One administrator
The main Administrator can do everything. BidKing Plus doesn't include staff roles: other admin accounts can't open any page until the Roles add-on gives each one a role. A few things stay with the Administrator alone even then, such as buying add-ons and the cron key.
Ban a customer
Open the customer's profile under Orders & Customers Customers and use its Edit tab. A ban needs a reason, and a banned customer can't sign in or order.
Built-in protection
- Sign-in limits: 5 failed attempts in 15 minutes locks that account and IP out for a while, on the storefront and in the admin.
- Passwords are stored hashed, never as text. Admin sign-ins are recorded.
- Forms carry a security token, so another site can't submit them on your behalf.
- Uploads accept only JPEG, PNG, GIF and WebP up to 5 MB. Every image is redrawn, which strips anything hidden inside, and saved under a random name.
- Private files: the web server refuses requests for settings, database dumps and logs. Payment proofs and support-ticket images are shown only to their owner and the staff who need them.
- Browser scripts: Settings Security controls which scripts your visitors' browsers may run.
Logs and checks
Under Settings Security Logs:
| Page | Shows |
|---|---|
| Admin Logs | What each admin changed, when, and from which IP. |
| User Logs | Activity on customer accounts. |
| Cron Logs | Every scheduled run, failures first. |
| Upload Logs | Every image uploaded or refused, and why. |
| Server errors | The PHP error log. |
| Server check | Whether your server keeps the store's private files private and sends every page address to the store. It also runs by itself once a day. |
Orders & Customers Customers Data health finds and tidies broken customer emails, phones, names and countries. Every repair is logged and can be undone.
Customer data
From a customer's profile, Export this customer's data downloads one ZIP of everything the store holds about them, with no passwords or other secrets. To let customers download their own copy, switch it on in Settings Sign-up & compliance, where you also set how long logs are kept.
Security add-ons
Sold separately from the add-on store in your admin:
| Add-on | What it does |
|---|---|
| Roles | Staff accounts with only the pages their role allows. |
| User Impersonation | A Log in as them button for staff, with a required reason, blocked account changes and a 60-minute limit. |
| Fraud Prevention | VPN and proxy detection, auto-ban thresholds, one device per account and a risk score per account. |
| reCAPTCHA | Google's v2 checkbox on the sign-up and sign-in forms. |
| Email codes | A code by email at sign-up, and optionally at every sign-in. |
| Identity checks | Decide who must verify identity, age or address before selling or claiming a prize. |
Roles, User Impersonation and Fraud Prevention come with BidKing Pro.
Something wrong or unclear on this page? Tell us at [email protected], or see how to get help.