2FA backoffice authentication module

Module 2FA Prestashop : protection of accounts employed by OTP

The 2FA Prestashop module adds a security layer essential to your backoffice access by requiring two-factor authentication with each connection. After validation of the login and password, the employee must enter a 6-digit OTP (One Time Password) code, delivered via one of the three configurable channels: e-mail, SMS Brevo or SMS Twilio.

This protection of Prestashop employee accounts neutralizes the most common attack vectors: credential stuffing, phishing, automated brute force, or unrevoked access after the departure of an employee. Even if a password is compromised, access remains blocked without the second factor.

The three OTP methods available

SMS methods are optional. The module works perfectly with the only E-mail OTP method, without any third-party subscriptions. The Brevo and Twilio integrations only activate if you enter your API keys in the module configuration, and you have entered a phone number in the profile used.

SMS security offers stronger security in the event that your email would also be compromised.

Main features

• Activity log: time stamping of all successful connections and failed attempts
  
• Anti-brute force blocking after N invalid code attempts (configurable)
  
• Configurable expiration of OTP codes (from 1 to 60 minutes)
  
• Multi-shop compatible Prestashop
• Responsive code input responsivei nterface (mobile)
• Adds a mobile number field to the profile used
• Customizable SMS Sender with your shop name (Brevo & Twilio)

Module strengths: no template to edit, no override, no additional JavaScript code. Install the module through the Prestashop Module Manager, fill in your settings in the configuration and the 2FA is operational. The code request message is customizable via the backoffice translation module.

GDPR compliance and ANSSI recommendations

Multi-factor authentication is explicitly recommended by the ANSSI (National Agency for the Security of Information Systems) and the CNIL for access to administration interfaces processing personal data. By using this 2FA module, you apply a security measure recognized as a state of the art, and an essential piece of evidence in the event of an audit or control following an incident.

-- Update --
v1.1.0 - PS 9 Support
v1.0.0 - Initial version