Moduł Two-Factor Authentication (2FA) for Back Office Login dla PrestaShop

❓ What are the main features of this module?

• ⭐ Personal TOTP key per employee

Every employee sets up their own secret by scanning a QR code with Google Authenticator, Authy, Microsoft Authenticator or any RFC 6238 app, or by typing the key in by hand. The 6-digit code refreshes every 30 seconds and is checked on your own server, so the secret never leaves your store.

• ✨ Force 2FA for the whole team

One switch requires every employee to set up a key before they can open the back office. Staff without one are walked through a guided single-screen setup at their next login: they scan the QR code or type the secret by hand, confirm with a 6-digit code, and they are protected.

• ⚙️ Central 2FA management

A single table lists every employee with their 2FA status, setup date, last verification and failed-attempt count, so you see who is protected at a glance. Revoke any key in one click and it applies at their next login, or reset a lockout counter to unlock somebody instantly.

• ⚡ Brute-force lockout and replay protection

Accounts lock automatically after 10 consecutive wrong codes, and recovery-code attempts count towards the same limit. Each code works only once within its 30-second window, so a code that was intercepted is already worthless by the time it is replayed. An administrator can lift a lockout at any time.

• ⏳ Single-use recovery code per employee

Each employee gets their own recovery code, hidden on their row until they choose to reveal it, so losing a phone never means losing access. It works exactly once and then a fresh one is issued. If a whole team is ever locked out, a single configuration value in the database lifts the requirement.

• ☑️ Trust your own devices

Employees can tick a box to skip the code on a browser they trust, and you decide how often a code is asked again, from every login to once a month. Trusted devices are cleared automatically whenever that employee's password or key changes.

• ✅ IP addresses exempt from 2FA

Exempt up to 32 addresses you control, such as your office or your VPN, and signing in from there never asks for a code. The check runs before every other rule, so even the forced setup is skipped, and it uses the address your server reports because forwarded headers can be faked.

• ✏️ Activity log of every sign-in

A dedicated tab records every connection, wrong code and lockout, newest first, with the date, the employee, their email and the IP address. Entries are colour-coded so a problem stands out at a glance, and only an employee allowed to edit employees can clear it, so the trail cannot be quietly erased.

• ✉️ Email alerts on sign-ins and failed attempts

Get an email the moment anyone signs in to your back office, with the employee, the IP address and the method used. A separate switch warns you when a code is rejected or an account locks out, which is the signal that somebody is trying to get in, so you can watch for intrusions without a message on every login.