Magento 2 Brute Force Protection: Slow Down Login Attacks
SKU: BRUTEFORCEPROTECTION1
- count failed attempts per IP address and account
- escalating lock times for customers and admin
- email to the security team, optionally to customers
- view locks in the admin, lift them, maintain exceptions
Einmaliger Kauf · inkl. 12 Monate Updates · zzgl. MwSt.
Magento 2 Brute Force Protection for customer login and admin
The Mironsoft Magento 2 Brute Force Protection counts failed logins and locks attackers out before they guess a password. It works for customer accounts in the shop as well as for the admin area, counts by IP address and by user account, and lengthens the lock time on repeated attempts. You set thresholds, time windows and notifications in the backend and can lift locks by hand at any time.
Counters per IP and account
Failed attempts are counted per address and per username, so neither single attacks nor distributed attacks slip through.
Escalating lock times
The first lock is short, each further one gets longer, up to a maximum that you define.
Customers and admin
Separate thresholds for customer login and admin login, each with its own message.
Notification
Email to the security team for admin locks or unusual spikes, optionally to the customer as well.
No account guessing
The error message stays the same whether or not the account exists, so nobody can probe addresses.
Release in the admin
View locks, lift single entries and exempt trusted addresses from counting.
Why Magento 2 Brute Force Protection makes sense even with strong passwords
Attackers try credentials automatically, often with lists from foreign data leaks. Many customers use the same password in several services, and a single hit is enough for access to an account with stored addresses and orders. Magento ships a simple lock per account, which however covers distributed attempts from many addresses only to a limited degree.
Magento 2 Brute Force Protection looks at both sides: how often an address fails and how often an account is attacked. It slows attacks down without permanently locking out real customers, and it gives the team an overview of what is going on.
Magento 2 Brute Force Protection: set counters, time windows and thresholds
With Magento 2 Brute Force Protection you define how many failed attempts are allowed in which time window, separately for customers and admin. Example: five attempts in ten minutes per address, ten per account. After that the lock applies. Successful logins reset the counter. The counters live in their own table, which is cleaned up automatically so that it does not grow.
- Thresholds separate for customers and admin
- Time window and counters per IP and account
- Successful login resets the counter
Escalating locks: start short, extend on repetition
The first lock lasts five minutes, for example, the second fifteen, the third one hour. With Magento 2 Brute Force Protection a typing error hardly affects the customer, while a bot waits longer each time. You decide start duration, factor and maximum duration. During an active lock the visitor sees a friendly message with the remaining time, without learning whether the account really exists.
- Start duration, factor and maximum adjustable
- Friendly message with remaining time
- Same answer for existing and unknown accounts
Notifications to team and customers on suspicious attempts
With Magento 2 Brute Force Protection the security team receives an email when an admin account is locked or when the number of locks in an hour exceeds a value. Customers can receive an email when their account was locked, with the advice to change the password. You maintain the email templates per store view. Duplicate messages are summarised so that the mailbox does not overflow.
- Email to the security team configurable
- Notice email to customers optional
- Summary instead of a flood of mails
View locks in the admin, lift them and maintain exceptions
The overview of Magento 2 Brute Force Protection lists active and past locks with address, account, time and number of attempts. You lift single locks with one click, for example when a customer asks for help by phone. Trusted addresses, such as the office or a test system, you exempt from counting. IP addresses are personal data, you set the retention, and the legal review is up to the shop operator.
- Overview of active and past locks
- Lift with one click
- Exceptions for trusted addresses
Where Magento 2 Brute Force Protection helps in daily work
Typical situations in which counting failures protects accounts.
Credential stuffing
A bot tries stolen credentials from foreign data leaks on your shop. After a few failed attempts it runs into the lock and loses speed.
Attacks on the admin
The admin login is hit with password lists at night. The Magento 2 Brute Force Protection lock applies quickly, and the team receives an email.
Customers with a forgotten password
With Magento 2 Brute Force Protection typing errors lead to short locks instead of permanent lockout. Support lifts a lock immediately when needed.
Distributed attacks
Many addresses try the same account. The counter per account slows them down even when each single address makes only a few attempts.
Magento 2 Brute Force Protection: without and with the module
The difference to the simple account lock of the standard.
| Topic | Without the module | With Mironsoft Brute Force Protection |
|---|---|---|
| Counting | Per account only | Per IP address and per account |
| Lock duration | Fixed duration | Escalating, longer on repetition |
| Notification | None | Email to team and optionally customers |
| Exceptions | Not provided | Trusted addresses |
| Overview | None | List with release in the admin |
How we set up Magento 2 Brute Force Protection for you
The process after your order.
Briefing
You tell us your desired values for attempts, time windows and lock duration and the recipients of the notifications.
Installation
We install the module, switch on the Magento 2 Brute Force Protection for customers and admin and adapt the message texts.
Exceptions
We enter your office addresses and test systems as exceptions so that your team is not locked out by accident.
Test
We trigger failed attempts and check counters, escalation, emails and the release in the admin.
Handover
Your team gets an introduction to the overview and to dealing with locked customers.
Scope compared with Google reCAPTCHA, Security Suite and IP approval
Google reCAPTCHA checks whether a human fills in the form and bothers every visitor in the process. Brute force protection applies only after failed attempts and is invisible to real customers. The Security Suite bundles general measures, and the admin IP approval limits access by origin. Magento 2 Brute Force Protection adds the counting of failed attempts to these building blocks.
All modules can be combined. The administration in the admin needs no additional JavaScript library, and in the Hyvä frontend only the error message changes.
No download, but a personal setup
The Magento 2 Brute Force Protection is not listed here as a finished download file for self-installation. The purchase is a commission: we contact you after the purchase, install the module in your shop and agree thresholds, lock times and emails with you.
Frequently asked questions
Everything important about counters, lock times, notifications and how the purchase works.
How can I protect the login against brute force attacks in Magento 2?
Does the protection apply to customers and the admin?
Can a real customer be locked out permanently?
Does the error message reveal whether an account exists?
How does the module differ from Google reCAPTCHA?
How are locks lifted?
Does Magento 2 Brute Force Protection work with Hyvä?
Who receives notifications?
What happens to the stored IP addresses?
Can I download and install the module myself?
Recently Viewed Products
Magento 2 Brute Force Protection – Mironsoft