How to secure the PrestaShop back office

The back office is the most valuable way into a PrestaShop store: an administrator account can change prices, payment methods and installed modules, and read customer data. The measures below add up. None of them is enough on its own, but together they close the most common routes in.

1. Update PrestaShop and your modules

A known flaw in PrestaShop itself or in a module can let someone in without a password. That is why the first measure has nothing to do with the login page.

1. Apply PrestaShop maintenance releases as soon as they come out, after taking a backup.
2. Update your modules from the module manager or through their vendor.
3. Uninstall and then delete modules you no longer use: a disabled module leaves its files on the server.

To find out which of your modules have a known vulnerability, read our guide How to check if your PrestaShop modules are vulnerable.

2. Keep the admin folder name unpredictable

PrestaShop requires the administration folder to be named something other than admin. Pick a random name that cannot be guessed from your store name, and never publish it: not in a public support ticket, not in a shared screenshot. If the name has been leaked, rename the folder.

On its own this does not protect you. What it mainly does is stop bots from finding the login page on the first try.

3. One account per person, with the right permissions

1. Create a named employee account for each person, contractors included. Never share a login.
2. Give each person a profile limited to what they need: someone who packs orders does not need to manage modules.
3. Keep the SuperAdmin profile for one or two people.
4. Disable the account of anyone who leaves the company, or of a contractor whose job is done, straight away.

Forgotten accounts are a classic risk: nobody notices when they are being used.

4. Long, unique passwords

Every employee should use a long password that is not used anywhere else. A password manager makes this easy to stick to. Change any password right away if it was sent by email, written in a shared document, or used on another site that suffered a breach.

5. Turn on two-factor authentication

Two-factor authentication asks for a second proof after the password: a one-time code generated by an app on a phone, or a security key. A stolen or guessed password is no longer enough to get in.

Sentinel adds it to the back office for free: authenticator app (TOTP), passkeys and FIDO2 security keys, single-use backup codes and trusted devices. You can make it mandatory for an employee profile, set a deadline to comply and see who has turned it on. The details are on the two-factor authentication page.

6. Restrict access to your team’s IP addresses

If your team works from fixed IP addresses (office, VPN), you can restrict the back office to those addresses only. Outsiders then do not even see the login page.

There are two ways to do it:

• at server level, with a rule set by your host or in your web server configuration;
• with Sentinel’s free back-office access control: you enter the allowed IPv4 addresses, IPv6 addresses or ranges, and any other address is redirected to the store’s 404 page. Customers can still shop as usual. Sentinel refuses to save a list that does not include your own address, so you cannot lock yourself out.

If your store sits behind Cloudflare, a CDN or a reverse proxy, declare it before turning filtering on; otherwise the server only sees the proxy’s address.

7. Limit login attempts

A brute-force attack tries a large number of passwords on the login page. Without a limit, nothing stops it except the strength of the password.

Some hosts offer this kind of filtering. Sentinel Pro temporarily bans from the back office any address behind too many failed logins, using a threshold, time window and ban duration that you set. Customers sharing that address can still order from the store. Two-factor authentication also blocks the address after several wrong codes in a row, including in the free version.

8. Monitor logins and accounts

Protection only helps if someone is watching what happens:

1. Regularly review the list of employees and when each last logged in.
2. Look into repeated failed logins and unfamiliar addresses.
3. Disable accounts that have gone unused for a long time.

Sentinel’s free security logs record failed logins, blocked back-office access and two-factor authentication events, with filters by date, IP and type. Sentinel can also automatically disable employee accounts that have not used the back office for a number of days you choose, without ever deleting an account.

On the hosting side

Some measures are up to your host or your developer:

• serve the whole site, back office included, over HTTPS;
• run a PHP version that is still maintained;
• have automatic backups of files and database, stored off the server and tested;
• protect FTP, SSH and hosting control panel access as carefully as the back office.

Where to start

If you only do three things this week: update your modules, turn on two-factor authentication for every administrator account and clean up your employee accounts. Sentinel Free covers two-factor authentication, IP filtering, logs and the vulnerability scanner, and it installs in a few minutes. Pro features are listed on the pricing page.