Staff and roles
The main Administrator can do everything. Other admins get only what their role allows. Roles come from the Roles plugin, included: without it, other admins can't open any page.
- Make a role
User Roles Roles: name it and tick what it can manage. Permissions that move money or reach site-wide settings carry a clear warning. Every installed plugin's areas appear in the list by themselves.
- Add the staff member
User Roles Staff: add their account and give it a role. You can edit or ban staff here and see when each last signed in.
Only the main Administrator ever sees the Roles and Staff pages, so nobody can raise their own permissions. A few things stay with the Administrator alone, such as buying add-ons and the cron key.
Log in as a customer
With the User Impersonation plugin, staff with its permission get a Log in as them button on a customer's panel under Orders & Customers Customers. Use it to see a problem exactly as the customer does.
- A short reason is required and kept in the admin log and the customer's history.
- No password is needed, and the customer's password is never seen or changed.
- Withdrawals, email, phone and password changes and account deletion stay blocked.
- A banner shows on every page, with a way back, and the session ends by itself after 60 minutes.
- The customer sees "Support viewed your account" in their notifications afterwards.
Fraud prevention
Security Fraud Prevention:
| Check | What it does |
|---|---|
| VPN and proxy detection | Block, monitor only, or block data-centre addresses. Looked up with proxycheck.io; an optional free key raises the daily lookups. |
| Auto-ban thresholds | For repeated VPN attempts, multiple accounts and suspicious country switching, each set on its own. |
| One device per account | Cuts down duplicate accounts. |
| Risk score | Low, Medium, High or Critical for each account. |
| Events log | Every event, with totals for VPN attempts, banned accounts and tracked devices. |
To ban a customer by hand, open their profile's Edit tab. A ban needs a reason, and a banned customer can't sign in or order.
Built-in protection
- Sign-in limits: 5 failed attempts in 15 minutes locks that account and IP out for a while, on the storefront and in the admin.
- Passwords are stored hashed, never as text. Admin sign-ins are recorded.
- Forms carry a security token, so another site can't submit them on your behalf.
- Uploads accept only JPEG, PNG, GIF and WebP up to 5 MB. Every image is redrawn, which strips anything hidden inside, and saved under a random name.
- Private files: the web server refuses requests for settings, database dumps and logs. Payment proofs and support-ticket images are shown only to their owner and the staff who need them.
- Browser scripts: Settings Security controls which scripts your visitors' browsers may run.
Logs and checks
Under Settings Security Logs:
| Page | Shows |
|---|---|
| Admin Logs | What each admin changed, when, and from which IP. |
| User Logs | Activity on customer accounts, and whether staff did it while logged in as them. |
| Cron Logs | Every scheduled run, failures first. |
| Upload Logs | Every image uploaded or refused, and why. |
| Server errors | The PHP error log. |
| Server check | Whether your server keeps the store's private files private and sends every page address to the store. It also runs by itself once a day. |
Orders & Customers Customers Data health finds and tidies broken customer emails, phones, names and countries. Every repair is logged and can be undone.
Customer data
From a customer's profile, Export this customer's data downloads one ZIP of everything the store holds about them, with no passwords or other secrets. To let customers download their own copy, switch it on in Settings Sign-up & compliance, where you also set how long logs are kept.
Security add-ons
Sold separately from the add-on store in your admin:
reCAPTCHA (v2 checkbox) stops bots on the sign-up and sign-in forms. Email codes sends a code by email at sign-up, and can also ask for one at every sign-in.
Something wrong or unclear on this page? Tell us at [email protected], or see how to get help.