Brute-force Protection

Pro Feature

Brute-force protection and automatic IP banning are available with the Pro license. Get your Pro license to access this feature.

Sentinel detects repeated failed login attempts on the PrestaShop back-office and automatically bans the offending IP addresses for a configurable period.

How it works

1. Attempt tracking: Every failed back-office login is recorded per IP address.
2. Threshold detection: When an IP exceeds the configured number of attempts within the time window, it is banned automatically.
3. Back-office blocking: A banned IP receives an HTTP 403 response on any back-office access until the ban expires. The front-office (storefront) remains fully accessible.
4. Automatic release: Temporary bans expire on their own — no manual action or cron is required.

Only back-office access is blocked, so legitimate customers sharing the same IP (for example behind a NAT) can still browse and order on the storefront.

Settings

The settings are set in the Brute-force Protection card of the Brute force tab of Sentinel > Configuration:

Setting	Default	Description
Enable brute-force protection	On	Master on/off switch
Maximum attempts	5	Number of failed logins before a ban
Time window (seconds)	900 (15 min)	Period over which attempts are counted
Ban duration (seconds)	3600 (1 h)	How long an automatic ban lasts

Below the fields, a sentence sums up the settings in plain words, and follows them as you type:

• while the protection is on, After %attempts% within %window%, the address is banned for %duration%., each duration in the largest unit that divides it: "After 5 failed attempts within 15 minutes, the address is banned for 1 hour." with the default values;
• while it is off, Brute-force protection is off: failed logins are not counted and no address is banned.

Click Save settings to save the card.

When the plan of the shop does not include the brute-force protection, the card shows the Pro invitation described under Brute force instead of the settings; during an outage of the Sentinel service, see When the Sentinel service does not answer.

Only an employee who can configure the Sentinel module changes these settings; the others see the tab read-only. See Who can change the settings.

Settings in effect

The Sentinel > Brute-force Protection page shows the settings without changing them: its Settings in effect card gives the same sentence and the saved values of Maximum attempts, Time window (seconds) and Ban duration (seconds). Its Adjust settings button opens the Brute force tab; it is only shown to an employee who can configure the Sentinel module.

Trusted IPs

An address in the Trusted IPs card of the General tab of Sentinel > Configuration is never counted, banned or blocked. Its Add my current IP (%ip%) button adds the address you are browsing from in one click: the safeguard that prevents an administrator from locking themselves out. This is a single list, shared with the DDoS protection and with threat detection, and you can change it on every plan, free included.

Behind a proxy or a CDN

If your store sits behind Cloudflare, a CDN or a reverse proxy, declare it in the Behind a proxy or a CDN? card of the General tab of Sentinel > Configuration. Without it, all your visitors appear under the address of the proxy, and the protections cannot tell them apart.

• When it detects Cloudflare or a reverse proxy that is not trusted yet in the request you are making from the back-office, the card offers Trust Cloudflare or Trust this proxy, which declares it in one click.
• My store is behind Cloudflare trusts Cloudflare's published ranges without pasting a single CIDR.
• Other reverse proxies accepts your own proxy addresses or CIDR ranges.

The Sentinel > Brute-force Protection page reminds you of it, with a Declare my proxy button that opens the General tab, only shown to an employee who can configure the Sentinel module (see Who can change the settings).

Forwarded headers are only honoured when the request genuinely comes from a declared proxy, so a visitor cannot forge their IP.

Blacklist

The Manual blacklist form permanently bans an IP, with an optional comment stored as the ban's reason so you remember why it is there. Permanent bans never expire and must be removed manually.

Managing bans

The Brute-force Protection page lists all active bans (IP, type, reason, ban date, expiry, attempt count) and lets you unban any IP with a single click. Unban lifts the brute-force ban or manual blacklist entry of the address and nothing else: a rate-limit ban of the same address stays in place, and is lifted from the DDoS Protection page. Clicking the attempt count opens the Attempted emails modal, listing the email addresses that were tried from that IP (sourced from the failed-login security logs). A ban whose address is also in the trusted IPs list is flagged with a Trusted badge: that address is no longer blocked.

Dashboard overview

The Sentinel dashboard displays a brute-force summary: number of active bans, total banned IPs, failed attempts over the last 24 hours, and the most recent bans. When the plan of the shop does not include the brute-force protection, an upgrade prompt is displayed instead; during an outage of the Sentinel service, see When the Sentinel service does not answer. The dashboard also shows, next to it, the top email addresses tried in failed back-office logins.

The PrestaShop home widget shows an Active Protection section with one card per licensed protection (brute force and DDoS), each displaying the active bans with the last-24-hours count in parentheses — e.g. "15 (3)". Each card links to its management page.

Command line

Bans can also be managed from the CLI:

# Ban an IP for the configured duration
php bin/console sentinel:brute-force ban 203.0.113.10

# Ban an IP for a custom duration (seconds)
php bin/console sentinel:brute-force ban 203.0.113.10 --duration=7200 --reason="Suspicious activity"

# Permanently blacklist an IP
php bin/console sentinel:brute-force ban 203.0.113.10 --permanent

# Unban an IP
php bin/console sentinel:brute-force unban 203.0.113.10

# List all bans (add --json for machine-readable output)
php bin/console sentinel:brute-force list

# Purge expired bans and stale attempts
php bin/console sentinel:brute-force purge

The unban command is the recommended recovery path if an administrator is ever locked out of the back-office. It lifts every ban of the address, whatever its type, including a DDoS protection ban: the address is no longer banned from its very next request, though it can still be slowed down while its network is under attack, since the per-network limit is shared with its neighbours. An IPv6 address can be typed in any notation.

Notes on IP resolution

• IPv6 addresses are supported and normalized before storage and comparison.
• Proxies: by default the client IP is read from REMOTE_ADDR. Forwarded headers are spoofable, so X-Forwarded-For is only read when the request reaches you from a declared proxy (the Cloudflare preset or Other reverse proxies), and the chain is walked from right to left so that entries an attacker prepended are ignored. CF-Connecting-IP is additionally only trusted when the request originates from a published Cloudflare range.
• Declaring a proxy is what enables this hardened behaviour. Until you do, installations upgraded from an earlier version keep the previous handling of the legacy Trust X-Forwarded-For setting, so bans and logs stay keyed by the same address as before.
• Trusted IP entries accept exact addresses and CIDR ranges (203.0.113.0/24, 2001:db8::/32). IPv4-mapped IPv6 addresses match their IPv4 form.

---

Next: Security Logs