Private Shop for PrestaShop: complete guide

<p>DataFirefly Private Shop reserves all or part of your PrestaShop 8 and 9 shop for the customers you have approved. This guide covers installation, the three access modes, the layout of the private page, social login, request handling and the members-only pricing mode.</p>

<h2>Installation</h2>
<p>In the back office, go to Modules > Module Manager > Upload a module and drop the ZIP file. On install, the module creates its tables, adds the Customers > Access requests tab and registers the private page (a /module/dfprivateshop/private URL, rewritten to /private-access/ when friendly URLs are on).</p>
<p>Then open the module configuration. A banner at the top recalls the current state, your IP address and the redirect URI to declare with social login providers, and flags blocking points: missing cURL extension, img/dfprivateshop folder not writable, page cache module installed.</p>
<div class=”df-callout note”><p>The module ships disabled. Nothing changes on your shop until you pick a mode in the Access tab.</p></div>

<h2>Choosing an access mode</h2>
<h3>Whole shop is private</h3>
<p>Every page requires an account. Still reachable: the module sign-in page, the contact page if you allow it, the CMS pages you list as public, the password reset page and payment module controllers. This is the mode for a wholesaler, a club or a shop under preparation.</p>
<h3>Only selected parts are private</h3>
<p>You designate categories (their subcategories follow automatically), products by ID, brands, suppliers, CMS pages, the home page and URL patterns using the <code>*</code> character. The products concerned also disappear from listings, search, autocomplete, faceted filters and the product blocks of other modules, so no name, image or price shows through.</p>
<h3>Members-only pricing</h3>
<p>A separate switch, usable with the shop mode disabled or with selected parts. The catalog stays public and indexable, but visitors without access see neither prices, nor the add to cart button, nor the price filter and price sorting. The module turns PrestaShop’s native catalog mode on for the current request only, writing nothing to the database.</p>

<h2>Who gets access</h2>
<ul>
<li><strong>Logged-in, active customers.</strong> If you enable the group restriction, only accounts in the chosen groups get in; the others see the access denied message.</li>
<li><strong>Invitation codes.</strong> One code per line, with a validity in days. Removing a code from the list revokes it immediately, including for people who already entered it.</li>
<li><strong>Whitelisted IP addresses.</strong> One IP or CIDR range per line, IPv4 and IPv6. Handy for an office, a contractor or a test machine.</li>
<li><strong>Search engine bots</strong>, if you turn the option on. Googlebot, Bingbot, Applebot and DuckDuckBot are verified by reverse then forward DNS: a fake user agent does not get through.</li>
</ul>

<h2>Designing the private page</h2>
<p>The Design tab controls the look. Two layouts: full screen, with the form card on the left, centre or right of the media, or split, with the media on one side and the form on the other, width adjustable between 35 and 70 per cent.</p>
<p>The background accepts an image, a slideshow of two or three images with a slow zoom, a video, or a video and an image. For video: an uploaded MP4 or WebM file (a silent 10 to 30 second loop, under 8 MB recommended), a YouTube URL embedded in enhanced privacy mode, or a Vimeo URL. A dedicated image can be set for phones, where the media can become a banner above the form, a background, or disappear.</p>
<p>Media files are stored in <code>img/dfprivateshop/</code>, outside the module folder, so they survive updates. Then set the overlay, the accent colour, the corner radius, the card style (light, dark or frosted glass), the logo and the language switcher. The Preview button in the banner shows the page as visitors see it, without closing the shop.</p>
<div class=”df-callout tip”><p>Video does not load on phones by default, nor when the visitor has data saver on or asked for reduced motion. Always provide an image as well: it doubles as the poster during loading.</p></div>

<h2>Access requests and account approval</h2>
<p>In the Registration tab, decide whether the request tab appears on the private page, which fields are offered (company, company ID or VAT number, birth date, message, newsletter, partner offers) and which are required. A GDPR consent checkbox can point to a CMS page; the acceptance date is stored with the request.</p>
<p>With manual approval, each registration creates an inactive account and a row in Customers > Access requests. You filter by status, source or company, then approve or reject, one by one or in bulk. The customer gets the matching email, in their language. Addresses from the domains you list can be approved automatically, and your team can be notified of every new request.</p>
<p>The customer page shows the request and the linked social accounts. Activating a customer from their page counts as approval: the request status follows and the email goes out.</p>

<h2>Google, Facebook, Apple and Instagram login</h2>
<p>Each provider is enabled independently in the Social login tab. Copy the redirect URI shown in the banner: it must be declared exactly as is with the provider.</p>
<ul>
<li><strong>Google</strong>: create a Web application OAuth client in Google Cloud Console, then copy the client ID and secret.</li>
<li><strong>Facebook</strong>: create an app in Meta for Developers, add the Facebook Login product, then copy the app ID and secret.</li>
<li><strong>Apple</strong>: create a Services ID in your Apple developer account, then a Sign in with Apple key. You need the Services ID, the Team ID, the Key ID and the contents of the .p8 file, pasted in full, BEGIN and END lines included.</li>
<li><strong>Instagram</strong>: Instagram Business Login only authenticates professional accounts and never returns an email address. The customer types it in a short form after signing in.</li>
</ul>
<p>If the returned email already belongs to a customer account, the module asks once for that account’s password before linking the two, unless you chose to link addresses certified by the provider automatically. The buttons can also be shown on the theme’s native sign-in page.</p>
<div class=”df-callout warn”><p>Social login requires the PHP cURL extension and an HTTPS redirect URI. The configuration banner flags a missing cURL and the state of friendly URLs.</p></div>

<h2>Page cache</h2>
<p>Pages rendered for a visitor with access are sent with headers that forbid caching, including for LiteSpeed, Varnish and CDNs. If you use a page cache module, disable caching for logged-in customers in its settings: otherwise a member may be served the anonymous version of a page, without the reserved products or prices. The Smarty cache is cleared every time you save the module settings.</p>

<h2>Troubleshooting</h2>
<ul>
<li><strong>You can no longer reach your own shop</strong>: add your IP address, shown in the configuration banner, to the whitelist.</li>
<li><strong>A provider button does not appear</strong>: it is enabled but its credentials are incomplete. The configuration banner says so.</li>
<li><strong>A social login returns an error</strong>: check that the redirect URI declared with the provider is exactly the one in the banner, protocol and subdomain included.</li>
<li><strong>Prices are still visible</strong>: check that the visitor is not covered by the IP whitelist or an invitation code, and clear the page cache.</li>
<li><strong>A private product still shows in a block</strong>: the theme in use probably does not apply the expected product-miniature class. Contact us with the theme name.</li>
</ul>