Back office 2FA : to secure admin logins - Module PrestaShop

Secure your PrestaShop Back-Office with Two-Factor Authentication (2FA)

Did you know that a password, no matter how complex, is no longer enough to guarantee the security of your online store? Faced with the rise of phishing and credential theft, access to your administration is the preferred target for hackers. Our Two-Factor Authentication (2FA) module adds a second step to every sign-in: the 6-digit code of an app on the employee's smartphone. With a valid license, a stolen password is no longer enough: no page, no form and no AJAX call runs in your back office without that code. Without a valid license, the module disables itself: no code is asked and the module pages are closed, while enrolments, recovery codes, trusted devices, settings and journal are kept.

A Second Lock Against Password Theft

The security of your turnover and the protection of your customer data are your priorities. The module relies on the open TOTP standard (Time-based One-Time Password, RFC 6238) supported by the common authenticator apps: the code changes every 30 seconds and works only once. You strengthen the protection of your store's personal data and build trust within your management team; the access journal helps you document your GDPR obligations.

A Sign-In That Does Not Slow Your Team Down

A two-factor authentication that people bypass because it wears them out protects nobody. The module reduces the number of codes asked without weakening the check:

• One code per month and per browser: a trusted device is remembered for 30 days (adjustable), whatever the IP address. Each employee sees their devices and removes the ones they no longer use.
• A verified session of 12 hours: a single code per working day, even on a browser that is not remembered. The duration is adjustable from 1 to 168 hours and signing out ends it.
• Quick entry: the code is sent at the sixth digit, and the "Remember this device" box is ticked by default (adjustable).

Key Features

• Universal Compatibility: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden or any TOTP app. Set-up by QR code, by a readable setup key or with the "Open in the app" button on a phone.
• Granular Profile Management: make 2FA mandatory for critical profiles (e.g., SuperAdmin) and let the others turn it on themselves from "My two-factor authentication".
• Configurable Grace Period: give your employees a few days (7 by default) to get equipped before making double authentication mandatory. The delay runs from the day the profile becomes mandatory, and a banner shows the days left.
• Lockout After Wrong Codes: after 5 wrong codes (adjustable), the account is locked for 15 minutes (adjustable). The lockout is stored in the database: signing in again does not reset the attempts.
• Dashboard and Journal: super administrators see who is protected, who is locked out and who still has to set up 2FA, and read the history of verifications, failures and security changes.
• Reset a Colleague: an employee lost their phone? A super administrator resets or unlocks the account in a few clicks, after confirming with their own code.
• Check Before Any Action: while the module is active, the code is required before a page, a form or an AJAX call runs. Changing phone or creating new recovery codes also requires a valid code.

A valid license, continuous protection

Two-factor authentication only applies with a valid license. If the license is missing, expired, suspended or revoked, or if the domain or signature is not recognized, the module disables itself on all shops: no code is asked at sign-in and the module pages are closed. Enrolments, recovery codes, trusted devices, settings and journal are kept, and the shop stays available: only the password then protects the back office. The license form remains reachable from Configure.

Activate or renew the license from that page, choosing the context that covers all shops in multistore: the module re-enables itself at once and, from the next page, the back office asks for the code again. A paid license is not cut off by mistake: the module keeps the protection for seven days after the stored end date, checks the server at most once an hour and tolerates seven days of temporary answers from the first failure. A definitive answer (expired, suspended or revoked license, unknown domain or signature) is applied immediately.

Why Choose This Solution for Your PrestaShop Store?

Unlike other complex solutions, our module was designed for demanding e-merchants who don't want to sacrifice their time. It offers a balance between high security and ease of use.

• Peace of Mind: your catalog, margins and customer files are protected by a digital double lock.
• Always a Way Back In: 10 single-use recovery codes per employee, the reset by a super administrator, the DISABLE_2FA file and the wepresta:2fa:disable console command keep you from a permanent lockout.
• Lightweight: no override, no third-party PHP library, encrypted and authenticated secrets, an archive of less than 250 KB.
• A valid license, no re-enrolment: without a license, the module disables itself and keeps enrolments, recovery codes and settings; once the license is activated or renewed, protection resumes without enrolling employees again.

Simple, Fast, and Effective Installation

You don't need to be a cybersecurity expert to protect your business. Installation takes just a few clicks directly from your module manager. Once activated, the module guides each employee step by step through the set-up of their mobile app: two minutes are enough. Pick the mandatory profiles, and your PrestaShop back-office benefits from professional-grade protection, ready to face modern web threats.

Compatibility

Compatible with PrestaShop 1.7.8, 8.0+ and 9.0+, with PHP 7.4 minimum (json, openssl and mbstring extensions). PrestaShop 1.7.7 and earlier versions are not supported. One archive fits all these versions. The interface is available in French, English, Spanish, Italian and Polish. On PrestaShop 1.7, the settings page points out three legacy stand-alone PrestaShop scripts (backup.php, pdf.php, get-file-admin.php) to delete: they answer to a signed-in employee without going through the check of the module.

Support is provided from your WePresta customer area or by email at mail@wepresta.shop, depending on the support option of your plan. Read the full documentation