Security

Passwords

• Minimum User Password Strength (General Settings > Security) is enforced wherever a password is set: registration, account changes, resets and staff accounts.
• Passwords are stored hashed. Gateway keys, SMTP passwords and similar secrets are stored encrypted with the APP_KEY from .env. Back up .env. Without the same APP_KEY, encrypted values cannot be read after a restore.

Forgot password

Clients and staff can reset their password by email. Links last 2 hours and work once.

Failed-login protection

After repeated failed sign-ins the IP is banned for Failed Login Ban Time (minutes). Add trusted addresses to Whitelisted IPs so you never lock yourself out. The sign-in forms are also rate limited.

Two-factor authentication

Install the Google Authenticator 2FA plugin. Clients and staff can then protect their account with a code from Google Authenticator, Authy or any TOTP app. You can require it for clients.

Email code sign-in

Switch on Email OTP Login in General Settings > Security. Each person then enables it for themselves. The code has 6 digits, lasts 10 minutes and locks after 5 wrong tries.

Client signup

Switch on Client Signup in General Settings > Security > Login to let visitors open an account at /client/register without placing an order. It uses the same fields as checkout, starts on the visitor's own country and adds a Sign up link to the client sign-in page and the storefront header. It is off by default, and checkout creates accounts either way.

CAPTCHA

Install reCAPTCHA, hCaptcha or Cloudflare Turnstile, add the keys under Settings > General Settings > Security, and it protects checkout, ticket forms and the client sign-in and reset pages. It is never applied to the admin sign-in. See Cloudflare Turnstile.

Fraud screening

Install IPQualityScore or MaxMind minFraud and enable it under Settings > Fraud Protection to score orders. See Security tools.

Session protection

By default a session ends when its IP address changes. You can switch this off in the Security tab if your clients use mobile networks that change address often.

Change the admin path

Move the admin sign-in away from /admin. See Changing the admin path.

Server hardening checklist

• Serve the site over HTTPS only.
• Keep the document root on the public folder.
• Keep APP_DEBUG=false and APP_ENV=production in .env.
• Keep PHP updated and use PHP 8.3 or newer.
• Make .env readable only by the site user.
• Back up the database and .env regularly (see Backups).
• Remove unused staff accounts and unused plugins.