PrestaShop back-office 2FA: how to secure admin sign-in
A merchant guide to PrestaShop back-office 2FA: TOTP setup, mandatory profiles, trusted devices, lost-phone recovery and what a licence change does.
Passwordless sign-in for PrestaShop 1.7.8, 8.0+ and 9.0+: e-mail code, one-click link and Google, with the path from the cart to the order and the consents of your shop.
The customer types a 6-digit code or presses the button of the e-mail: no password to remember.
The official Google button: the token is checked on your server and the account is found or created.
Name, the consents of your shop, the welcome e-mail and the hooks of your other modules, as for any registration.
Limits per code, address and visitor, a token for each visitor, return pages limited to your shop, no e-mail address in the statistics.
From the cart the customer signs in and comes back to their order, or orders without an account if you allow it.
An archive of about 310 KB, nothing loaded on the pages that do not need it, a test e-mail and a diagnostic to check your settings.
Passwords are the biggest enemy of your conversion rate. According to the Baymard Institute, nearly one shopper in five has abandoned an order because the site wanted them to create an account. Magic Login permanently removes this barrier by offering your customers a modern, fluid, and secure "Passwordless" experience: they type an e-mail address, confirm it, and they are signed in, or they get a real account of your shop without ever choosing a password.

Give your users the simplicity they deserve. With Magic Login, there's nothing to remember and nothing to mistype:

A new customer gives a name and accepts the consents of your shop (privacy, newsletter, partner offers), then receives the welcome e-mail; the hooks of your other modules (CRM, newsletter) are called as for any registration. A guest account with the same address becomes a customer account and keeps its orders, the cart follows the customer and the automatic vouchers of their group apply.

Forget dull, standard PrestaShop forms. Magic Login deploys a dedicated full-screen interface, stripped of headers and footers to eliminate distractions. Fully optimized for mobile browsing, it features smooth AJAX transitions (no page reloads) and a clean design that builds buyer confidence during checkout. It is accessible (labels, announced errors, keyboard use, reduced motion) and independent of your theme: choose your accent colour, write a title and a sub-title in each language and add a picture beside the form, with a preview in the back office.

Magic Login is built to supercharge your checkout flow. It becomes the login and registration page of the whole shop (the โSign inโ link of the theme, โMy accountโ in the footer, the pages that need an account). When an unauthenticated user clicks "Checkout," they are redirected to the Magic Login screen. Once logged in, they land exactly where they left off, with their cart intact, or they choose Order without an account when your shop allows guest checkout. You can also disable "Guest Checkout" and turn every sale into a loyal customer account: the module gives the setting back as it was if you change your mind or uninstall it.

Magic Login works in harmony with the native structure of PrestaShop: it never changes the tables of your shop. On the security side, codes are stored hashed and work once, Rate Limiting applies to the tries per code, the codes per address and the codes per visitor, an address that collects too many wrong codes is locked for a while, every request carries a token of the visitor (CSRF protection), and the return pages must belong to your shop. An option refuses disposable e-mail addresses. The Statistics tab shows the codes sent, the sign-ins by code, link and Google and the new accounts, with a CSV export that holds no e-mail address; a test e-mail and a diagnostic check your configuration in a minute.

The module works with PrestaShop 1.7.8, 8.0+ and 9.0+ and needs PHP 7.4 or later; PrestaShop 1.7.7 and earlier are not supported. It overrides no class of the shop and works next to Social Login 2: the buttons of your other sign-in modules appear on the page.
Ready to remove the password? Install Magic Login, add your Google client ID if you wish, and let your customers sign in with an e-mail address. Read the full documentation.
See how we compare to the most common alternatives on the market.
| Feature | WePresta | Addons |
|---|---|---|
| payments Transparent pricing | check_circle | cancel |
| update Lifetime updates included | check_circle | cancel |
| support_agent Direct developer support | check_circle | cancel |
| verified PS 1.7, 8 & 9 compatible | check_circle | help_outline |
| code Standardized clean code | check_circle | cancel |
| storefront Multi-store ready | check_circle | help_outline |
| money_off No hidden renewal fees | check_circle | cancel |
Find answers to frequently asked questions about this module
Join +111 merchants using this module
5-minute installation · Full documentation included
check_circle
check_circle