PrestaShop back office security: update first, then add two-factor authentication

If you worry that a stolen administrator password could open your shop's back office, do two things: keep PrestaShop on the latest version and add two-factor authentication (2FA). With 2FA, signing in also takes a one-time code generated on each employee's phone. Updating closes the known flaws. 2FA makes sure a leaked password is not enough.

Vulnerabilities will keep appearing, and AI is speeding up the pace

All software has bugs. They are found over time and fixed in new versions. PrestaShop 9.2 was released on September 30, 2026. A few weeks earlier, PrestaShop 9.1.5 fixed five vulnerabilities reported through coordinated disclosure. Version 8.2.8, released at the same time, fixes them too.

One of them was an SQL injection in the back office list filters. It was discovered by Claude (Anthropic), through Anthropic's Coordinated Vulnerability Disclosure program, and Doyensec verified and reported it. In other words, AI is already finding real flaws.

According to the 2026 Verizon Data Breach Investigations Report, vulnerability exploitation is now the most common way in. For the first time in the report's 19 years, it has overtaken stolen credentials. Verizon links the worsening of patching to the sharp rise in vulnerabilities, and the use of AI to find them, by researchers and attackers alike, is expected to add even more load. Note that its data predates the “explosion” of AI-assisted research.

What PrestaShop does out of the box for back office access

Out of the box, PrestaShop asks only for a password to access the back office. And a password can be phished, guessed or reused from another site that suffered a breach. Verizon notes that stolen credentials are packaged and sold by initial access brokers. It also warns that pretexting (inventing a scenario so the victim hands over information or access) is increasingly common as a way in for ransomware and extortion. CISA sums it up: users who enable multi-factor authentication are significantly less likely to get hacked.

How to turn on two-factor authentication with our module

To add that second factor, we offer our Two-Factor Authentication (2FA) module for secure back office login. After the password, each employee types a 6-digit code generated on their phone. It is compatible with your PrestaShop. It uses no external services, subscription or API key: codes are verified on your own server.

You only need two things. First, a TOTP app (RFC 6238) on each employee's phone, such as Google Authenticator, Authy, 2FAS or Microsoft Authenticator. Second, a secure source of randomness on your server. If there isn't one, the module tells you.

1. Open the configuration. Go to Modules > Module Manager > Two-Factor Authentication (2FA) for Back Office Login > Configure.
2. Create your key. In “Employee 2FA Management”, find your row and click “Generate 2FA key”. Scan the QR code with your app and type the 6-digit code.
3. Store your recovery code. It is personal, single-use and has the format XXXX-XXXX-XXXX. You need it if you lose your phone.
4. Require it for the whole team. In “Global Settings”, enable “Force 2FA for all employees” once at least one administrator has a key. Anyone without one goes through a guided setup at their next login.
5. Set frequency and alerts. If you like, add “IP addresses exempt from 2FA”. In “Ask for a new code”, choose whether the code is asked at every login or every 1, 4, 8 or 24 hours, every week, every 15 days or every month. Then enable, as needed, “Remember trusted devices”, “Email on new connection” or “Email on failed attempts”.
6. Review access. You will find it in the “Activity Log” tab.

What the module includes

Before the November campaign, lock down access

Taking on extra staff in November or giving an agency access? Turn on “Force 2FA for all employees” before they start. That way, every new account sets up its key at its first login. Also turn on email on failed attempts: you will know without opening the back office. Your customers won't notice a thing, because only employee access is protected.

Frequently asked questions