assert.equal(updated.security.webAuthnEnabled, false)
   assert.equal(updated.security.externalEmailEnabled, false)
+  assert.equal(updated.security.webAuthnRpId, 'mail.old.com')
 })
 
 test('七个页面使用分组表单，控件和样式能编译且不再提供 JSON 编辑器', () => {