Two-factor authentication and protecting the PrestaShop back office

The back office is the key to everything: orders, customers, prices, modules and, in many stores, the ability to upload files to the server. Protecting it has more impact than almost any other measure.

1. Two-factor authentication

With 2FA, a stolen password is not enough: a code from a phone or email is also needed. PrestaShop does not include it out of the box in every version, but there are modules that add it. Enable it for all employees, not just the administrator.

2. Minimum profiles

In Advanced Parameters > Team > Roles you can create profiles with access only to what is needed. Someone who picks orders does not need to install modules or see the payment settings.

3. IP lists

If your team works from fixed locations, restricting back office access by IP is very effective. Careful: behind a CDN or a proxy, the store sees the proxy’s IP, not the employee’s; configure the real-IP headers properly or you will lock yourself out.

4. Lockout after failed attempts

Limit failed login attempts and send an alert when the limit is exceeded. Brute-force attacks against the login are constant.

5. Logging

Regularly review the access log and the active employees. An employee who no longer works with you should be disabled the same day.