Shopping Cart
There are no more items in your cart
- Tecnoacquisti.com
- Online Security Blog
PrestaShop 8 and PrestaShop 9 have introduced a significantly more robust authentication system compared to versions 1.7 and earlier, for both the Back Office and the Front Office. In this article, we explore how login management works, how to properly configure passwords and session cookies, and which additional tools allow for advanced access control.
How login works in PrestaShop 8 and 9
PrestaShop 8 and 9 share a very similar authentication architecture, significantly improved compared to previous versions. The login procedure has been made more secure on both fronts — Back Office and Front Office — with native mechanisms that can be enhanced through dedicated modules.
Back Office Login: security and control
Access to the Back Office is reserved for administrators and authorized users. PrestaShop 8 and 9 integrate a protected login screen that can be further strengthened through two-factor authentication (2FA) and access monitoring. For those who need advanced control and complete traceability, the module Admin Login Monitor + 2FA for PrestaShop adds:
- Complete access audit: successful logins and failed attempts, with date, time, and IP address.
- Automatic detection of IP changes and whitelist of trusted addresses.
- 2FA TOTP to prevent unauthorized access even if the password is compromised.
- Dedicated security dashboard with detailed reports accessible from the Back Office.
Front Office Login: customer and B2B access
In the Front Office, login allows customers to access their orders, personal data, and any reserved offers. In PrestaShop 8 and 9, the authentication procedure is more modular than in the past and is well-suited for integration with extensions designed for specific business models. For advanced B2B access management, the module PrestaShop B2B Request — Registration and validation of B2B customers allows you to:
- Hide prices from customers not yet authorized.
- Display personalized messages during login or registration.
- Introduce a B2B registration request flow with manual validation from the Back Office.
- Assign custom groups to the customer after validation for precise profiling.
Password management and security in PrestaShop
Password security is one of the most delicate aspects of managing an ecommerce. PrestaShop 8 and 9 use secure hashing algorithms to save user and administrator credentials, ensuring that data is never stored in plain text in the database.
Setting password complexity
From PrestaShop 8, it is possible to define minimum complexity requirements for passwords, both for Front Office customers and Back Office operators. Configurable options include:
- Minimum password length.
- Requirement to include special characters, numbers, and uppercase and lowercase letters.
- Blocking of passwords that are too weak or already known as compromised.
These settings are found in the Advanced Parameters > Security section of the Back Office.
Cookie and user session management
Cookies are fundamental for managing user sessions both in the Back Office and Front Office. PrestaShop 8 and 9 use cookies with the HTTPOnly and Secure attributes to reduce the risk of session theft through client-side scripting. The information saved in cookies includes:
- The user session ID, encrypted.
- Minimal state data for authentication, without sensitive information in plain text.
The duration of session cookies is configurable from the Back Office, allowing for differentiated timeouts to increase the security of more exposed users, such as administrators.
Setting cookie duration
Go to Advanced Parameters > Administration and set the maximum session duration. As a practical reference: do not exceed 3 hours for the Back Office and 24 hours for the Front Office. Shorter sessions reduce the exposure window in case of a shared device or improperly terminated access.
User session control and tracking
Monitoring active sessions and identifying abnormal access is essential for the security of any shop. PrestaShop 8 and 9 offer basic native tools, which can be integrated with specific modules for more granular control:
- Register User IP: accurately records IP addresses associated with carts, registrations, and orders, with integration of GeoLite2, dnslytics.com, and ipinfo.io to identify geographical anomalies and prevent fraud.
- Admin Login Monitor + 2FA: tracks every access to the Back Office, signals suspicious IP address changes, and activates the second factor request in case of anomaly.
Practical tips to improve login security
- Make passwords obligatorily complex: set a policy requiring at least 8 characters, a number, and a special symbol.
- Enable 2FA on the Back Office: adds a second layer of protection against unwanted access, making a compromised password unusable.
- Monitor IP addresses and suspicious activities with tools like Register User IP.
- Configure appropriate session timeouts: short sessions for the Back Office reduce the risk of identity theft in case of improperly closed access.
- Regularly update PrestaShop and installed modules: many vulnerabilities are corrected in update patches.
IP verification and whitelist
PrestaShop 8 and 9 allow defining whitelists of trusted IP addresses for Back Office access. In case of access from an unrecognized IP, it is possible to configure automatic notifications or request an additional second factor of authentication through Admin Login Monitor + 2FA.
Conclusions
Login management in PrestaShop 8 and 9 is structurally more secure compared to previous versions, with protected cookies, robust password hashing, and greater configurability of access policies. For those managing shops with multiple operators, B2B customers, or simply wanting more precise control over who accesses and when, the modules PrestaShop B2B Request, Register User IP, and Admin Login Monitor + 2FA natively complement the platform's functionalities.