Everything you'd want to know before you install.
A detailed look at how 2FA Google Authenticator for PrestaShop works, why we built it the way we did, and the thinking behind the features above.
Why 2FA on PrestaShop
The PrestaShop back-office is the #1 target of attacks on your store. A compromised admin password (via phishing, leak from another app, dictionary attack) means direct access to your orders, your customers, your source code. 2FA adds a second layer: even with the password, the attacker can't log in without the phone. Over the past six years, more than 80% of documented PrestaShop intrusions would have been prevented by an active 2FA.
TOTP standard, no proprietary service
The module follows the RFC 6238 (TOTP) standard — the same as Google Authenticator, Authy, 1Password, Microsoft Authenticator, etc. This means your employees use the app of their choice, without installing a specific app. If your company already has 1Password, 2FA simply adds itself to existing secrets. No third-party service, no per-user cost, no external dependency.
Progressive configuration
2FA can be enabled globally (all admins must use it) or per employee profile (Super Admin mandatory, other profiles optional). This allows progressive rollout: start with sensitive profiles, observe team reaction, then generalise. Activation from Preferences → 2FA Google Authenticator.
Handling phone loss
The scenario "I can't log in anymore, I changed my phone" is anticipated at two levels. First safety net: 10 single-use recovery codes, generated at the initial pairing. The employee keeps them in their password manager or printed in a safe. Second safety net: a Super Admin can reset an employee's 2FA from their profile in one click. The next login will request the initial pairing again with a new QR code.
Security and audit
Each employee's TOTP secret is encrypted with AES-256 in the database — even read-only SQL access doesn't allow regenerating codes. Every attempt to enter the 2FA code is logged with success/failure, employee, IP, date. An excessive number of failures on an account triggers an automatic temporary lock to slow down brute-force attacks.
Reviews
There are no reviews yet.