Authentication Security
This tab adds identity checks after the password: two-factor codes, location and IP checks, country rules, JetPass and passkeys, for clients and staff.
Opening the Screen
In the left menu, click Settings, then Security. Click Authentication in the tab row.
Address: {admin}/settings/security?general=authentication
What Is on the Screen
Each sub-tab has its own Save Changes button; switching away without saving loses the changes.
Fields
Two-Factor Authentication
Location Verification
Asks for extra verification when the visitor's city or country changed since their last sign-in. An account with no sign-in here yet (after an upgrade or import) is compared against its profile address. In 5.0-beta.3 and earlier the check ran only for accounts with a previous sign-in.
A sign-in from a new country or browser also e-mails the client and adds a panel notice. The "New Device Sign-in (Client)" template controls it.
Since 5.0-beta.4 a password or JetPass sign-in is also risk-scored once the password is accepted. From 40 points the client is asked for a one-time code, even with two-factor off. It travels on the method chosen here, or by e-mail. A browser that passes the code is remembered for 90 days. The score never refuses a sign-in; without a mail or SMS module the sign-in goes through. The signals appear on the Sign-in Attempts screen.
An address that signs in to five unrelated accounts within an hour is blocked for 60 minutes. The bell shows a notice and administrators receive the Suspected Account Takeover (Administrator) e-mail. The case is filed on the Security Events screen with three one-click actions; by default nothing else happens until you act. When automatic protection is set to end sessions, the accounts involved lose their sessions and trusted devices at once. Each owner gets a "was this you?" e-mail. Its one-click link locks the account and sends a reset link; it works once, within 24 hours. In 5.0-beta.3 and earlier the bell notice is the only record.
IP Verification
Checks for proxy, VPN or anonymizer use; it is not an address allowlist. To limit the admin panel to given IP addresses, use Admin Area IP Restriction on the Settings tab.
Country Rules
Each card has a mode and a country list. The visitor's country comes from the IP address; at sign-up the form's country is checked too.
JetPass
Lets someone sign in with a one-time code sent by e-mail instead of a password. It sits beside the password form on the login page; clients and staff are switched on separately. It needs an active mail module, or the option appears but no code arrives.
Passkeys
Lets someone sign in with a fingerprint, face scan or device PIN instead of a password. A passkey works only on your domain and only over https. On a non-secure address the tab warns you and the feature is unavailable. Clients and staff are switched on separately.
Tasks
Requiring Two-Factor Authentication for Clients
- Open Two-Factor Authentication and switch on at least one method card, such as the authenticator app.
- Turn on Force Enable for Clients.
- Click Save Changes.
Asking for an SMS Code on Every Sign-In
- Under Two-Factor Authentication, switch on the SMS Verification card. If SMS is the only method you want, switch off TOTP and Email Verification.
- Turn on Force Enable for Clients and leave Trusted Device Duration (Clients) at 0.
- Click Save Changes.
The client enables SMS verification at the next sign-in; every later one asks for the code sent to their phone.
Restricting Access to Certain Countries
- Open Country Rules and set the Access Restriction mode to Allow Only the Selected Countries.
- Pick the countries you serve in the Countries list that appears.
- Click Save Changes.
Visitors from other countries can no longer open an account, sign in or place an order.
Signing In as Staff Without a Password
- Open Passkeys, turn on Enable for Staff and click Save Changes.
- Open your own Account Settings from the profile menu, go to the Security tab and expand Passkeys.
- Click Add Passkey and finish the prompt your device shows.
The key is listed with its date. From then on the staff login screen offers Sign In with a Passkey, which opens the panel without a password or code.
Things to Watch
An account with two-factor verification is asked for a code on every sign-in, even from the same IP address. Only a Trusted Device Duration above 0 lets a trusted browser skip the code until the period ends.
The rule runs at every sign-in, not only at sign-up. A client travelling outside your list cannot sign in or pay until back. Staff logins are exempt.
A password reset, switching two-factor on or off, or ending all sessions deletes the account's trusted devices. Clients can also remove one device under Trusted Devices on their Security tab.
SMS codes go by SMS only, e-mail codes and JetPass by e-mail only. The client switches of the Two-Factor Authentication template do not change this. The code reaches the account holder alone, never a contact or a sub-account.
The SMS step shows the last four digits of the phone on file. If the code cannot be sent, the client is told to contact support; staff are pointed to the module settings.
If the module behind the check is removed later, or an SMS user has no mobile number, sign-in continues without the code. Keep the module configured while the check is on.
Some imported accounts have no password; JetPass, integration sign-in links and social sign-in then show a message until the client sets one with Forgot Password?.
Required Privileges
Viewing and saving any sub-tab on this screen needs the SECURITY_SETTINGS privilege.
Related Articles
Thanks for your feedback!
Our support team is here around the clock for anything you can't find above.