Registration, login and privacy
How people become customers and sign in is set in one place: Settings → Customer settings. It has four tabs - Customer, Security, Customer form fields and Address form fields.
Registration method
| Method | What happens |
|---|---|
| Standard | The account is active as soon as the form is sent. |
| Email validation | The customer must click a link in an activation e-mail first. |
| Admin approval | A staff member activates the account (set Active on the customer). Use it for B2B shops. |
| Disabled | No new registrations; guest checkout may still be allowed in the Sales settings. |
Other switches on the same tab: Notify about new customer registration (an e-mail to you), Allow users to change email, Usernames enabled (sign in with a user name instead of e-mail), New customer has a free shipping for the first order, and which tabs of My account are hidden (downloads, auctions, reviews, courses, documents...).
Passwords and sign-in security
The Security tab:
| Setting | What it does |
|---|---|
| Regular Expression for password validation | The password rule, for example a minimum length and a digit. The message shown to customers explains it. |
| Default password format | How new passwords are stored. Keep the hashed default; never store clear text. |
| Unduplicated passwords number | How many previous passwords cannot be reused. |
| Password lifetime | Days after which a customer must change the password (0 = never). Applies to customer groups that enforce it. |
| Maximum login failures, Lockout time | After this many wrong passwords the account is locked for the given minutes. Slows down password guessing. |
| Password recovery link. Days valid | How long a "forgot password" link works. |
| Two factor authentication enabled, type | Lets customers protect their account with a second factor - an authenticator app, or a code by e-mail or SMS depending on the plugins installed. |
External sign-in with Google or Facebook is provided by the authentication plugins under Plugins → External authentication methods.
Privacy: customers' own data
- Allow users to export account adds a button in My account that downloads the customer's data.
- Allow users to delete account lets customers delete their account themselves.
- Staff can export or delete a customer's data from the customer's page in the admin.
- The newsletter box can require an explicit opt-in, and the Newsletter box. Allow to unsubscribe switch shows an unsubscribe option.
What customers see in My account:
Tips and common mistakes
- With Email validation, make sure outgoing e-mail works first (message templates and e-mail accounts), or nobody can finish registering.
- Changing the password rule does not affect existing passwords until they are changed.
Related
Question not answered here? Ask the community on GitHub Discussions ↗