Two-factor login, a hidden admin login page and attempt limits for OpenCart.
Protects your OpenCart admin three ways: a 6-digit code from your phone after the password, an admin login page at an address only you know, and a lockout for bots that keep guessing passwords. Admin and customer logins are logged, and a forgotten login address can be emailed to you.
- Free, for OpenCart 4.0.2.0 and newer
- Two-factor login without SMS or an outside service
- No tracking, no outside connections
Then in your admin: Extensions → Installer, upload the file, and install it under the “Other” extension type.
Why protect your OpenCart admin?
Your OpenCart admin holds your orders, customers and payment settings, and its login page is easy to find. Bots try common usernames and leaked passwords on it over and over, and on the customer login too.
It takes only one weak or reused password for a guess to work. Saral Login Shield hides the admin login page, locks out IP addresses that keep failing, and asks for a code from your phone, so a stolen password on its own is no longer enough to get in.
What Saral Login Shield does
Two-factor login
After the password, admin users enter a 6-digit code from Google Authenticator, Microsoft Authenticator, Authy or 1Password. No phone number or outside service needed.
Backup codes
10 one-time codes for a lost phone, and “Don’t ask again on this device for 30 days” for your own computer.
Required for administrators
Make two-factor login compulsory for user groups that can change the store settings. They set it up right after their password.
Hidden admin login page
The admin only shows its login page at your own address, such as /admin/?login-k3x9qa. Everyone else gets a “Not Found” page or a redirect.
Limit login attempts
After 5 failed logins in 20 minutes, the IP address is locked out for 20 minutes. Covers the admin login, two-factor codes and the customer login.
Login activity
Every admin and customer login, failed login, wrong code and lockout, with filters and search. Unblock an IP address in one click.
New IP alerts and recovery
Administrators are emailed when they sign in from a new IP address. Forgot the login address? Get it by email at /?login-recovery.
Works behind Cloudflare
Reads the real visitor IP address behind Cloudflare, a proxy or a load balancer. IPv6 addresses are counted by their /64 network.
Set it up in four steps
In your OpenCart admin, go to Extensions, then Installer, and upload saral_login_shield.ocmod.zip. Then go to Extensions, choose the “Other” type, and install Saral Login Shield.
Open Saral Login Shield, switch on “Hide the login page” and save. Bookmark the new admin login address shown at the top.
In the profile menu at the top right, choose Two-factor login. Scan the QR code with your authenticator app, enter the code and save your 10 backup codes.
Login attempt limits are on already. If your store is behind Cloudflare or a proxy, choose it under Visitor IP address.
Saral Login Shield Pro for OpenCart
A paid add-on is on the way. Everything in the free extension keeps working as it is, and Pro will add:
IP allowlist and blocklist
Addresses and ranges, IPv4 and IPv6, with an option to let administrators log in only from the allowlist.
Bans for repeat offenders
Longer bans for addresses locked out again and again, and an instant lockout for usernames only attackers use.
CAPTCHA
Cloudflare Turnstile, hCaptcha or Google reCAPTCHA on the admin login and the customer login, registration and forgotten password forms.
Two-factor login for everyone
Require it for any user group and offer it to customers, with codes by email for people without an authenticator app.
Password policy
Minimum lengths, no passwords known from data breaches, and new passwords after a breach or every few months.
Security alerts and reports
Lockouts, bans and administrator logins by email, Slack, Discord or a webhook, plus a weekly summary.
Pro isn’t on sale yet. Leave your email at the top of this page and we’ll tell you when it is.
What it doesn’t do
Saral Login Shield looks after your admin login. It’s a strong layer, not a complete security setup:
- It isn’t a firewall or a malware scanner.
- Two-factor login is for admin users. Customers’ logins are limited and logged, but they don’t get two-factor login.
- It needs OpenCart 4.0.2.0 or newer. OpenCart 3 and older aren’t supported.
Use it together with strong passwords, regular updates and backups.
Private by design
The extension makes no outside connections and has no tracking or ads. Two-factor codes are made in your store and on your phone. The login log (time, username, IP address and browser) stays in your own database, is deleted after 30 days by default, and its tables are removed when you uninstall the extension.
Made for
- OpenCart store owners
- Stores with several admin users
- OpenCart developers
- Agencies managing many stores
Get an email when Saral Login Shield is updated
What's new in each version, in one short email. You'll also get our occasional newsletter. Unsubscribe from either any time.
Want your OpenCart store properly secured?
We build and look after OpenCart stores, write custom extensions and fix stores that have been hacked. The same team that made Saral Login Shield can help.
Questions about Saral Login Shield for OpenCart