Protecting the PrestaShop back office: securing administrator logins without locking yourself out

Purpose

Strengthen protection of access to the PrestaShop back office while avoiding locking yourself out. This article explains which protections to enable (2FA, firewall, CAPTCHA, attempt limiting), in which order, and how to configure backups and whitelists to prevent administrative lockouts.

Audience and prerequisites

• You are an administrator of a PrestaShop store (1.7 to 9).
• The Securantis module for PrestaShop is installed and enabled.
• You have a Securantis account on the SaaS platform and an active license to use advanced features (firewall, global 2FA, quarantine).
• Access to another backup administrator account or FTP/SSH access for recovery if needed.

Overview of relevant protections

• Firewall (WAF): blocks malicious requests before they reach PrestaShop.
• 2FA (two-factor authentication): adds an additional factor to log in to the back office.
• reCAPTCHA / CAPTCHA: limits automated attempts from login forms.
• Attempt limiting and IP blocking: reduces the likelihood of brute-force attacks.
• Manual quarantine: isolation of suspicious files/modifications (human action required to delete or restore).

Recommended steps (recommended order)

1. Enable protection on a test administrator account

• Before applying a global protection, enable it on an administrator account you can test. This allows you to evaluate the effects without impacting all administrators.

2. Install and verify the Securantis license

• In the module, verify that the license is activated to unlock configuration of the firewall and global 2FA.

3. Enable 2FA for your administrator account

• Enable 2FA on your personal account first. Configure the authentication app (TOTP) on your phone or a hardware token and save the provided backup codes.
• Verify login with 2FA before enabling additional protections.

4. Set up a secondary administrator account

• Create at least one other administrator account and enable 2FA on it. This account will serve as a fallback if the primary account encounters a problem.

5. Gently enable attempt limiting and CAPTCHA

• Enable an attempt limiting system (e.g. 5 to 10 attempts before a cooldown) and enable reCAPTCHA on the login form.
• Prefer progressive block durations rather than permanent blocks (e.g. 15 minutes → 1 hour → 24 hours) to reduce the risk of accidental lockout.

6. Enable the firewall (WAF) in monitoring mode

• If the firewall offers a “passive” or “monitoring” mode, enable it first to observe which rules would be applied.
• Analyze events for 24–72 hours before enabling automatic blocking.

7. Enable global 2FA (with caution)

• Only enable global 2FA after securing at least two administrator accounts and validating 2FA access on each.
• Inform all administrators of the steps to follow for activation and management of backup codes.

8. Configure automatic notifications

• Enable notifications to be alerted of blocked login attempts, firewall rule changes, and quarantines.

Expected outcome

• Automated and malicious attempts are significantly reduced.
• Legitimate administrators continue to log in using 2FA and CAPTCHA.
• Incidents are notified by email and visible in the Securantis console.
• Suspicious files are isolated in quarantine pending human decision.

Prudent settings and practical advice

• Always enable 2FA on at least two administrator accounts before applying global 2FA.
• Prefer progressive temporary blocks rather than permanent lockouts.
• Store 2FA backup codes in a safe place; never transmit passwords or codes via unsecured email.
• Add your IP range or the office IP to a whitelist if your team works from a fixed address. If your administrators have changing IPs, avoid a strict whitelist.
• Keep an alternative access method (FTP/SSH or an email account linked to the server) to restore access in case of problems.

Common mistakes and how to avoid them

• Problem: enabling global 2FA without a fallback account => Risk of collective lockout. Solution: configure at least two accounts with 2FA and keep backup codes.

• Problem: legitimate IPs blocked after strict firewall activation. Solution: use the firewall’s monitoring mode first and review the logs; add legitimate IPs to a whitelist.

• Problem: forgetting 2FA backup codes. Solution: store the codes encrypted in a secure password vault and document the recovery procedure.

• Problem: exclusive reliance on CAPTCHA which blocks legitimate users. Solution: combine CAPTCHA with progressive delays and 2FA rather than CAPTCHA alone.

Step-by-step troubleshooting

1. Unable to log in after enabling a protection

• Check whether you have another administrator account with 2FA enabled.
• Attempt recovery using the 2FA backup codes.
• If you cannot recover, use FTP/SSH access to temporarily rename the Securantis module folder (fallback procedure) to restore back office access, then fix the configuration.

2. IP blocked by the firewall

• If the firewall shows blocking entries, note the IP and the reason.
• If you control the blocked IP, add it to the whitelist and request removal of the block via the Securantis interface.

3. Massive attempts detected

• Enable automatic notifications and see if requests come from a few IPs: isolate and block those IPs.
• Investigate the targeted routes and strengthen rules applicable to those routes.

Security precautions

• Never automatically delete detected files without human review. Quarantine is the recommended default setting.
• Never share passwords, 2FA codes, or keys via email or unsecured chat.
• Interventions requiring sensitive access (FTP, database) must follow the Securantis client procedure if a paid intervention is requested.

When to contact Securantis support

Contact support if:

• You are locked out of all administrator accounts without backup codes.
• The firewall is massively blocking legitimate visitors and you cannot correct the configuration.
• You observe unknown and suspicious file modifications requiring in-depth analysis.

Before contacting support, prepare:

• A precise description of the problem and the time it occurred.
• Screenshots of any error messages and event logs from the Securantis interface.
• A list of actions already attempted (2FA reset, IP whitelisting, restore from backup).

Conclusion

Protecting the PrestaShop back office is an exercise in balance: enabling strong protections (2FA, firewall, CAPTCHA) while retaining fallback paths and progressive configurations reduces the risk of unauthorized access without risking administrative lockout. Follow the recommended order, first enable protections on a test account, keep secondary accounts and backup codes, and use the firewall’s monitoring mode before automatic blocking. If you are stuck, Securantis support can assist you according to secure procedures and after identity verification.