Admin Shield: securing the PrestaShop 8 and 9 back office

Admin Shield protects access to the PrestaShop 8 and 9 back office. The module is configured from Advanced Parameters > Admin Shield, organized in seven tabs: Dashboard, Login history, Activity log, Active sessions, Bans and locks, Settings and Back office access.

Installation

1. In Modules > Module Manager, click Upload a module and send the ZIP file.
2. Installation clears the PrestaShop cache: every back office page is protected from the next request.
3. The module grants every employee profile the right to view the module. Without it, PrestaShop would not run its hooks for those employees and their actions would not be logged.

Recommended first settings

1. Settings tab, IP addresses block: click Add my current IP to the whitelist. A whitelisted IP is never blocked.
2. Check the Detected client IP line. Behind Cloudflare or a proxy, keep the Automatic mode or choose the matching mode.
3. Configure the anti-bot verification (see below) and test the keys.
4. Click Send me a test e-mail to check that the shop e-mails go out.
5. Back office access tab: rename the admin folder if the checklist reports it as easy to guess.

Test each protection from a private browsing window without closing your main session.

Login attempt limiting

By default, 5 failures on the same account from the same IP, or 15 failures from one IP across all accounts, within a 15-minute window, lock the login for 15 minutes. With the progressive lock, the duration doubles at each repeat within 24 hours, up to 24 hours. After 3 locks in 24 hours, the IP is banned for 7 days. The lock applies to the IP and account pair: an attacker cannot lock out a legitimate employee connecting from another address. Forgotten password requests are limited to 5 per IP and hour.

The Bans and locks tab lists active locks, which you can release, and bans, which you can remove. You can also ban an IP or a CIDR range manually there.

IP addresses and country filter

The whitelist accepts IPs and IPv4 and IPv6 CIDR ranges, one per line. The Only allow the whitelist option refuses every other address; it is only saved if your current IP is in the list.

The country filter works in allow mode (only the chosen countries) or block mode. The country comes from the Cloudflare header when the request really comes from Cloudflare servers, otherwise from an MMDB database. Click Download the DB-IP Lite database to install the free country database, to be updated roughly every two months. Local network addresses are never filtered, and saving is refused if it would block your own connection.

Refused visitors get a 403 page, or a 404 page if you prefer to hide that the back office exists.

Anti-bot verification: Turnstile or hCaptcha

1. Create a widget on dash.cloudflare.com (Turnstile) or dashboard.hcaptcha.com, allowing the domain of your back office.
2. In Settings, choose the provider, paste the site key and the secret key, then save.
3. Solve the test widget and click Verify and activate.

The check only applies to the login page after this successful test: a wrong key cannot lock the administrators out. Any key change disables it until the next test. By default, logins go through if the provider cannot be reached.

Back office access: secret link and admin folder

Secret access link

Once enabled, the back office only opens in a browser that has visited the secret link once; everyone else gets a 404 page. The browser that enables it keeps access, and the link is e-mailed to the alert recipients. Generate a new link invalidates every browser except yours. Whitelisted IPs never need the link.

Rename the admin folder

A random name is suggested. Before renaming, the new address is e-mailed; the folder is then renamed and the cache cleared. Log in again at the new address and update the cron tasks that point to the old folder. If the web server is not allowed to rename the folder, do it by FTP and then clear the cache in Advanced Parameters > Performance.

Unusual login alerts

The first login of each employee after installation becomes the reference. An alert is then sent for a new IP, a new country, a new browser or system, or a login outside the time range entered (for example 07-21). Recipients are the employee, the super administrators and the extra addresses. The It was not me link in the e-mail, valid for 7 days, bans the IP, closes the employee’s sessions and invalidates the password; the employee chooses a new one with Forgot your password.

The webhook field also posts these alerts, locks and sensitive changes to Slack, Microsoft Teams, Discord, Google Chat or Mattermost.

Active sessions and inactivity

The Active sessions tab lists open sessions with the IP, country and device of the login. You can close a session, log out all your other sessions, or log an employee out everywhere. The Log out after inactivity setting closes sessions left idle beyond the chosen delay; automatic back office refreshes do not count as activity.

Activity log

Every creation, modification and deletion made in the back office is recorded with the employee, the IP, the page and, for a modification, the old and new value of each field. Passwords and tokens are masked. Module installations, uninstallations and upgrades are tracked too. Changes to employees, profiles, API keys, shop URLs and module installations are marked sensitive and e-mailed to the administrators. Filter by employee, action or object, and export to CSV. Add the object classes not to log in Settings.

Security report

The report is sent every week or every month to the super administrators and the extra addresses. For reliable delivery, call the cron URL shown in Settings once a day. Without cron, the report leaves on the next back office visit once it is due. The Send me the report now button gives a preview.

Emergency access

If you are locked out, create an empty file named disable.flag by FTP in modules/dfadminshield/: every protection stops until it is deleted. Do not delete the module folder, the PrestaShop Symfony container references it. The DFAS_KEY value of the configuration table holds the secret link key.

Two-factor authentication

Admin Shield protects the login page and watches access, without asking for a code after the password. To add that step, also install the DataFirefly 2FA Google Authenticator module: both work together.