Moduł Two-Factor Authentication (2FA) for Back Office Login dla PrestaShop

❓ What are the main features of this module?

• ⭐ Personal TOTP key per employee

Every employee sets up their own secret by scanning a QR code with Google Authenticator, Authy, Microsoft Authenticator or any RFC 6238 app, or by typing the key in by hand. The 6-digit code refreshes every 30 seconds and is checked on your own server, so the secret never leaves your store.

• ✨ Force 2FA for the whole team

One switch requires every employee to set up a key before they can open the back office. Staff without one are walked through a guided single-screen setup at their next login: they scan the QR code or type the secret by hand, confirm with a 6-digit code, and they are protected.

• ⚙️ Central 2FA management

A single table lists every employee with their 2FA status, setup date, last verification and failed-attempt count, so you see who is protected at a glance. Revoke any key in one click and it applies at their next login, or reset a lockout counter to unlock somebody instantly.

• ⚡ Brute-force lockout and replay protection

Accounts lock automatically after 10 consecutive wrong codes, and recovery-code attempts count towards the same limit. Each code works only once within its 30-second window, so a code that was intercepted is already worthless by the time it is replayed. An administrator can lift a lockout at any time.

• ⏳ Single-use recovery code per employee

Each employee gets their own recovery code, hidden on their row until they choose to reveal it, so losing a phone never means losing access. It works exactly once, and a new one is issued from the same table whenever you ask for it. If a whole team is ever locked out, adding an IP address you control to the exempt list gets you back in.

• ☑️ Trust your own devices

Employees can tick a box to skip the code on a browser they trust, and you decide how often a code is asked again, from every login to once a month. Trusted devices are cleared automatically whenever that employee's password or key changes.

• ✅ IP addresses exempt from 2FA

Exempt up to 32 addresses you control, such as your office or your VPN, and signing in from there never asks for a code. The check runs before every other rule, so even the forced setup is skipped, and it uses the address your server reports because forwarded headers can be faked.

• ✏️ Activity log of every sign-in

A dedicated tab records every connection, wrong code and lockout, newest first, with the date, the employee, their email and the IP address. Entries are colour-coded so a problem stands out at a glance, and only an employee allowed to edit employees can clear it, so the trail cannot be quietly erased.

• ✉️ Email alerts on sign-ins and failed attempts

Get an email the moment anyone signs in to your back office, with the employee, the IP address, the city and country the connection came from and the method used. The location is read from the geolocation database PrestaShop already installs, so nothing is sent to any outside service. A separate switch warns you when a code is rejected or an account locks out, which is the signal that somebody is trying to get in, so you can watch for intrusions without a message on every login.