{"id":39,"date":"2026-07-29T12:36:55","date_gmt":"2026-07-29T10:36:55","guid":{"rendered":"https:\/\/go-onagency.es\/modulos\/prestaward-authenticator\/"},"modified":"2026-10-16T19:06:31","modified_gmt":"2026-10-16T17:06:31","slug":"prestaward-authenticator","status":"publish","type":"page","link":"https:\/\/go-onagency.es\/en\/modulos\/prestaward-authenticator\/","title":{"rendered":"PrestaWard Authenticator"},"content":{"rendered":"<section class=\"section product-hero product-hero--prestaward\">\n<div class=\"container product-hero__inner\">\n<div class=\"product-hero__copy\">\n<p class=\"eyebrow\">PrestaShop module<\/p>\n<h1>PrestaWard Authenticator<\/h1>\n<p><strong>Real MFA for the Back Office.<\/strong> Protects admin accounts with TOTP, profile- and shop-specific policies, secure recovery and verifiable logs.<\/p>\n<p><strong>Exclusive distribution on the PrestaShop Marketplace (Addons).<\/strong><\/p>\n<div class=\"product-hero__actions\">\n        <a class=\"button button--ghost\" href=\"https:\/\/go-onagency.es\/prestaward-authenticator\/changelog\/en\/\">Changelog<\/a><br \/>\n        <a class=\"button button--ghost\" href=\"https:\/\/go-onagency.es\/prestaward-authenticator\/prestaward-authenticator-user-guide.pdf\" target=\"_blank\" rel=\"noopener\">PDF guide<\/a><br \/>\n        <a class=\"button button--ghost\" href=\"\/ayuda\/prestaward-authenticator\/\">Help Guide<\/a>\n      <\/div>\n<div id=\"authenticator-gallery\" style=\"margin-top:20px\">\n<p style=\"margin:0 0 8px;font-size:13px;font-weight:600;color:#b6bcc7\">Screenshots<\/p>\n<div style=\"display:flex;flex-wrap:wrap;gap:12px\"><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-01-empleados.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-01-empleados-thumb.png\" alt=\"PrestaWard Authenticator 0.0.16: deployment by employees and two-factor authentication reset\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Deployment by employees<\/span><\/a><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-02-politica.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-02-politica-thumb.png\" alt=\"PrestaWard Authenticator 0.0.16: MFA policy and grace period by employee profile\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Policy by profile<\/span><\/a><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-03-actividad.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-03-actividad-thumb.png\" alt=\"PrestaWard Authenticator 0.0.16: recent activity and login statistics\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Activity and statistics<\/span><\/a><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-04-configuracion.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-gallery\/v0016-es-04-configuracion-thumb.png\" alt=\"PrestaWard Authenticator 0.0.16: MFA mode, trusted devices and recovery methods\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Security stance<\/span><\/a><\/div>\n<p style=\"margin:7px 0 0;font-size:11px;color:#b6bcc7\">Spanish interface \u00b7 version 0.0.16<\/p>\n<\/div><\/div>\n<div class=\"product-hero__card\">\n      <img decoding=\"async\" src=\"https:\/\/go-onagency.es\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-authenticator-logo.svg\" alt=\"PrestaWard Authenticator\"><br \/>\n      <span>TOTP + policies + recovery + audit<\/span><\/p>\n<ul class=\"product-hero__checks\">\n<li>Standalone MFA with no remote dependency<\/li>\n<li>Encrypted TOTP secrets<\/li>\n<li>PrestaShop 1.7, 8 and 9<\/li>\n<li>Multi-version laboratory<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section class=\"section product-page-main product-page-main--prestaward\">\n<div class=\"container product-page-layout\">\n<article class=\"product-page-content product-page-content--editable\">\n<h2>What it does<\/h2>\n<p>A stolen password should not be enough to gain access to the Back Office. The module adds a second factor without sending the secret to third-party APIs.<\/p>\n<h2>How it works<\/h2>\n<ul>\n<li>The second factor consists of one-off codes (TOTP) generated by an authentication app on a mobile phone. If you enable this for a profile, employees with that profile can instead use eight-digit codes sent by post; this is a weaker method because anyone who can access the postbox can log in; the dashboard and the employee\u2019s page warn of this. It is disabled by default. Support for passkeys is included but disabled by default in this version.<\/li>\n<li>Each employee sets up their own two-factor authentication via \u2018My authentication\u2019, using a QR code generated within the shop itself. The initial set-up is guided: scan the QR code, enter the code, and a final page displaying the recovery codes appears. The button to proceed to the Back Office is only activated once the employee has downloaded, copied or printed these codes.<\/li>\n<li>It is installed in Disabled mode. In Audit only mode, it logs access attempts without blocking anyone, and in Force mode, it requires two-factor authentication. An employee who has not yet configured it must enter their password and can only access \u2018My authentication\u2019 until the configuration is complete.<\/li>\n<li>The policy is defined for the entire shop and can be adjusted by profile and per shop. In multi-shop set-ups, the strictest policy applies.<\/li>\n<li>Before enforcing this, you can grant a profile a grace period of 3 to 14 days. Employees who have not yet registered can log in as normal; on every page of the Back Office, they will see a notice stating the date from which two-step authentication will become mandatory, and the dashboard shows how many are still to register. Once the deadline has passed, \u2018Enforce\u2019 is applied as usual.<\/li>\n<li>Trusted devices (30 days by default) prevent the system from requesting the code every time a known device accesses the system. Each employee can revoke them individually.<\/li>\n<li>Password and code attempts are limited (by default, 5 code attempts every 5 minutes and a 15-minute lockout). A TOTP code cannot be reused. If PrestaWard Captcha protects access to the Back Office and rejects the request, the failure counts only towards the IP limit and not towards the lockout of the attacked administrator\u2019s account: a bot without a token can no longer lock out an account with just a few requests.<\/li>\n<li>From time to time, the MFA policy is renewed with a signature from the PrestaWard Integrity service. Only technical installation data is sent to Integrity; TOTP secrets, recovery codes and employee data are never sent.<\/li>\n<\/ul>\n<h2>If an employee loses their mobile phone<\/h2>\n<ul>\n<li>Personal recovery codes: by default, each employee receives 10 single-use codes when setting up their two-factor authentication and must keep them separate from the shop.<\/li>\n<li>Optional recovery via email: during the second step, the employee can request a code by email. This feature is disabled by default and must be enabled by a super-administrator.<\/li>\n<li>Reset via the MFA administration panel, without console access: a super-administrator can reset another employee\u2019s second factor. It prompts for the password; it cannot be used on oneself and deletes the employee\u2019s authenticator, recovery codes, trusted devices and open sessions, requiring the employee to log in again on their next access. Other profiles with edit access to the MFA administration console can only reset employees with lower-privileged profiles, and only a super-administrator can reset another super-administrator. Every reset, and every rejected attempt, is logged in the access log.<\/li>\n<li>Emergency console access, as a last resort: requires access to the server and the single-use emergency key generated in the MFA administration panel. It allows you to reset an employee\u2019s authentication factors or suspend the MFA requirement for one hour if no one can log in. This is logged, and the key cannot be reused.<\/li>\n<\/ul>\n<h2>Requirements<\/h2>\n<ul>\n<li>PrestaShop 1.7, 8 or 9 and the version of PHP required by your version of PrestaShop (PHP 7.1 or later for PrestaShop 1.7).<\/li>\n<li>A TOTP authentication app on every employee\u2019s mobile phone, except for profiles where you allow a code sent by email as a second factor.<\/li>\n<li>For email recovery, email codes and alerts, the shops must be able to send emails.<\/li>\n<li>For access keys (disabled by default), an HTTPS address in the Back Office.<\/li>\n<li>Global policy, employee inventory, email and logs are only available to super-administrators. All other employees manage only their own factors.<\/li>\n<li>Control panel and messages in nine languages.<\/li>\n<\/ul>\n<h2>Known limitations<\/h2>\n<ul>\n<li>The PrestaShop core file manager (<code>filemanager<\/code> folder in the admin panel) does not run modules, so it cannot enforce two-factor authentication. Where MFA is mandatory, remove this access for profiles that do not require it, or block it at the web server level.<\/li>\n<li>The Protection of the Symfony pages in the Back Office requires PrestaShop 1.7.7 or later. In earlier versions, only the classic pages are protected.<\/li>\n<li>The PrestaShop web service and Admin API use their own keys and are outside the scope of the module.<\/li>\n<\/ul>\n<h2>What it does not do<\/h2>\n<ul>\n<li>It does not protect your customers\u2019 access to the shop: only the Back Office.<\/li>\n<li>It does not send TOTP secrets, recovery codes or employee data to external services.<\/li>\n<li>The footer of the module\u2019s emails does not contain any links, contact details or images hosted outside your shop: the GO ON Agency logo is a file from the module itself that is served from your shop.<\/li>\n<\/ul>\n<h2>Compatibility verified<\/h2>\n<p>Version 0.0.16 passed laboratory testing on PrestaShop 1.7, 8 and 9 on 15 October 2026, both on a clean installation and when updating from version 0.0.15. Version 0.0.15 passed laboratory tests on PrestaShop 1.7, 8 and 9 on 13 October 2026: on a clean installation and following an upgrade from version 0.0.14 and from version 0.0.6, with the configuration, TOTP secrets and trusted devices retained, and no blocking errors in the logs. Version 0.0.13 was verified on PrestaShop 1.7.8.11 with PHP 7.4, PrestaShop 8.2.7 with PHP 8.1 and PrestaShop 9.1.4 with PHP 8.5.<\/p>\n<h2>Key features<\/h2>\n<ul>\n<li>TOTP enrolment with current password and locally generated QR code.<\/li>\n<li>Secrets encrypted with AES-256-GCM and single-use HMAC recovery codes.<\/li>\n<li>Prevention of TOTP replay attacks through atomic counter increment.<\/li>\n<li>Protection against brute-force password attacks and MFA based on IP and identity, with configurable limits and locks.<\/li>\n<li>IPv4, IPv6, CIDR, trusted proxies and network lists, without allowing a secure list to bypass MFA.<\/li>\n<li>Trusted devices with 256-bit tokens, hashing, expiry and revocation.<\/li>\n<li>Employee self-service separate from global administration.<\/li>\n<li>MFA policies by profile and shop, with multi-shop resolution by the strictest requirement.<\/li>\n<li>Configurable session and device invalidation following a password change.<\/li>\n<li>Access recovery via personal codes, an optional code sent by email and, as a last resort, emergency console access using a one-off key.<\/li>\n<li>Optional code sent by email during an MFA challenge, with an expiry date, HMAC and sending limits.<\/li>\n<li>Grace period per profile before enforcing two-factor authentication, with a notification in the Back Office and monitoring of employees who have yet to comply.<\/li>\n<li>Resetting an employee\u2019s second factor via the MFA administration panel, using the administrator\u2019s password and logging each attempt.<\/li>\n<li>Recent activity in the dashboard: a summary in simple sentences of the last 30 days\u2019 access log (logins from a new IP address or browser, repeated failed attempts, blocks, recovery codes used and resets). Use only your own log, without geolocation or external services, and do not display full addresses: email addresses are masked and IP addresses retain only their \/24 network (IPv4) or their first three groups (IPv6). The access log with an integrity string retains the exact values.<\/li>\n<li>Guided registration for the first factor, with a final page displaying recovery codes that requires users to download, copy or print them before continuing.<\/li>\n<li>Codes sent by email as an optional second factor, only for profiles you authorise: eight digits, stored solely as a keyed hash, valid for five minutes, single-use and with a sending limit. Employees confirm their email address once. \u2018Recovery only\u2019 works as before.<\/li>\n<li>My authentication at a glance: a status bar, a card for each method with a single collapsible action, recovery codes, trusted devices and, at the end, a collapsible \u2018danger zone\u2019. Removing MFA explains what is removed whilst retaining the password, a current code and explicit confirmation, and applies only to the employee who is logged in.<\/li>\n<li>Statistics for the last 30 days with daily trends (logins, verified two-factor authentications, password and two-factor authentication failures, lockouts, recovery attempts used and new trusted devices), registration coverage by profile and methods in use. It only displays counts from your own login log: it does not show IP addresses or email addresses.<\/li>\n<li>A bot that fails to pass the PrestaWard Captcha can no longer block an administrator\u2019s account: this failure only counts towards the IP limit.<\/li>\n<li>Synchronisation with Integrity upon opening the dashboard, via a background request that does not slow down the page.<\/li>\n<li>A panel with five tabs (Overview, Employees and Registration, Policy, Statistics and Activity Log, and Settings) plus a Support tab, always the last one: the Overview tab displays the mode, registration coverage, errors and crashes from the last 24 hours and, at most, one alert line; each tab contains only its own settings.<\/li>\n<li>HMAC-chained logs, with retention, signed export, filters and pagination.<\/li>\n<li>Equivalent email alerts in PrestaShop 1.7, 8 and 9, with your shop\u2019s logo in the header and, in the footer, the GO ON Agency logo with the signature \u2018PrestaWard by GO ON Agency\u2019.<\/li>\n<li>Standard filter bar in the access log: the selectors are arranged in a grid of equal width, the search box and the \u2018Filter\u2019 button are in the same row, and the secondary actions are aligned to the right.<\/li>\n<li>Unified design of the dashboard across the four PrestaWard modules: section headers, form cards with neutral borders and standard collapsible blocks, statistics displayed on a single line, and a larger GO ON Agency logo in the header. The main button is now a solid brand colour, without a gradient.<\/li>\n<li>Minimum quarantine period with no browsing until MFA is completed.<\/li>\n<li>Installation registration and MFA policy signed using Integrity, without transmitting TOTP secrets, recovery codes or employee data. On the module screen, the \u2018Synchronise\u2019 button updates the connection.<\/li>\n<li>GO ON Agency support panel with a downloadable diagnostic report. It is downloaded by an employee with editing permissions, having selected a shop. It contains only versions, statuses and counters; it does not include paths or credentials and is not sent automatically.<\/li>\n<\/ul>\n<h2>Secure use<\/h2>\n<p>The initial mode is <strong>Disabled<\/strong>. Each employee sets up their account from <strong>My authentication<\/strong>; the administrator reviews the rollout, goes through <strong>Audit only<\/strong> and enables <strong>Force<\/strong> once recovery has been verified.<\/p>\n<h2 id=\"registro-de-cambios\">Changelog<\/h2>\n<h3>0.0.16<\/h3>\n<ul>\n<li>The dashboard is organised into tabs: Summary (mode, registration coverage, errors and crashes over the last 24 hours, and a maximum of one alert line), Employees and Registration, Policy, Statistics and Activity Log, and Settings. The support panel has its own tab, Support, which is always the last one; the Integrity status appears below all the tabs and the header displays the GO ON Agency logo. Each tab saves only its own settings.<\/li>\n<li>This corrects the issue whereby a request that fails PrestaWard Captcha would count towards the block limit for the targeted administrator account. Previously, requests without a Captcha token counted as password failures, and a bot could block an account with just a few requests. When PrestaWard Captcha protects access to the Back Office and rejects a request, the failure counts only towards the IP limit. Without PrestaWard Captcha (or in Observation mode), nothing changes.<\/li>\n<li>New: one-time codes via email as an optional second factor. In the email settings, select \u2018Second factor (weaker)\u2019 and then enable this for each employee profile. Employees with these profiles confirm their email address once, using a code sent by post, and can then log in using codes sent by post: eight digits, stored only as a keyed hash, valid for five minutes, single-use and with a limit on the number of codes sent, just like the current recovery codes. The settings and the employee portal warn that these are weaker than an authentication app: anyone who can read the mailbox can gain access. \u2018Recovery only\u2019 works exactly as before.<\/li>\n<li>New: guided registration for the first factor. When an employee needs to register (or is in the grace period), \u2018My authentication\u2019 guides them through the process: scan the QR code, enter the code, and a final success page displaying the recovery codes (download, copy or print). The \u2018Continue to the Back Office\u2019 button only works after the codes have been downloaded, copied or printed. Access keys and codes sent by post, if enabled for the employee, are provided under \u2018Other ways to secure your account\u2019.<\/li>\n<li>My authentication is now a straightforward summary: a status bar (status, methods, recovery codes and trusted devices), a compact card for each method (authentication app, access keys and codes by post) with a single collapsible action, a recovery codes card, collapsed trusted devices and, finally, a collapsed \u2018danger zone\u2019. Removing MFA now explains what is removed and what happens next, whilst retaining a red button, the password, a current code and an explicit confirmation. It continues to apply only to the employee who has logged in and is recorded in the access log with an integrity chain.<\/li>\n<li>Privacy: \u2018Recent Activity\u2019 no longer displays full addresses. Email addresses appear as j***@d***.com and IP addresses retain only their \/24 network (IPv4) or their first three groups (IPv6), just like Statistics. The access log with an integrity string retains the exact values and remains the authoritative source.<\/li>\n<li>New: Statistics. A new section displays data for the last 30 days as brief daily trends (logins, verified two-factor authentications, password failures, two-factor authentication failures, lockouts, recovery attempts used and new trusted devices), along with registration coverage for employees who need to register (by profile) and the methods in use. It only reads counts from your own access log and does not display IP addresses or email addresses.<\/li>\n<li>Passkeys (Touch ID, Face ID, Windows Hello and security keys) as a second factor: the code is included, but they are disabled by default and require an HTTPS address in the Back Office. An administrator enables them in the settings, and each employee adds them in \u2018My authentication\u2019 by entering their password and current code.<\/li>\n<li>Fixes an issue where the connection to Integrity would degrade in the Back Office for \u2018all shops\u2019: the installation\u2019s identity was only saved for the first shop; the background synchronisation read it as empty, resulting in an \u2018Invalid RSA public key\u2019 error, and the connected shop\u2019s status changed to \u2018pending registration\u2019. The identity is now read as a single unit from the global scope (or from the shop that stores it) in any context; the update passes an identity stored in a shop to the global scope without regenerating it; and, if it cannot be read, the Integrity status is left as it was and the last error is logged as a local error.<\/li>\n<li>Fixes an issue where the console installation (prestashop:module install) would create the PWA_* settings only for the first shop, whilst the \u2018All Shops\u2019 section of the Back Office reads the global settings. The installation now creates the global settings, and the update copies any missing ones from the first shop without overwriting any existing values.<\/li>\n<li>New: shared filter bar in the access log. The selectors are arranged in a grid of equal width; the search box and the \u2018Filter\u2019 button are in the same row; and the secondary actions are aligned to the right.<\/li>\n<li>Emails sent by the module display your shop\u2019s logo in the header (with the shop name as the alt text) and a standard footer featuring the GO ON Agency logo and the signature \u2018PrestaWard by GO ON Agency\u2019, without any links or contact details. The footer logo is a file from the module itself, served from your shop.<\/li>\n<li>Unified design of the dashboard across the four PrestaWard modules: section headers, form cards with neutral borders and standard collapsible blocks, statistics displayed on a single line, and a larger GO ON Agency logo in the header. The main button is now a solid brand colour, without a gradient.<\/li>\n<li>Fixes an issue where, in PrestaShop 9, the admin theme displayed tabs with underlines as links and section titles in capital letters. The common styles override this only within the PrestaWard panel, so PrestaShop 1.7 and 8 look the same as before.<\/li>\n<li>Fixes an issue where, in PrestaShop 1.7, the module\u2019s stylesheet was ignored when registered with the version number in the URL. The file is now checked and registered without parameters, so that the new styling appears in versions 1.7, 8 and 9.<\/li>\n<li>Fixes an issue where, in PrestaShop 9, resetting another employee\u2019s second factor and synchronising with Integrity would check the security token using a method that PrestaShop 9 does not use, which could result in the token being rejected. It is now validated using the PrestaShop 9 service; in PrestaShop 1.7 and 8, the verification remains the same.<\/li>\n<li>When the connection to Integrity cannot be updated at that moment, the panel displays a single message: the saved connection remains valid and will be retried automatically. The labels on all tabs have been translated into all nine languages.<\/li>\n<li>The update creates any missing global settings, runs the schema step (profile column for email codes and access key tables) and keeps email codes and access keys disabled until an administrator enables them. Nothing changes in an existing installation until an administrator enables an option.<\/li>\n<\/ul>\n<h3>0.0.15<\/h3>\n<ul>\n<li>New: reset an employee\u2019s second factor from the MFA administration panel. If an employee loses their mobile phone and recovery codes, the administrator no longer needs console access. The reset deletes the employee\u2019s authenticator and recovery codes, closes their trusted devices and open sessions, and the employee must log in again on their next attempt. It requires the administrator\u2019s password; it cannot be used on oneself, and a super-administrator can only be reset by another super-administrator. Every reset, and every rejected attempt, is logged in the access log, and you can notify the employee by email.<\/li>\n<li>New: grace period before enforcement. In the profile policies, you can set a period of 3 to 14 days before \u2018Enforce\u2019 blocks employees who have not yet registered. They log in as normal and see a notice on every page of the Back Office stating the date from which two-step authentication will become mandatory; those who have already registered continue to request their code. The dashboard shows the deadline for each profile and how many employees have yet to register. Profiles without a grace period behave as in previous versions.<\/li>\n<li>New: \u2018Recent Activity\u2019 in the dashboard summarises the last 30 days of the access log in simple sentences: logins from an IP address or browser that the employee had not used before, repeated failed login attempts, account locks, recovery codes used and administrator resets. Use only your own log data, without geolocation or external services.<\/li>\n<li>Using a personal or email recovery code is now recorded in the access log as \u2018Recovery code used\u2019.<\/li>\n<li>The update adds two columns to the profile policies (with no grace period by default) and registers the hook that displays the grace period notification.<\/li>\n<li>The support and diagnostics panel is positioned just before the Integrity section, as in all other PrestaWard modules, and in the \u2018all shops\u2019 context it no longer disappears: it indicates that a shop must be selected.<\/li>\n<li>The style sheets are loaded with the module version, so the new look appears after updating without clearing the browser cache.<\/li>\n<li>Synchronise with Integrity every time you open the dashboard, using a background request that never slows down the page, and no more than once per minute per shop.<\/li>\n<\/ul>\n<h3>0.0.14<\/h3>\n<ul>\n<li>Recommended security update: strengthens two-factor authentication in the Back Office, so that protected pages and actions are only accessible once this has been completed.<\/li>\n<li>Extends MFA verification to PrestaShop Back Office routes in versions 1.7.7 to 9 that do not use the classic template, such as exports and AJAX requests.<\/li>\n<li>It limits the number of attempts for all code checks in \u2018My authentication\u2019, including those made by employees from different IP addresses, and requires a verified session for sensitive account changes.<\/li>\n<li>Fixes a redirect loop in PrestaShop 9 when opening \u2018My authentication\u2019 whilst the second factor is pending.<\/li>\n<li>Employees with profiles created after installation can now access \u2018My authentication\u2019.<\/li>\n<li>Fixes the installation and Integrity retry process in PHP 7.1 and 7.2.<\/li>\n<li>Renews the signed MFA policy before it expires and displays a warning in the dashboard if it has expired.<\/li>\n<li>Adds a one-off emergency console access option to temporarily suspend the MFA requirement if no one can log in. This is a last resort: it requires access to the server and the emergency key; the suspension lasts for one hour and is logged. Employees can still regain access using their personal codes or via the optional email recovery option.<\/li>\n<li>Translates all access log events into the nine languages.<\/li>\n<\/ul>\n<h3>0.0.13<\/h3>\n<ul>\n<li>Fixes the Back Office container build in legacy versions without <code>request_stack<\/code>.<\/li>\n<li>Retains MFA and attempt limits in PrestaShop 9; if the required context is missing, denies access.<\/li>\n<li>Adds a limited manual diagnostic report: download it and attach it to your support request, along with the issue and the steps to reproduce it. It does not send data automatically.<\/li>\n<li>Full interface in nine languages, with translated text and help messages.<\/li>\n<\/ul>\n<h3>0.0.12<\/h3>\n<ul>\n<li>Fixes the registration test controller in PrestaShop 9 and displays the actual cause when Integrity fails.<\/li>\n<li>Updates the standard Back Office design and removes the built-in update checker from the Addons edition.<\/li>\n<\/ul>\n<h3>0.0.11<\/h3>\n<ul>\n<li>Security patch: stops automatic re-registration attempts when the shop\u2019s registration key changes and displays a clear warning in the Back Office.<\/li>\n<\/ul>\n<h3>0.0.10<\/h3>\n<ul>\n<li>Automatic heartbeat without cron, using a non-blocking local probe and authenticated server-to-server communication via the Integrity API.<\/li>\n<li>Per-shop sealed credentials, signed MFA policy and last valid state, with no remote calls during login.<\/li>\n<li>Atomic lock, six-hour interval and wait time following failures to prevent duplicates.<\/li>\n<li>Lifecycle and update validated on PrestaShop 1.7, 8 and 9.<\/li>\n<\/ul>\n<h3>0.0.9<\/h3>\n<ul>\n<li>Secure connection to Integrity per shop, sealed credentials and synchronisation from the Back Office.<\/li>\n<li>The signed remote policy can only reinforce the local MFA policy and never interferes with the login process.<\/li>\n<li>Settings reorganised into four tabs: MFA and notifications, Employee profile policies, Attempts and blocks, and Network and IP.<\/li>\n<li>Policies by profile and shop have been moved to a separate section to distinguish them from the global policy.<\/li>\n<li>The redundant update source has been removed from the settings: the official channel is now set by the module.<\/li>\n<li>Each configuration field includes a link to its explanation in the help guide.<\/li>\n<\/ul>\n<h3>0.0.8<\/h3>\n<ul>\n<li>Security timeframe per employee for invalidating previous sessions, challenges and devices.<\/li>\n<li>Configurable invalidation following any password change, only after password recovery or an administrative change, or never.<\/li>\n<li>\u2018Inherit\u2019, \u2018Required\u2019, \u2018Optional\u2019 and Disabled policies by profile and shop.<\/li>\n<li>Super-administrators are always required in Force mode, and multi-shop resolution follows the strictest policy.<\/li>\n<li>Single-use emergency key and recovery exclusively via the console, with no permanent web bypass.<\/li>\n<li>Optional email recovery during an MFA challenge, with an eight-digit code, HMAC, a five-minute expiry time and a limit on the number of attempts.<\/li>\n<li>HMAC-chained logs, integrity diagnostics, retention periods of 30 to 730 days and signed JSON export.<\/li>\n<li>Idempotent migration 0.0.8 and validated update from 0.0.7 on PrestaShop 1.7, 8 and 9.<\/li>\n<\/ul>\n<h3>0.0.7<\/h3>\n<ul>\n<li>\u2018Security posture\u2019 divided into \u2018MFA and alerts\u2019, \u2018Attempts and blocks\u2019 and \u2018Network and IP\u2019, with atomic saving.<\/li>\n<li>Keyboard-accessible tab navigation, selection persistence and automatic opening of the validation errors panel.<\/li>\n<li>Actual pagination of database records with 25, 50 or 100 rows per page.<\/li>\n<li>Filters for records by date range, employee or email, event, result and IP.<\/li>\n<li>Redesigned \u2018My authentication\u2019 header with improved contrast, hierarchy, mobile responsiveness and corporate access options.<\/li>\n<li>The email test checks the transport and recipients without requiring operational alerts to be active.<\/li>\n<li>Visible diagnostics of PrestaShop\u2019s mail transport, distinguishing between capture servers and actual SMTP servers.<\/li>\n<li>Error diagnostics compatible with the <code>SwiftMessage<\/code> and <code>MailerMessage<\/code> logs in PrestaShop versions 1.7, 8 and 9.<\/li>\n<li>Removed the duplicate shop prefix from subject lines and strengthened the alternative link to the Back Office.<\/li>\n<li>Corporate email sending validated via Exchange Online across all three supported versions.<\/li>\n<li>Updates panel aligned with Snapshot using PrestaWard Update Manifest v1, status, severity and SHA-256.<\/li>\n<li>Idempotent migration 0.0.7 and validated update from 0.0.6 on PrestaShop 1.7, 8 and 9.<\/li>\n<\/ul>\n<h3>0.0.6<\/h3>\n<ul>\n<li>Transactional protection against brute-force password attacks and MFA based on IP address and identity.<\/li>\n<li>Support for IPv4, IPv6, CIDR, trusted proxies, allowlist and blocklist.<\/li>\n<li>Limited block notices to prevent deliberate email storms.<\/li>\n<li>Server quarantine without a menu, quick links or Back Office content.<\/li>\n<li>\u2018My authentication\u2019 has been redesigned with four steps, accessible labels, exportable recovery options and individual revocation.<\/li>\n<li>Equivalent and translated emails in PrestaShop 1.7, 8 and 9, with results by recipient.<\/li>\n<li>Hardened update checker: corporate HTTPS, no redirects, TLS, body size limit and strict v1 manifest.<\/li>\n<li>Migration 0.0.6, update from 0.0.5 and complete compatibility matrices for all three supported versions.<\/li>\n<\/ul>\n<h3>0.0.5<\/h3>\n<ul>\n<li>Multi-step login: PrestaShop first validates the password and then requests TOTP or recovery.<\/li>\n<li>Authenticated session in quarantine, linked to the employee and restricted to \u2018My authentication\u2019 until MFA is completed.<\/li>\n<li>Closing the side access via direct controllers and AJAX\/XHR requests.<\/li>\n<li>Mandatory enrolment for employees and super-administrators without confirmed TOTP.<\/li>\n<li>Trusted devices have been corrected in PrestaShop 9 and linked to the employee and the browser.<\/li>\n<li>Second factor redesigned in Spanish using the PrestaWard visual system.<\/li>\n<li>Extended guide with actual screenshots of two-factor authentication in PrestaShop 1.7, 8 and 9.<\/li>\n<li>Complete clean test matrix: email, TOTP, anti-replay, recovery, trust and quarantine.<\/li>\n<\/ul>\n<h3>0.0.4<\/h3>\n<ul>\n<li>Compulsory enrolment in \u2018My authentication\u2019 for accounts without TOTP when the mode is set to Force.<\/li>\n<li>Second login step displayed only after the password has been verified.<\/li>\n<li>Super-administrators included in the same personal authentication flow.<\/li>\n<li>MFA login form redesigned and translated into Spanish.<\/li>\n<li>Error 500 in the test email has been corrected.<\/li>\n<li>MFA self-service for each employee, kept separate.<\/li>\n<li>Policy, inventory, email and logs restricted to the super-administrator.<\/li>\n<li>Modern and legacy permissions rebuilt in an idempotent manner.<\/li>\n<li>Accurate diagnosis of recipients, SMTP configuration and transport.<\/li>\n<li>Unified real IP in logs, rate limiting, emails and trusted devices.<\/li>\n<li>Back Office events and texts translated into Spanish.<\/li>\n<li>Headers and design aligned with the PrestaWard family.<\/li>\n<li>Corporate support restored to hola@go-onagency.es.<\/li>\n<li>Upgrade 0.0.4 and clean test matrix in PrestaShop 1.7, 8 and 9.<\/li>\n<\/ul>\n<h3>0.0.3<\/h3>\n<ul>\n<li>Unified visual geometry with PrestaWard Snapshot.<\/li>\n<li>Revocable trusted devices with 256-bit random tokens stored as hashes.<\/li>\n<li>Secure, HttpOnly and SameSite=Lax cookies are restricted to the Back Office.<\/li>\n<li>Equivalent alerts in legacy and Symfony integrations.<\/li>\n<li>Branding, product links, guide, support and test email.<\/li>\n<li>Rate limit validation in PrestaShop 1.7, 8 and 9.<\/li>\n<\/ul>\n<h3>0.0.2<\/h3>\n<ul>\n<li>Password-protected TOTP enrolment and local QR code.<\/li>\n<li>Single-use recovery codes stored as HMAC.<\/li>\n<li>Atomic protection against TOTP replay attacks.<\/li>\n<li>Rate limiting by account and IP address.<\/li>\n<li>Specific integrations for legacy login and PrestaShop 9 Symfony.<\/li>\n<li>Password- and factor-protected authenticator rotation and MFA deactivation.<\/li>\n<\/ul>\n<h3>0.0.1<\/h3>\n<ul>\n<li>Secure scaffold disabled by default.<\/li>\n<li>MFA tables, TOTP, dashboard, audit, logs, alerts and initial translations.<\/li>\n<\/ul>\n<\/article>\n<aside class=\"product-page-aside\">\n<div class=\"product-page-aside__card product-page-aside__card--cta\">\n<h2>Guide and support<\/h2>\n<p>Please refer to the user guide for instructions on how to install and configure it correctly.<\/p>\n<p><a href=\"https:\/\/go-onagency.es\/prestaward-authenticator\/prestaward-authenticator-user-guide.pdf\" target=\"_blank\" rel=\"noopener\">Open the user guide<\/a><\/p>\n<\/p><\/div>\n<div class=\"product-page-aside__card product-page-aside__card--contact\">\n<p class=\"eyebrow\">GO ON Agency<\/p>\n<h2>Do you need a meticulous implementation?<\/h2>\n<p>We can help you define the deployment, validate access and prevent operational blockages.<\/p>\n<p><a class=\"product-page-contact-link\" href=\"mailto:hola@go-onagency.es\">hola@go-onagency.es<\/a><\/p>\n<\/p><\/div>\n<\/aside><\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>PrestaShop module PrestaWard Authenticator Real MFA for the Back Office. Protects admin accounts with TOTP, profile- and shop-specific policies, secure recovery and verifiable logs. Exclusive distribution on the PrestaShop Marketplace (Addons). Changelog PDF guide Help Guide Screenshots Deployment by employeesPolicy by profileActivity and statisticsSecurity stance Spanish interface \u00b7 version 0.0.16 TOTP + policies + recovery [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":27,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-product-page.php","meta":{"_joinchat":[],"footnotes":""},"class_list":["post-39","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/39","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/comments?post=39"}],"version-history":[{"count":16,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/39\/revisions"}],"predecessor-version":[{"id":174,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/39\/revisions\/174"}],"up":[{"embeddable":true,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/27"}],"wp:attachment":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/media?parent=39"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}