Shopping Cart
There are no more items in your cart
Protect the Back Office with advanced monitoring, Activity Log, and 2FA authentication
Admin Login Monitor records every access attempt to the PrestaShop Back Office, tracks the activities of authenticated employees, monitors suspicious activities, and introduces a 2FA TOTP authentication system designed for agencies, multi-shop, and technical teams. Access control, IP blocking per employee, Basic Auth, multi-recipient IP change alerts, password expiration reminders, and a complete audit in a single professional module, without external services and recurring costs.
Main Features
Integrated 2FA TOTP for the Back Office
Implements two-factor authentication compatible with Google Authenticator, Authy, and any TOTP RFC 6238 app. Verification occurs on a dedicated page separate from the admin panel, preventing bypass or alternative navigation during validation.
Trusted IP Whitelist with Smart Bypass
Company or internal network IPs can be whitelisted to automatically bypass 2FA, IP change alerts, and employee-specific IP rules. Employees working from the office will not see additional requests, while access from external networks remains protected.
IP Blocking per Employee
Restricts each employee to one or more authorized IPs or CIDR ranges directly from the Employee Audit page. If the credentials are correct but the IP is not allowed, access is logged as blocked and denied: this check also applies to already authenticated sessions, verified at each request.
Basic Auth Protection
Adds an optional layer of Basic Auth to protect the admin directory, with htpasswd files generated in bcrypt hash and .htaccess rules to block direct access to the password file and sensitive dotfiles. Passwords from 12 to 128 characters with at least three character types.
Complete Login Tracking
Intercepts every access to the back office before PrestaShop processes it. For each attempt, it saves the IP address, User Agent, geographical location (GeoIP), and timestamp. Logs are kept for a configurable number of days and automatically deleted.
Back Office Activity Log
Optional and lightweight log of authenticated employee activities: pages visited, actions, Symfony controller or route, products/customers/orders involved. No payload, passwords, or form data are saved: only essential metadata for security auditing.
Multi-Recipient IP Change Alerts
Whenever an employee accesses from an IP different from the last recorded one, the module sends an alert email to multiple configurable recipients via a dedicated panel, as well as to the employee themselves. It also detects IP changes during an already authenticated session.
Shareable TOTP Secrets Across Multiple Shops
Designed for agencies and multi-shop managers: the same TOTP secret can be exported and imported between different installations, allowing the use of a single entry in the Authenticator app for multiple PrestaShop Back Offices.
Geolocation Without External Services
Utilizes the GeoLite2-City database already included in PrestaShop (/app/Resources/geoip/) to resolve city, region, and ISO country code for each registered IP. No third-party API, no additional costs.
Log Viewer with Color Coding
The Team → Login Monitor panel displays logs with visual highlighting: green for trusted IPs, red for failed logins on existing accounts, orange for non-existent emails or bot attempts, yellow for accesses from different countries, purple for accesses blocked by IP rules, white for normal accesses.
Advanced Employee Audit
The Team → Employee Audit panel adds advanced security information: hidden employees, last login, last IP, geographical location, IP blocking rules, password age, 2FA status, quick reset of TOTP secrets, and export/import tools for multi-shop environments.
Password Expiration Reminders
Displays a warning in the dashboard and module configuration when an employee's password exceeds the configured validity period (default 90 days, between 30 and 180). An optional email reminder sends the same advice after a successful login.
PrestaShop Security Checks
The configuration header indicates the status of recommended core settings: cookie IP verification, back office cookie duration not exceeding 24 hours, SameSite Cookie set to Lax, with a direct link to the Administration page of the back office.
Dashboard Widget
A compact widget in the dashboard shows real-time successful and failed logins in the last 24 hours and the latest unauthorized attempts, with a direct link to the complete monitoring panel.
A 2FA Approach Designed for Businesses and Agencies
Reducing Operational Friction
Many traditional 2FA systems are disabled because they slow down daily work. This module introduces a balanced system that protects remote access without penalizing those operating from the corporate network.
Ideal for Multi-Shop and Technical Support
The export/import functions of TOTP secrets, along with IP blocking per employee and Basic Auth, simplify the management of dozens or hundreds of PrestaShop installations, reducing the attack surface without burdening daily work.
How Detection Works
PrestaShop 8.x
The hook actionDispatcherBefore intercepts the request before AdminLoginController processes it. The module reads the POST payload, verifies the credentials via Employee::getByEmail(), and immediately logs the attempt.
PrestaShop 9.x
FormLoginAuthenticator handles the login before the standard hook. The module analyzes Symfony session keys to identify successful and failed logins, ensuring full compatibility with the modern architecture of PrestaShop 9, including recognition of modern pages for the Activity Log.
Passwords and credentials are never stored or saved in logs.
Requirements
| Component | Required Version |
|---|---|
| PrestaShop | 1.7.8, 8.2 or 9.x |
| PHP | 7.2+ |
| GeoLite2-City.mmdb | Optional — already included in PrestaShop in /app/Resources/geoip/ |
| .htaccess Support | Required only for optional Basic Auth (including LiteSpeed with .htaccess enabled) |
Installation
- Upload the tec_adminloginlog folder to
/modules/ - Go to Back Office → Modules → Module Manager and click Install
- The module automatically creates the tables ps_tec_admin_login_log, ps_tec_employee_2fa, and ps_tec_admin_activity_log
- The new sections Team → Login Monitor, Team → Employee Audit, and Team → Activity Log will be immediately available in the Back Office
- Configure 2FA, trusted IPs, alert recipients, and any Basic Auth or IP blocking rules per employee
Frequently Asked Questions
Do trusted IPs bypass all checks, including Basic Auth?
Trusted IPs bypass checks designed to react to accesses from untrusted networks: 2FA, IP change alerts, and employee-specific IP rules. Successful accesses are still logged, and password age reminders can still be shown or sent. Basic Auth, however, cannot be bypassed by trusted IPs because it is applied by the web server before PrestaShop and the module are executed.
