Skip to main content

Configuration

Under its title, the page says what it holds: Your subscription and the settings of every Sentinel protection. They are spread over eight tabs, described below in the order of the page, each with its cards and settings under the labels the module shows. What a setting does is explained on the page of its feature, linked from each tab.

Opening the page​

In the back-office menu, click Sentinel > Configuration: the page opens on the General tab. The Configure button of Sentinel in Modules > Module Manager also opens the page on the General tab.

Each tab has its own address: clicking a tab changes the address in the browser, so a bookmark or a link reopens the page on that tab.

The former address of the Access Control page, which no longer has an entry in the menu, opens the Access control tab: the links and bookmarks that led there still work.

Who can change the settings says who may open the page and change its settings.

Above the tabs, a single Search a setting field finds a setting in every tab, without opening them one by one. The results appear as you type, grouped by tab in the order of the tabs, each group under the name of its tab with the number of results it holds. Screen readers announce the total, %count% results, where %count% is the number of results found.

A setting is found when each word you type starts a word of its label, its help or its keywords. Neither case nor accents matter: ban dur finds, among others, Ban duration (seconds) under both Brute force and DDoS. The search only lists what the page shows you: Download Signatures, for example, is only found while the signatures are missing.

After the tab groups, an Actions group lists the actions left on other pages of the module. Each one is a plain link to its page:

  • Unban an address (brute force) and Blacklist: the Sentinel > Brute-force Protection page.
  • Unban an address (DDoS) and Resume enforcement: the Sentinel > DDoS Protection page.
  • My two-factor methods: the page where you manage your own two-factor authentication methods.

An action only appears if you may open the page it leads to. Every employee may open their own two-factor methods, so My two-factor methods is always offered.

When nothing matches, the list says No setting matches, then Try: followed by IP address, Ban, Proxy, 2FA and Signatures. Clicking one of these words types it in the field and searches again.

On the free plan, a setting kept for Pro is still found: its result carries the PRO badge and leads to the Pro invitation of its tab. An action whose page is kept for Pro carries the same badge.

Clicking a result opens its tab, as the tab bar does, then scrolls to the setting and highlights it for a few seconds, with the focus on it.

Everything works from the keyboard: the up and down arrows move through the results of every group, Enter opens the selected result, and Escape closes the list, then empties the field when pressed again. The suggested words are reached with the Tab key.

General​

The General tab holds three cards. They are only described here.

Subscription​

  • Current plan: the name of your plan, or Unknown when the subscription could not be read.
  • Licence: your licence key, shown in full, when the shop has one.
  • Expires: the date your subscription ends, when it has one.
  • Refresh: asks the Sentinel service again for the state of your subscription, for example right after a purchase.
  • Upgrade to %plan%, where %plan% is the name of the next plan, or Upgrade Now: opens the offer in a new tab, when a higher plan is available.
  • I bought my module on Addons: on the free plan, explains how to claim the three months of the Pro plan included with a purchase on PrestaShop Addons.
  • Already have a PRO licence? Associate it here: on the free plan, opens your Sentinel account in a new tab to associate with this shop a Pro licence you already own.

Behind a proxy or a CDN?​

If your store sits behind Cloudflare, a CDN or a reverse proxy, declare it on this card. Without it, all your visitors appear to share the address of the proxy and the protections cannot tell them apart; once the proxy is declared, every Sentinel protection sees the real address of each visitor.

  • When the request reaches the shop through Cloudflare and Cloudflare is not trusted yet, the card says so and offers Trust Cloudflare, which declares it in one click.
  • When the request reaches the shop through another reverse proxy that is not trusted yet, the card shows its address and offers Trust this proxy, which adds it to the list in one click.
  • My store is behind Cloudflare: a switch that trusts the addresses of Cloudflare.
  • Other reverse proxies: the IP addresses or CIDR ranges of your other proxies, separated by commas.
  • Save proxy configuration: saves the switch and the list.

Sentinel only reads the address of the visitor forwarded by a proxy when the request comes from Cloudflare, once trusted, or from one of the Other reverse proxies: a forwarded header sent by any other client is ignored, so a visitor cannot forge their address. The card is available on every plan.

Trusted IPs​

The addresses of this card are never counted, banned or blocked by the brute-force and DDoS protections or by threat detection, and CIDR ranges are supported. This is a single list, shared by the brute-force and DDoS protections and by threat detection: an address added here is trusted by all three. You can change it on every plan, free included.

  • One row per trusted address: IP or CIDR range, Comment (optional) and a Remove button that removes the address and saves the list at once.
  • An empty row to add an address: IP or CIDR range and Comment (optional); Add another address adds a further row, so that several addresses go in a single save.
  • Also trust PrestaShop maintenance IPs: also trusts the maintenance IPs set in PrestaShop. Once this switch is saved on, the card lists the maintenance IPs set in PrestaShop, after Maintenance IPs currently protected:, or warns that none is set with No PrestaShop maintenance IP is set. Add your own IP to the trusted list to avoid locking yourself out.; while it is off, neither is shown (after a refused save, the card follows the switch as you sent it), and they are only trusted while this switch is on.
  • Save trusted IPs: saves the list and the switch. If an entry is not a valid IP address or CIDR range, nothing is saved and the card keeps what you typed.
  • Add my current IP (%ip%), where %ip% is the address you are browsing from: shown while that address is not trusted, it saves the list with your address added.

Threat detection​

  • Threat Detection Signatures Missing: a notice shown while the signatures have not been downloaded.
    • Download Signatures
  • Real-time threat detection card:
    • a switch and the Apply button
    • the badge On, Waiting for signatures or Off
  • URLs never blocked card:
    • the One path per line field, which lists the paths that threat detection never blocks (see What is never blocked)
    • the Save button
  • Direct PHP File Access Protection card, on a plan other than the free one:
    • the badge On, Activation In Progress or Off
    • depending on the state, the notice Automatic Installation Not Possible, Activation In Progress or Direct Access Protection Not Active
    • Try Automatic Installation
    • Check Now
    • Manual Installation Instructions

On the free plan, the Real-time threat detection card shows the Upgrade to Pro button, or the Pro Plan Required badge when no upgrade is offered, instead of the switch and the badge.

On the free plan, the URLs never blocked card shows the Pro Plan Required badge, and its field cannot be changed. A list that an employee who can configure Sentinel sends anyway on the free plan is refused with URLs never blocked are available with Sentinel Pro. Nothing was saved.

On the free plan, the Direct PHP File Access Protection card only shows the Upgrade to Pro button, or the Pro Plan Required badge when no upgrade is offered: no badge, no notice, no Try Automatic Installation, no Check Now and no Manual Installation Instructions. An installation an employee who can configure Sentinel requests anyway on the free plan is refused with Direct PHP file access protection is available with Sentinel Pro. Nothing was installed.

During an outage of the Sentinel service, see When the Sentinel service does not answer.

What these settings do: Threat Detection and Auto Prepend File Protection.

Scheduling and alerts​

  • Automatic scans card, with one row for the Security Scanner and one for the Integrity Check:
    • the time of the run, in Paris time, with the badge Enabled or Disabled, or No automatic schedule
    • Hour (Europe/Paris)
    • Minute
    • Enable
    • Save
  • Alert recipients card:
    • Addresses, separated by commas
    • Save

On the free plan, both cards show Available with Sentinel Pro and, when an upgrade is offered, an Upgrade to Pro button.

What these settings do: Automatic scans and Alert recipients.

Integrity​

  • Integrity Check — Exclusions card:
    • the exclusion rules, one per line
    • Save ignore rules

What these settings do: Excluding files with .sentinelignore.

Brute force​

  • Brute-force Protection card:
    • Enable brute-force protection
    • Maximum attempts
    • Time window (seconds)
    • Ban duration (seconds)
    • a sentence that sums up these settings in plain words
    • Save settings

When the plan of the shop does not include the brute-force protection, the card shows Available with Sentinel Pro and the Upgrade to Pro button, or the Pro Plan Required badge when no upgrade is offered; during an outage of the Sentinel service, see When the Sentinel service does not answer.

What these settings do: Brute-force Protection. The addresses that are never banned are set under Trusted IPs.

DDoS​

  • Settings card:
    • Protection: Off, Monitor or On
    • Sensitivity: Relaxed, Balanced, Strict or Custom
  • Advanced card:
    • Time window (seconds)
    • Throttle threshold (requests per window)
    • Ban threshold (requests per window)
    • Ban duration (seconds)
    • Safety threshold (% of traffic blocked)
    • Network limit (requests per window)
    • Spike threshold (total requests per window)
    • Redis DSN (optional)
    • Per-path limits
    • Never limit verified search engine crawlers
    • Double the ban duration for repeat offenders
    • Also limit per network (/24 IPv4, /64 IPv6)
    • Tighten limits automatically during a traffic spike
  • Excluded URLs card:
    • One path per line
  • Save settings, below the three cards

When the plan of the shop does not include the DDoS protection, the tab shows Available with Sentinel Pro and the Upgrade to Pro button, or the Pro Plan Required badge when no upgrade is offered; during an outage of the Sentinel service, see When the Sentinel service does not answer.

What these settings do: DDoS Protection. The addresses that are never limited are set under Trusted IPs.

Access control​

  • Inactive employee accounts card:
    • Deactivate inactive employee accounts: off by default
    • Days without using the back office: a whole number from 1 to 3650, 90 by default
    • when enabling, you can also deactivate right away the accounts already inactive for longer

This card additionally requires permission to edit employees; without it, its settings stay read-only. See Inactive employee accounts. You can also find the card with Search a setting, using inactive.

  • Back office IP whitelist card:
    • Enable back office IP whitelist
    • one row per address: IP or CIDR range, Comment (optional) and Remove
    • Save the whitelist
    • Add my current IP (%ip%), shown only when your current address is not in the list
  • a reminder to declare your proxy, with Declare my proxy, which opens the General tab and its Behind a proxy or a CDN? card

What these settings do: Access Control.

Two-factor authentication​

  • Enrollment policy card:
    • Enforce two-factor authentication on this shop
    • a table with one row per profile: Profile, Requirement (Not required, Optional or Required) and Not enrolled / employees
  • Delays card:
    • Reminder after (days)
    • Deadline after (days)
    • 2FA session lifetime (seconds)
    • Trusted device duration (days)
    • Maximum attempts
  • Advanced settings card:
    • Relying party identifier
    • Accepted origins
  • Save the policy, below the three cards: while the policy is switched on, it first opens the confirmation Apply this policy? (see Saving the policy)

What these settings do: Two-Factor Authentication.

Who can change the settings​

To open the page, an employee needs the View permission on Sentinel > Configuration, set in Advanced Parameters > Team > Permissions. When Sentinel is installed, and when it is updated from a version without this page, each profile receives on Sentinel > Configuration the permissions it holds on Sentinel > Dashboard, and a profile that could configure the module receives View and Edit. Permissions are only added, never taken away.

Only an employee who can configure the Sentinel module changes the settings of this page: a SuperAdmin, or a profile that has the three following permissions, set in Advanced Parameters > Team > Permissions:

  • Edit on Sentinel > Configuration
  • Edit on Module Manager
  • Configure on the Sentinel module

The rule is the same on every version of PrestaShop. It covers every setting of the page, on every tab:

The actions left on other pages of the module, such as unbanning an address, follow the permissions of their own page.

On the other pages of the module, the buttons and links that lead to a tab of this page, such as Adjust settings and Declare my proxy, are only shown to an employee who can configure the module. The others see the same page without them.

On the Sentinel > Brute-force Protection and Sentinel > DDoS Protection pages and on the Access control tab, the notice about the proxy depends on the rights of the employee:

  • an employee who can configure the module reads Behind a proxy or a CDN? Declare it once in Sentinel › Configuration, so every protection sees the real address of each visitor., with the Declare my proxy button;
  • an employee who can open this page but cannot configure the module reads Behind a proxy or a CDN? Only an employee allowed to configure Sentinel can declare it in Sentinel › Configuration: ask one of them to declare it, so every protection sees the real address of each visitor.
  • an employee who cannot open this page reads Behind a proxy or a CDN? It can only be declared in Sentinel › Configuration, which your account cannot open: ask the shop administrator to declare it.

The messages about an undeclared proxy on the two-factor authentication screens and in the prerequisites check follow the same three cases.

An employee who can open the page but cannot configure the module sees it read-only. The settings keep their values, their fields disabled, and what would change them is withdrawn: the save buttons, Refresh, Already have a PRO licence? Associate it here, Trust Cloudflare and Trust this proxy, the empty row, Add another address and Add my current IP (%ip%) of the Trusted IPs card, the empty row and Add my current IP (%ip%) of the Back office IP whitelist card, Download Signatures, Try Automatic Installation, and the switch and Apply button of the Real-time threat detection card, which keeps its badge. The Declare my proxy buttons give way to the wording for an employee who can open this page but cannot configure the module (see above). The offers, Check Now and the Manual Installation Instructions stay. The Automatic scans and Alert recipients cards only show You need the permission to configure this module to see these settings.

If that employee sends a change anyway, nothing is changed. Without the Edit permission on Sentinel > Configuration, PrestaShop refuses the request; otherwise, the page shows one of these messages:

  • for the proxy: Your account is not allowed to change the proxy configuration. Nothing was saved: ask the shop administrator.
  • for the automatic scans and the alert recipients: Your account is not allowed to change the automatic scans or the alert recipients. Nothing was saved: ask the shop administrator.
  • for a licence association: Your account is not allowed to associate a licence with this shop. Nothing was saved: ask the shop administrator to associate the licence again from this page.
  • for any other setting: Your account is not allowed to change these settings. Nothing was changed: ask the shop administrator.

When the Sentinel service does not answer​

While the Sentinel service does not answer, the module does not take a Pro shop for a free one in the parts below: they follow the plan the Sentinel service last gave for the shop, whatever its age.

  • the Real-time threat detection, URLs never blocked and Direct PHP File Access Protection cards of the Threat detection tab;
  • the Brute force and DDoS tabs, whose settings stay shown and can still be saved;
  • on Sentinel > Dashboard, the rows of Your protections, the DDoS Requests Blocked figure, and the Brute-force Protection and DDoS Protection cards with their figures;
  • the coverages the security score counts as missing.

The protection itself can be suspended meanwhile. The Brute-force Protection and DDoS Protection cards of the dashboard, and the Brute force and DDoS tabs, then show a notice:

  • Brute-force protection suspended until the Sentinel service responds, when Enable brute-force protection is on;
  • DDoS protection suspended until the Sentinel service responds, when Protection is on Monitor or On.

When each protection is suspended is given in Notes under a row; before that, no notice is shown.

The following parts only follow the subscription the Sentinel service confirms, and take the shop for a free one as long as it is not confirmed:

  • the Sentinel > Brute-force Protection and Sentinel > DDoS Protection pages, reached from the menu, from View all or from the DDoS Requests Blocked figure, which show Feature Locked instead;
  • the plan shown at the top of Sentinel > Dashboard, next to Refresh;
  • the Active Protection section of the PrestaShop home widget, which leaves out the brute-force and DDoS cards.