Fraud prevention
Included. Security Fraud Prevention:
| Check | What it does |
|---|---|
| VPN and proxy detection | Block, monitor only, or block data-centre addresses. Looked up with proxycheck.io; an optional free key raises the daily lookups. |
| Auto-ban thresholds | For repeated VPN attempts, multiple accounts and suspicious country switching, each set on its own. |
| One device per account | Cuts down duplicate accounts. |
| Risk score | Low, Medium, High or Critical for each account. |
| Events log | Every event, with totals for VPN attempts, banned accounts and tracked devices. |
To ban a customer by hand, open their profile's Edit tab. A ban needs a reason, and a banned customer can't sign in or order.
Staff and roles
The main Administrator can do everything. Roles for other staff come from the Roles add-on, which RaffKing Standard doesn't include: without it, admins other than the main Administrator can't open any page.
With Roles, you make a role, tick what it can manage, and give it to each staff account. Only the main Administrator sees the Roles and Staff pages, so nobody can raise their own permissions. A few things stay with the Administrator alone, such as buying add-ons and the cron key.
The User Impersonation add-on gives support staff a Log in as them button, to see a problem exactly as the customer does, with a required reason, a banner on every page and a 60-minute limit.
Built-in protection
- Sign-in limits: 5 failed attempts in 15 minutes locks that account and IP out for a while, on the storefront and in the admin.
- Passwords are stored hashed, never as text. Admin sign-ins are recorded.
- Forms carry a security token, so another site can't submit them on your behalf.
- Uploads accept only JPEG, PNG, GIF and WebP up to 5 MB. Every image is redrawn, which strips anything hidden inside, and saved under a random name.
- Private files: the web server refuses requests for settings, database dumps and logs. Payment proofs and support-ticket images are shown only to their owner and the staff who need them.
- Browser scripts: Settings Security controls which scripts your visitors' browsers may run.
Logs and checks
Under Settings Security Logs:
| Page | Shows |
|---|---|
| Admin Logs | What each admin changed, when, and from which IP. |
| User Logs | Activity on customer accounts. |
| Cron Logs | Every scheduled run, failures first. |
| Upload Logs | Every image uploaded or refused, and why. |
| Server errors | The PHP error log. |
| Server check | Whether your server keeps the store's private files private and sends every page address to the store. It also runs by itself once a day. |
Orders & Customers Customers Data health finds and tidies broken customer emails, phones, names and countries. Every repair is logged and can be undone.
Customer data
From a customer's profile, Export this customer's data downloads one ZIP of everything the store holds about them, with no passwords or other secrets. To let customers download their own copy, switch it on in Settings Sign-up & compliance, where you also set how long logs are kept.
Security add-ons
Sold separately from the add-on store in your admin:
reCAPTCHA (v2 checkbox) stops bots on the sign-up and sign-in forms. Email codes sends a code by email at sign-up, and can also ask for one at every sign-in. Identity checks (KYC) decide who must verify their identity, age or address, for example before claiming a prize.
Something wrong or unclear on this page? Tell us at [email protected], or see how to get help.