{"id":836293,"date":"2026-07-06T11:39:42","date_gmt":"2026-07-06T11:39:42","guid":{"rendered":"https:\/\/www.knowband.com\/blog\/?p=836293\/"},"modified":"2026-08-04T12:04:51","modified_gmt":"2026-08-04T12:04:51","slug":"opencart-advanced-security-manager-extension","status":"publish","type":"post","link":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/","title":{"rendered":"OpenCart Advanced Security Manager Extension &#8211; Complete User Guide (Updated)"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">Most OpenCart store owners end up securing their site the hard way: one extension for two-step login verification, another for blocking spammy bots, a third for CAPTCHA, and maybe a support ticket to their host about a firewall. OpenCart Security Manager was developed to remove that patchwork. This module puts admin-side protection, storefront defense, and file-integrity monitoring into one settings screen inside your OpenCart admin panel.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Whether you&#8217;ve been searching for an OpenCart two-factor authentication extension, an OpenCart firewall extension, protection against login brute-forcing, or a way to disguise your admin directory without stacking five separate add-ons, this single extension is built to cover that ground.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The <a href=\"https:\/\/www.knowband.com\/opencart-advanced-security-manager\">OpenCart Advanced Security Manager extension<\/a> is organised into three sections, each broken into its own set of tabs:<\/span><\/p>\n<p><span style=\"font-weight: 400;\"><strong>Admin Protection<\/strong>: Two-Step Verification, Login Attempt Throttling, IP-Restricted Admin Access, Admin Directory Cloaking, Server-Level Login Prompt, and login activity tracking.<\/span><\/p>\n<p><span style=\"font-weight: 400;\"><strong>Storefront Protection<\/strong>:\u00a0 Web Application Firewall, Security Response Headers, Form Spam Filtering (CAPTCHA), Copy\/Scrape Deterrents, and a storefront-wide access prompt.<\/span><\/p>\n<p><span style=\"font-weight: 400;\"><strong>File Integrity Monitoring<\/strong>: Scheduled scans, threat flagging, and a scan history log.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Each area is covered field-by-field later in this document, so you&#8217;ll always understand what a setting does before you switch it on.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Attackers targeting OpenCart stores tend to go after the same handful of weak points: guessable admin passwords, scripted login attempts, an admin directory sitting at its default path, unguarded contact\/registration forms, and quietly altered core files. This extension is meant to close those specific doors without requiring a security consultant or a stack of unrelated add-ons.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Protection is applied in independent layers, and each layer covers a different surface &#8211; the admin login screen, storefront-facing forms, the headers your server sends back to browsers, and the files on disk.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The risk in plain terms: OpenCart, being widely used and open-source, is a routine target for automated scanning. Bots probe for default admin paths, hammer login forms with credential lists, and flood contact forms with spam. One compromised admin login can lead to stolen customer records, injected code, or a defaced storefront &#8211; outcomes that cost far more in cleanup and lost trust than the setup time this extension requires.<\/span><\/p>\n<div data-index=\"1\">\n<div tabindex=\"0\" role=\"article\" aria-setsize=\"4\" aria-posinset=\"2\" aria-label=\"Message 2 of 4\">\n<div data-test-render-count=\"1\">\n<div class=\"group\">\n<div class=\"contents\">\n<div class=\"group relative relative pb-[var(--msg-assistant-pb,0.75rem)]\" data-is-streaming=\"false\">\n<div class=\"font-claude-response relative leading-[1.65rem] [&amp;_pre&gt;div]:bg-bg-000\/50 [&amp;_pre&gt;div]:border-0.5 [&amp;_pre&gt;div]:border-border-400 [&amp;_.ignore-pre-bg&gt;div]:bg-transparent [&amp;_.standard-markdown_:is(p,blockquote,h1,h2,h3,h4,h5,h6)]:pl-2 [&amp;_.standard-markdown_:is(p,blockquote,ul,ol,h1,h2,h3,h4,h5,h6)]:pr-8 [&amp;_.progressive-markdown_:is(p,blockquote,h1,h2,h3,h4,h5,h6)]:pl-2 [&amp;_.progressive-markdown_:is(p,blockquote,ul,ol,h1,h2,h3,h4,h5,h6)]:pr-8\">\n<div>\n<div class=\"grid grid-rows-[auto_auto] min-w-0\">\n<div class=\"row-start-2 col-start-1 relative grid grid-rows-[auto_auto] isolate min-w-0\">\n<div class=\"row-start-1 col-start-1 relative z-[2] min-w-0\">\n<div>\n<div>\n<div class=\"standard-markdown grid-cols-1 grid [&amp;_&gt;_*]:min-w-0 gap-3 standard-markdown\">\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>New Features Added to the OpenCart Advanced Security Manager Extension v1.0.1 ( Updated July 10, 2026)<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Knowband&#8217;s OpenCart Security Extension has been upgraded with two major additions: a Security Dashboard and a frontend Honeypot Field under Spam Protection powered by Project Honeypot. Together, these give store owners a complete, real-time view of their store&#8217;s safety along with a stronger, hassle-free shield against automated attacks.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>1. New Security Dashboard<\/strong><\/p>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836402\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard.png\" alt=\"\" width=\"1671\" height=\"827\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard.png 1671w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-300x148.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-1024x507.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-768x380.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-1536x760.png 1536w\" sizes=\"auto, (max-width: 1671px) 100vw, 1671px\" \/><\/a><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836401\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-2.png\" alt=\"\" width=\"1677\" height=\"857\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-2.png 1677w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-2-300x153.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-2-1024x523.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-2-768x392.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Dashboard-2-1536x785.png 1536w\" sizes=\"auto, (max-width: 1677px) 100vw, 1677px\" \/><\/a><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">A centralised Security Dashboard is now available, giving OpenCart admins a single-screen overview of their store&#8217;s overall security health.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Key details displayed include:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Security Score<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Active Security Protections<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Failed and Successful Login Attempts<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Login Success Rate<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Two-Factor Authentication Coverage<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Active IP Bans<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Spam Protection Statistics<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Flagged IP Addresses<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Bot Trapping Activity<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Recent Project Honeypot Classifications<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Top Attacking IP Addresses<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Top Targeted Admin Accounts<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal\">With this dashboard, merchants can track security activity as it happens and catch potential threats before they escalate.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>2. Honeypot Protection<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">The new Honeypot feature adds an invisible layer of bot defence by embedding a hidden field within key storefront forms. Genuine shoppers never see it, but bots that auto-fill every field are instantly flagged.<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Protects Registration, Login, Contact, Newsletter, and Product Review forms<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Requires no theme modifications<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">No dependency on third-party services<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Completely invisible to real customers<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Reduces spam submissions and fake account creation<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal\">For added protection against more sophisticated bots, this feature pairs effectively with the OpenCart Captcha Extension.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>3. Project Honeypot Integration<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">This release also integrates the extension with Project Honeypot, a globally trusted service that identifies known spammers and malicious IP addresses. Rather than relying solely on form-based checks, this integration evaluates a visitor&#8217;s reputation before they even interact with your store&#8217;s forms.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Key highlights:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Real-time IP reputation lookups via the Http-bl service<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Observer Mode to monitor suspicious visitors without blocking them<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Action Mode to automatically block flagged IP addresses<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Configurable ban duration<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">IP whitelisting for trusted users, internal networks, and CDN services<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Detailed logs showing visitor reputation scores and the corresponding action taken<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h2><span style=\"font-weight: 400;\"> Key Features of <a href=\"https:\/\/www.knowband.com\/opencart-advanced-security-manager\">OpenCart Security Manager Extension<\/a><\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><\/h2>\n<p><b>Two-Step Verification (2FA)<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Requires an admin to supply a rotating six-digit code from an authenticator app in addition to their password. This blocks account takeover even when a password has leaked, been guessed, or reused from another breach.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Example: A shop with three admin users might require 2FA for everyone except a contractor&#8217;s fixed office IP, which is exempted. Tip: whitelist your own reliable IP addresses before turning on sitewide enforcement, so you&#8217;re never prompted to enroll from a connection you can&#8217;t act from.<\/span><\/p>\n<p><b>Login Attempt Throttling<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Temporarily blocks an IP once it racks up too many failed admin logins inside a set window &#8211; no manual watching required.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Example: if a script fires 50 password guesses at the admin login in under a minute, the source IP gets banned automatically once the retry limit is hit. Tip: pair a moderate retry ceiling (5\u201310 tries) with a ban long enough to discourage a retry (15\u201330 minutes), and exempt your office or VPN IP so a typo doesn&#8217;t lock your own team out.<\/span><\/p>\n<p><b>IP-Restricted Admin Access<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Limits admin panel access to a defined list of addresses &#8211; anyone else is turned away before the login form even loads. This is the single strongest control against outside admin access, since the block happens before any credentials are checked.<\/span><\/p>\n<p><strong>Admin Directory Cloaking<\/strong><\/p>\n<p><span style=\"font-weight: 400;\">This feature hides your real admin path behind a secret alternate URL; the genuine path returns a 404 to anyone who doesn&#8217;t know the alternate name. This takes your store out of the pool that bots find by scanning for common admin folder names.<\/span><\/p>\n<p><b>Server-Level Login Prompt (HTTP Authentication)<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Adds a browser-native username\/password prompt in front of the admin panel, the storefront, or both &#8211; before OpenCart&#8217;s own login screen loads. This runs entirely outside the application, which is useful for staging sites, pre-launch stores, or an extra admin gate.<\/span><\/p>\n<p><b>Web Application Firewall (WAF)<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Screens incoming GET\/POST data and cookies for known SQL injection, cross-site scripting, and path-traversal patterns, and blocks matches with an HTTP 403 before they reach OpenCart&#8217;s code.<\/span><\/p>\n<p><b>Security Response Headers<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Adds headers (HSTS, clickjacking protection, MIME-sniffing protection, referrer policy, permissions policy) that instruct browsers to enforce extra safeguards. This is a low-risk way to harden how browsers treat your site, and it&#8217;s frequently required on PCI and security-audit checklists.<\/span><\/p>\n<p><b>Form Spam Filtering (CAPTCHA)<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Adds CAPTCHA verification &#8211; Cloudflare Turnstile, Google reCAPTCHA, or hCaptcha &#8211; to the contact form and registration form, cutting spam submissions and fake sign-ups with no theme edits required.<\/span><\/p>\n<p><b>Copy\/Scrape Deterrents<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Discourages casual content copying by disabling right-click, copy\/paste, view-source, and DevTools shortcuts, raising the effort needed to casually scrape product text and images.<\/span><\/p>\n<p><b>File Integrity Monitoring<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Runs scheduled scans that compare your OpenCart installation against a known-good baseline, flagging new or altered files as possible threats &#8211; often surfacing a compromise before it shows up on the storefront.<\/span><\/p>\n<p><b>Detailed Overview of the OpenCart Security Extension<\/b><\/p>\n<p><b>Admin Protection<\/b><span style=\"font-weight: 400;\"> &#8211; Covers your admin login and sessions: 2FA, login throttling, IP restriction, directory cloaking, server-level login prompt, and login monitoring (which includes a Users sub-view for managing individual 2FA enrollments).<\/span><\/p>\n<p><b>Storefront Protection<\/b><span style=\"font-weight: 400;\"> &#8211; covers customer-facing traffic: the firewall, response headers, spam filtering, cart-bot blocking, copy deterrents, and the storefront-wide login prompt.<\/span><\/p>\n<p><b>File Integrity Monitoring<\/b><span style=\"font-weight: 400;\"> &#8211; scan settings and history, including the cron URL used for scheduling and a searchable log of past scans.<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><\/p>\n<h4><span style=\"font-weight: 400;\">At the top of every tab you&#8217;ll find the emergency recovery link &#8211; a permanent URL that switches off the extension&#8217;s restrictive features in one click if you ever get locked out. This is the single most important detail in this manual: find it now, before touching any other setting, and save it somewhere outside the admin panel. This is the important information that an admin owner should be aware of.<\/span><\/h4>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Emergency-Recovery.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836297\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Emergency-Recovery.png\" alt=\"\" width=\"1702\" height=\"177\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Emergency-Recovery.png 1702w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Emergency-Recovery-300x31.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Emergency-Recovery-1024x106.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Emergency-Recovery-768x80.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Emergency-Recovery-1536x160.png 1536w\" sizes=\"auto, (max-width: 1702px) 100vw, 1702px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">The Users view under Admin Protection lists every admin account (ID, name, email, current 2FA status) and lets you reset a lost or compromised authenticator enrollment so that person can register a new one on their next login.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Reporting lives in two places: the Login Attempt Log under Admin Protection (IP, timestamp, email, and result for every admin login attempt, once logging is turned on) and the Scan History table under File Integrity Monitoring (every scan run, manual or scheduled, with file counts, threat counts, duration, and a link to the full report).<\/span><\/p>\n<p><b> How Each Feature Actually Works<\/b><\/p>\n<p><strong>Two-Step Verification<\/strong><\/p>\n<p><span style=\"font-weight: 400;\">This uses the standard TOTP (Time-based One-Time Password) protocol &#8211; the same one behind Google Authenticator, Authy, and similar apps. When an admin turns on 2FA, or is required to via sitewide enforcement, they scan a QR code into their authenticator app, which then generates a new six-digit code every 30 seconds. That code is entered alongside the normal password at each login.<\/span><\/p>\n<p><b>Login Attempt Throttling<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Every failed admin login is logged against the IP it came from. Once failures from one IP cross the configured limit inside the configured window, that IP is blocked from further attempts until the ban period runs out.<\/span><\/p>\n<p><b>IP-Restricted Admin Access<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Once turned on, every request to the admin panel is checked against an allow-list before OpenCart&#8217;s routing runs at all. Anyone not on the list is blocked outright &#8211; they never reach the login form.<\/span><\/p>\n<p><b>Admin Directory Cloaking<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The extension intercepts requests to your real admin path and returns a 404 unless the visitor has already reached a secret alias URL, which sets a cookie and quietly forwards them to the real location.<\/span><\/p>\n<p><b>Server-Level Login Prompt<\/b><\/p>\n<p><span style=\"font-weight: 400;\">This adds a separate, browser-native prompt &#8211; rendered by the browser itself rather than an OpenCart form &#8211; in front of the admin panel, the storefront, or both, enforced at the web-server level before any PHP logic runs.<\/span><\/p>\n<p><b>Web Application Firewall<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The WAF checks incoming query parameters, POST fields, and cookies against a library of known injection, XSS, and path-traversal patterns. A match triggers an immediate 403 before the request reaches OpenCart&#8217;s controllers.<\/span><\/p>\n<p><b>Security Response Headers<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Each toggle here adds one specific header telling the visitor&#8217;s browser to enforce a particular behavior &#8211; refusing to render the page in an iframe, refusing to guess file types, forcing HTTPS, and so on.<\/span><\/p>\n<p><b>Form Spam Filtering<\/b><\/p>\n<p><span style=\"font-weight: 400;\">When enabled, the extension injects the chosen CAPTCHA widget into the storefront contact and registration forms automatically, with no theme editing, and verifies the response server-side before accepting a submission<\/span><\/p>\n<p><b>Copy\/Scrape Deterrents<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A set of client-side restrictions &#8211; disabling copy\/cut\/paste, right-click, text selection, view-source, and DevTools shortcuts &#8211; applied across the storefront, with an IP whitelist for staff who need normal browser behavior.<\/span><\/p>\n<p><b>File Integrity Monitoring<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A scheduled job, triggered by your server&#8217;s cron scheduler hitting a unique, token-protected URL, scans every file in your installation, compares it to a maintained baseline of known-good OpenCart core and common extension files, and flags anything new, missing, or modified.<\/span><\/p>\n<h2><strong>1.0.0 Admin Protection<\/strong><\/h2>\n<p><b>Two-Step Verification<\/b><\/p>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Admin-Security-2FA.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836294\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Admin-Security-2FA.png\" alt=\"\" width=\"1592\" height=\"885\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Admin-Security-2FA.png 1592w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Admin-Security-2FA-300x167.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Admin-Security-2FA-1024x569.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Admin-Security-2FA-768x427.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Admin-Security-2FA-1536x854.png 1536w\" sizes=\"auto, (max-width: 1592px) 100vw, 1592px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">Enable 2FA &#8211; turns on 2FA support; admins are guided to set up an authenticator app at their next login.<\/span><\/p>\n<p><b>Whitelist IPs <\/b><span style=\"font-weight: 400;\">&#8211; addresses that skip 2FA entirely, even when enforcement is on. Add your office or home network as a safety net before enforcing.<\/span><\/p>\n<p><b>Force 2FA<\/b><span style=\"font-weight: 400;\"> &#8211; requires every non-whitelisted admin to set up 2FA before proceeding. Only enable after whitelisting a trusted IP or confirming the recovery link works.<\/span><\/p>\n<p><b>ID <\/b><span style=\"font-weight: 400;\">&#8211; identifies the admin account.<\/span><\/p>\n<p><b>2FA Status<\/b><span style=\"font-weight: 400;\"> &#8211; shows whether that account currently has 2FA enrolled. Worth reviewing periodically, especially after staff changes.<\/span><\/p>\n<p><b>Actions <\/b><span style=\"font-weight: 400;\">&#8211; resets a lost 2FA enrollment so the user can register a new device. Use right away if someone loses their authenticator phone.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Rolling out 2FA as optional first, then switching to enforced once everyone&#8217;s enrolled, is the <\/span><b>recommended path <\/b><span style=\"font-weight: 400;\">&#8211; it stops account takeover from a leaked, guessed, or reused password, since the password alone is no longer enough. Never enforce 2FA sitewide without first whitelisting at least one trusted IP or confirming the recovery link works, and keep that whitelist short and reviewed regularly, since those addresses bypass 2FA completely. Add &#8220;reset 2FA&#8221; to your offboarding checklist for departing staff.<\/span><\/p>\n<h3><b>Brute Force Protection<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Brute-Force-.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836296\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Brute-Force-.png\" alt=\"\" width=\"1607\" height=\"821\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Brute-Force-.png 1607w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Brute-Force--300x153.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Brute-Force--1024x523.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Brute-Force--768x392.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Brute-Force--1536x785.png 1536w\" sizes=\"auto, (max-width: 1607px) 100vw, 1607px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\"><strong>Enable throttling<\/strong> &#8211; Temporarily blocks an IP after too many failed admin logins. Recommended on any live store.<\/span><\/p>\n<p><b>Max retries<\/b><span style=\"font-weight: 400;\"> &#8211; Failed attempts allowed before a ban triggers. 5 is a reasonable default.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Time window (seconds) &#8211; The rolling window in which failures are counted. 300 seconds (5 minutes) works for most stores.<\/span><\/p>\n<p><b>Ban time (seconds<\/b><span style=\"font-weight: 400;\">) &#8211; How long a banned IP stays blocked; it expires automatically.<\/span><\/p>\n<p><b>Whitelist IPs<\/b><span style=\"font-weight: 400;\"> &#8211; Addresses never counted toward the limit or banned.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Start with moderate values, check your login log after a week, and tighten if repeated attack patterns keep showing up from varied IPs. This works best paired with 2FA rather than alone &#8211; throttling slows attackers down, 2FA stops them outright even if a password is eventually guessed. Bans clear themselves once the timer runs out; there&#8217;s no need to manually unban anyone.<\/span><\/p>\n<h3><b>IP-Restricted Admin Access<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/IP-Protection.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836305\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/IP-Protection.png\" alt=\"\" width=\"1632\" height=\"671\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/IP-Protection.png 1632w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/IP-Protection-300x123.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/IP-Protection-1024x421.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/IP-Protection-768x316.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/IP-Protection-1536x632.png 1536w\" sizes=\"auto, (max-width: 1632px) 100vw, 1632px\" \/><\/a><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Restrict Admin Access by IP<\/b><span style=\"font-weight: 400;\">: Limits admin panel access to a specific list of trusted addresses.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>How It Works<\/b><span style=\"font-weight: 400;\">: Once enabled, only listed IPs can reach the admin panel; every other visitor is blocked, including anyone attempting to reach the login page. Your current IP is added automatically the moment you enable this option, so you won&#8217;t lock yourself out.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Allowed IPs (required)<\/b><span style=\"font-weight: 400;\">: Only addresses entered here are permitted through.<\/span><\/li>\n<\/ul>\n<h3><b>Admin Directory Cloaking<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Folder-Rename.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836298\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Folder-Rename.png\" alt=\"\" width=\"1627\" height=\"617\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Folder-Rename.png 1627w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Folder-Rename-300x114.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Folder-Rename-1024x388.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Folder-Rename-768x291.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Folder-Rename-1536x582.png 1536w\" sizes=\"auto, (max-width: 1627px) 100vw, 1627px\" \/><\/a><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Hide Admin Directory Name<\/b><span style=\"font-weight: 400;\">: Replaces your real back-office URL with a secret alias, removing your store from the pool of sites automated scanners find by guessing common admin paths.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>How It Works<\/b><span style=\"font-weight: 400;\">: When enabled, the direct admin URL returns a 404 response, and the panel is only reachable through the alias configured below.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Alias Name<\/b><span style=\"font-weight: 400;\">: 3 to 32 letters, digits, hyphens, or underscores. Treat this as a secret, the same as a password.<\/span><\/li>\n<\/ul>\n<h3><b>Server-Level Login Prompt (Admin)<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Authentication.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836303\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Authentication.png\" alt=\"\" width=\"1627\" height=\"867\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Authentication.png 1627w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Authentication-300x160.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Authentication-1024x546.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Authentication-768x409.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Authentication-1536x819.png 1536w\" sizes=\"auto, (max-width: 1627px) 100vw, 1627px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">Part of the <\/span><b>OpenCart password protection plugin<\/b><span style=\"font-weight: 400;\"> functionality built into this extension, this feature adds a browser-native authentication layer in front of the admin panel itself.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Enable HTTP Auth for the Admin<\/b><span style=\"font-weight: 400;\">: Adds a username\/password prompt before the admin login screen even loads.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Username \/ Password<\/b><span style=\"font-weight: 400;\">: Credentials for the prompt; the password is stored encrypted and never saved in plain text.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Whitelist IPs<\/b><span style=\"font-weight: 400;\">: Addresses that skip the prompt entirely.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Server Compatibility (PHP-FPM\/FastCGI)<\/b><span style=\"font-weight: 400;\">: Adds a directive needed on servers where the authentication header isn&#8217;t otherwise passed through correctly.<\/span><\/li>\n<\/ul>\n<h3><b>Login Monitoring<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Monitoring.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836306\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Monitoring.png\" alt=\"\" width=\"1622\" height=\"777\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Monitoring.png 1622w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Monitoring-300x144.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Monitoring-1024x491.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Monitoring-768x368.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Monitoring-1536x736.png 1536w\" sizes=\"auto, (max-width: 1622px) 100vw, 1622px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">A core feature of this <\/span><b>OpenCart login security plugin<\/b><span style=\"font-weight: 400;\">, this tab provides visibility into every admin login attempt made against your store.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Email on Successful Login<\/b><span style=\"font-weight: 400;\">: Sends a notification whenever an admin logs in successfully.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Notification Email<\/b><span style=\"font-weight: 400;\">: Where alerts are sent; defaults to your store&#8217;s email address if left blank.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Log Admin Login Attempts<\/b><span style=\"font-weight: 400;\">: Records the IP address, time, email, and outcome for every login attempt to a downloadable log.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Login Attempt Log<\/b><span style=\"font-weight: 400;\">: The log itself; download buttons activate once entries exist.<\/span><\/li>\n<\/ul>\n<h2><b>2.0.0 Storefront Protection<br \/>\n<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Storefront Protection covers everything a customer or a bot interacts with directly. This is where the firewall, CAPTCHA, and security-header functionality of this <\/span><b>OpenCart security extension<\/b><span style=\"font-weight: 400;\"> all work side by side, each addressing a different customer-facing threat.<\/span><\/p>\n<h3><b>Web Application Firewall<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-WAF.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836301\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-WAF.png\" alt=\"\" width=\"1612\" height=\"480\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-WAF.png 1612w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-WAF-300x89.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-WAF-1024x305.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-WAF-768x229.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-WAF-1536x457.png 1536w\" sizes=\"auto, (max-width: 1612px) 100vw, 1612px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">Functioning as a dedicated <\/span><b>OpenCart firewall extension<\/b><span style=\"font-weight: 400;\">, this feature automatically blocks requests carrying known SQL injection, cross-site scripting, or path-traversal patterns before they reach the storefront&#8217;s own code. No configuration is required beyond enabling it.<\/span><\/p>\n<h3><b>Security Response Headers<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Security-Headers.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836304\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Security-Headers.png\" alt=\"\" width=\"1627\" height=\"852\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Security-Headers.png 1627w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Security-Headers-300x157.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Security-Headers-1024x536.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Security-Headers-768x402.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HTTP-Security-Headers-1536x804.png 1536w\" sizes=\"auto, (max-width: 1627px) 100vw, 1627px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">These settings add small, invisible instructions telling browsers how to handle your store safely. Most are safe to switch on and leave alone.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>XSS Protection<\/b><span style=\"font-weight: 400;\">: An older safeguard against a specific attack type. Modern browsers have better built-in protection, but leaving this on doesn&#8217;t hurt; think of it as a backup lock for older browsers.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Clickjack Protection<\/b><span style=\"font-weight: 400;\">: Stops other sites from secretly displaying your store inside a hidden frame, a trick sometimes used to fool visitors into clicking things they didn&#8217;t mean to.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Content Sniffing Protection<\/b><span style=\"font-weight: 400;\">: Tells browsers to trust the file type your store declares instead of guessing, closing a path attackers sometimes exploit.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>HTTPS-Only Browsing (HSTS)<\/b><span style=\"font-weight: 400;\">: Tells browsers to always use the secure, encrypted version of your site, never the unsecured one.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Include Subdomains \/ Preload<\/b><span style=\"font-weight: 400;\">: Extends that rule to any subdomains you use, and can optionally register your store on a global list browsers check automatically.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Referrer Policy<\/b><span style=\"font-weight: 400;\">: Limits how much information browsers share about where a visitor came from when they click a link away from your store.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Permissions Policy<\/b><span style=\"font-weight: 400;\">: Controls which device features (camera, microphone, etc.) your store&#8217;s pages can request in a visitor&#8217;s browser.<\/span><\/li>\n<\/ul>\n<h3><b>Form Spam Filtering<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836300\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection.png\" alt=\"\" width=\"1627\" height=\"892\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection.png 1627w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection-300x164.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection-1024x561.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection-768x421.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection-1536x842.png 1536w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Spam-Protection-750x410.png 750w\" sizes=\"auto, (max-width: 1627px) 100vw, 1627px\" \/><\/a><\/p>\n<p><strong>1.0 Captcha<\/strong><\/p>\n<p><span style=\"font-weight: 400;\">As a built-in <\/span><b>OpenCart spam protection extension<\/b><span style=\"font-weight: 400;\"> and <\/span><b>OpenCart captcha extension<\/b><span style=\"font-weight: 400;\">, this feature keeps bots and spammers from flooding your contact and registration forms with junk submissions. It works with providers including Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha, each verifying that a real visitor, not a bot, is submitting your form.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Enable Spam Protection<\/b><span style=\"font-weight: 400;\">: Adds a CAPTCHA check to your contact and registration forms, verified server-side so it can&#8217;t be bypassed.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Provider<\/b><span style=\"font-weight: 400;\">: Choose Turnstile, reCAPTCHA, or hCaptcha; each works a little differently, but all block automated spam.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Site Key \/ Secret Key<\/b><span style=\"font-weight: 400;\">: Codes from your chosen provider that connect your store securely.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Widget Theme<\/b><span style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">: Controls how the CAPTCHA box looks (Auto, Light, or Dark).<\/span><\/span><\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>2. [New] Honeypot Field<\/strong><\/p>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HoneyPot-Field.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836403\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HoneyPot-Field.png\" alt=\"\" width=\"1622\" height=\"622\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HoneyPot-Field.png 1622w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HoneyPot-Field-300x115.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HoneyPot-Field-1024x393.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HoneyPot-Field-768x295.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/HoneyPot-Field-1536x589.png 1536w\" sizes=\"auto, (max-width: 1622px) 100vw, 1622px\" \/><\/a><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">The Honeypot Field feature strengthens frontend security by embedding hidden fields within selected storefront forms. These fields stay completely invisible to human visitors, but any bot that automatically fills out every field on a form gives itself away instantly and gets blocked. It&#8217;s a low-overhead way to cut down on spam submissions, fraudulent account creation, and bot-driven login attempts, without adding any friction to the checkout or browsing experience for real shoppers.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Enable Honeypot:<\/strong> Switches Honeypot protection on for your store. Once active, a concealed field is silently inserted into each form you&#8217;ve selected below. Any submission where that hidden field gets filled in is flagged as bot activity and rejected before it reaches your database.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Protected Forms:<\/strong> Select which storefront forms Honeypot should guard. Available options include:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Registration: <\/strong>Prevents bots from mass-creating fake customer accounts.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Login: <\/strong>huts down scripted login attempts and credential-stuffing attacks.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Contact: <\/strong>Keeps your inbox free of bot-generated spam inquiries.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Newsletter:<\/strong>\u00a0Blocks fake or automated subscription attempts. <em>Note: Availability depends on your newsletter setup and active theme. If the form can&#8217;t be detected on a page, this protection is simply bypassed for that page.<\/em><\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Product Reviews: <\/strong>Shields your review\/comment forms from spam entries. <em>Note: Requires the Product Review module to be present; if the form isn&#8217;t detected due to theme differences, protection is skipped automatically.<\/em><\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>3.0 Project Honeypot<\/strong><\/p>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Project-HoneyPot.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836404\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Project-HoneyPot.png\" alt=\"\" width=\"1612\" height=\"852\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Project-HoneyPot.png 1612w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Project-HoneyPot-300x159.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Project-HoneyPot-1024x541.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Project-HoneyPot-768x406.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Project-HoneyPot-1536x812.png 1536w\" sizes=\"auto, (max-width: 1612px) 100vw, 1612px\" \/><\/a><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Enable Project Honeypot:<\/strong> The master switch for this entire module. Turning it on means every incoming visitor&#8217;s IP address gets checked against Http:BL \u2014 Project Honeypot&#8217;s DNS-based reputation database \u2014 the moment they land on a page. Unlike the form-based Honeypot field, which only triggers on submission, this check happens proactively, before the visitor interacts with anything.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Access Key:<\/strong> A 12-character lowercase code assigned by Project Honeypot that links your HTTP:BL queries back to your registered account. It isn&#8217;t a security credential in the traditional sense \u2014 it can&#8217;t be used to access anything, it functions more like an attribution token so the service knows which site is making the request.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Observer-Only Mode:<\/strong> Runs the IP lookups and logs every classification, but takes no blocking action. Use this mode first to collect data and understand your traffic patterns before enforcing anything.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Log Scope:<\/strong> Determines the volume of data written to the Classification Log.<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Flagged IPs only<\/strong> \u2013 A leaner option that records just the visitors Http:BL flags as risky.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>All visitors<\/strong> \u2013 Captures every classification, including &#8220;Safe&#8221; entries, giving you a fuller picture of your overall traffic reputation. Because this fills up faster, records are automatically cleared after 7 days.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Ban Duration (seconds):<\/strong> Applies once you switch to Action Mode. Determines how long a flagged IP remains blocked before it can attempt access again.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Whitelist IPs:<\/strong> Add specific IP addresses here to exempt them from blocking entirely, regardless of what Http:BL reports.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Classification Log:<\/strong> A record of each visitor&#8217;s IP, its assigned classification (Safe, Suspicious, Harvester, or Comment Spammer), and whether the action taken was observation only or an actual block. Reviewing this log during the Observer phase helps you catch any false positives before committing to Action Mode<\/p>\n<h3><b>Content Protection<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Content-Protection.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836299\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Content-Protection.png\" alt=\"\" width=\"1675\" height=\"837\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Content-Protection.png 1675w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Content-Protection-300x150.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Content-Protection-1024x512.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Content-Protection-768x384.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Frontend-Content-Protection-1536x768.png 1536w\" sizes=\"auto, (max-width: 1675px) 100vw, 1675px\" \/><\/a><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Enable Content Protection<\/b><span style=\"font-weight: 400;\">: Master toggle. This works as a deterrent only; a determined visitor can still bypass it using their browser&#8217;s developer tools.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Disable Copy\/Cut\/Paste<\/b><span style=\"font-weight: 400;\">: Blocks the keyboard shortcuts visitors would use to copy or paste page content.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Disable View Source (Ctrl+U)<\/b><span style=\"font-weight: 400;\">: Blocks the shortcut for viewing a page&#8217;s source code.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Disable Right-Click Menu<\/b><span style=\"font-weight: 400;\">: Removes the context menu visitors could use to save images or copy content.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Disable Text Selection<\/b><span style=\"font-weight: 400;\">: Prevents highlighting or selecting text on the page.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Disable DevTools\/Inspect (F12)<\/b><span style=\"font-weight: 400;\">: Blocks the F12, Ctrl+Shift+I, and Ctrl+Shift+J shortcuts. Does not stop someone from opening DevTools through the browser&#8217;s own menu.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Whitelist IPs (Staff)<\/b><span style=\"font-weight: 400;\">: Addresses that bypass all content-protection restrictions.<\/span><\/li>\n<\/ul>\n<h3><b>Storefront-Wide Login Prompt<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Another layer of this <\/span><b>OpenCart password protection plugin<\/b><span style=\"font-weight: 400;\">, this feature gates the entire storefront behind a browser-level username\/password prompt, separate from the admin-side prompt described in Section 6.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Enable HTTP Auth for the Storefront<\/b><span style=\"font-weight: 400;\">: Adds a password prompt before any storefront page can be viewed.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Username \/ Password<\/b><span style=\"font-weight: 400;\">: Storefront-specific credentials, stored encrypted.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Whitelist IPs<\/b><span style=\"font-weight: 400;\">: Addresses that skip the storefront prompt entirely.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">This is meant to keep a pre-launch or staging store private from search engines and casual visitors. The friction here is intentional, unlike the admin-side prompt. If the prompt keeps looping even with correct credentials on a PHP-FPM\/FastCGI server, enable the compatibility setting under Admin Protection to resolve it; that setting applies to both the admin and storefront prompts.<\/span><\/p>\n<h2><b>3.0.0 File Integrity Monitoring<\/b><\/h2>\n<h3><b>Settings<\/b><\/h3>\n<p><a href=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Anti-Malware-frontend.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-836295\" src=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Anti-Malware-frontend.png\" alt=\"\" width=\"1667\" height=\"717\" srcset=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Anti-Malware-frontend.png 1667w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Anti-Malware-frontend-300x129.png 300w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Anti-Malware-frontend-1024x440.png 1024w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Anti-Malware-frontend-768x330.png 768w, https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/Anti-Malware-frontend-1536x661.png 1536w\" sizes=\"auto, (max-width: 1667px) 100vw, 1667px\" \/><\/a><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Enable File Integrity Monitoring<\/b><span style=\"font-weight: 400;\">: Master toggle; when off, the scan endpoint returns immediately without scanning anything.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Email Alert on New Threats<\/b><span style=\"font-weight: 400;\">: Sends an alert to the admin email whenever a scan finds something new or modified. Repeat alerts for known false positives are automatically suppressed.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Exclude Paths<\/b><span style=\"font-weight: 400;\">: Relative paths, one per line, to skip during scanning, useful for suppressing known false positives such as vendor directories.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Cron URL<\/b><span style=\"font-weight: 400;\">: A unique, token-protected URL that triggers a scan whenever your scheduler requests it.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">To configure this correctly: enable the feature, turn on email alerts, and add the cron URL to your hosting control panel&#8217;s scheduled tasks (or your own crontab), typically scheduled for off-peak hours such as 2 a.m. Alerts fire only for genuinely new or changed threats. Once a file has been seen and either excluded or acknowledged, repeat alerts for that item are suppressed.<\/span><\/p>\n<h3><b>Scan History<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>ID<\/b><span style=\"font-weight: 400;\">: Sequential identifier for each scan run.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Date<\/b><span style=\"font-weight: 400;\">: When the scan was executed.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Triggered By<\/b><span style=\"font-weight: 400;\">: Manual or scheduled (cron).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Files Scanned<\/b><span style=\"font-weight: 400;\">: Total files checked in that run.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Threats<\/b><span style=\"font-weight: 400;\">: Number of new or modified files flagged.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Duration<\/b><span style=\"font-weight: 400;\">: How long the scan took.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Status<\/b><span style=\"font-weight: 400;\">: Completion state.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>View Report<\/b><span style=\"font-weight: 400;\">: Opens the detailed findings for that scan.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">This tab is purely historical and filterable by date range. No configuration is needed. Review your reports after the first few scheduled scans to learn what&#8217;s &#8220;normal&#8221; for your store, since most sites see a handful of flagged files tied to routine theme or extension updates. Once that baseline is established, genuinely unusual findings will stand out more clearly. Investigate any scan where the threat count jumps well past your baseline, even if individual files don&#8217;t look obviously malicious at first glance. That&#8217;s often exactly what an early-stage compromise looks like<\/span><\/p>\n<h2><strong>Conclusion<\/strong><\/h2>\n<p><span style=\"font-weight: 400;\"><a href=\"https:\/\/www.knowband.com\/opencart-advanced-security-manager\">OpenCart Advanced Security Manager<\/a> brings together the protections most stores end up needing piecemeal &#8211; two-step verification, login throttling, a firewall, CAPTCHA, and file-integrity scanning &#8211; into one centrally configured screen. Set up thoughtfully, starting with login monitoring and the emergency recovery link before layering on more restrictive controls, it meaningfully cuts down the most common attack paths against OpenCart stores without adding friction for real customers or your own team.<\/span><\/p>\n<p>The OpenCart Advanced Security Manager is also available on the OpenCart Marketplace, and store owners can access it the module by clicking <a href=\"https:\/\/www.opencart.com\/index.php?route=marketplace\/extension\/info&amp;extension_id=48654\">here<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Most OpenCart store owners end up securing their site the hard way: one extension for two-step login verification, another for blocking spammy bots, a third for CAPTCHA, and maybe a support ticket to their host about a firewall. OpenCart Security Manager was developed to remove that patchwork. This module puts admin-side protection, storefront defense, and [&hellip;]<\/p>\n","protected":false},"author":41,"featured_media":836513,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_kbui_enabled":"","footnotes":""},"categories":[51,48],"tags":[50503,50510,50508,50509,50505,50514,50506,50512,50511,50513,50516,50502,50515,48425,50504,50507],"class_list":["post-836293","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-opencart-user-manual","category-user-manual","tag-opencart-2fa-extension","tag-opencart-admin-security-extension","tag-opencart-brute-force-extension","tag-opencart-brute-force-protection-plugin","tag-opencart-captcha-extension","tag-opencart-content-protection-extension","tag-opencart-firewall-extension","tag-opencart-ip-restriction-extension","tag-opencart-login-security-extension","tag-opencart-password-protection-extension","tag-opencart-secure-backend-plugin","tag-opencart-security-extension","tag-opencart-security-headers-extension","tag-opencart-spam-protection-extension","tag-opencart-two-factor-authentication-extension","tag-opencart-waf-extension"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>OpenCart Advanced Security Manager Extension | User Guide<\/title>\n<meta name=\"description\" content=\"Secure your OpenCart store with Advanced Security Manager, add 2FA, malware &amp; brute-force protection. Easy setup, real-time protection. Try it now!\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OpenCart Advanced Security Manager Extension | User Guide\" \/>\n<meta property=\"og:description\" content=\"Secure your OpenCart store with Advanced Security Manager, add 2FA, malware &amp; brute-force protection. Easy setup, real-time protection. Try it now!\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/\" \/>\n<meta property=\"og:site_name\" content=\"Knowband Blog | Ecommerce Modules\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Knowband\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-06T11:39:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-04T12:04:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"760\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Olivia Smith\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@KnowbandPlugin\" \/>\n<meta name=\"twitter:site\" content=\"@KnowbandPlugin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Olivia Smith\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/\"},\"author\":{\"name\":\"Olivia Smith\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#\\\/schema\\\/person\\\/d06d387c1a539103dd802941df1953c0\"},\"headline\":\"OpenCart Advanced Security Manager Extension &#8211; Complete User Guide (Updated)\",\"datePublished\":\"2026-07-06T11:39:42+00:00\",\"dateModified\":\"2026-08-04T12:04:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/\"},\"wordCount\":4072,\"publisher\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg\",\"keywords\":[\"OpenCart 2FA Extension\",\"OpenCart Admin Security Extension\",\"OpenCart Brute Force Extension\",\"OpenCart Brute Force Protection Plugin\",\"OpenCart CAPTCHA Extension\",\"OpenCart Content Protection Extension\",\"OpenCart Firewall Extension\",\"OpenCart IP Restriction Extension\",\"OpenCart Login Security Extension\",\"OpenCart Password Protection Extension\",\"OpenCart Secure Backend Plugin\",\"OpenCart Security Extension\",\"OpenCart Security Headers Extension\",\"OpenCart spam protection extension\",\"OpenCart Two Factor Authentication Extension\",\"OpenCart WAF Extension\"],\"articleSection\":[\"Opencart User Manual\",\"User Manual\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/\",\"url\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/\",\"name\":\"OpenCart Advanced Security Manager Extension | User Guide\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg\",\"datePublished\":\"2026-07-06T11:39:42+00:00\",\"dateModified\":\"2026-08-04T12:04:51+00:00\",\"description\":\"Secure your OpenCart store with Advanced Security Manager, add 2FA, malware & brute-force protection. Easy setup, real-time protection. Try it now!\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg\",\"width\":760,\"height\":300,\"caption\":\"OpenCart Advanced Security Manager Extension by Knowband User Manual\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/user-manual\\\/opencart-advanced-security-manager-extension\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OpenCart Advanced Security Manager Extension &#8211; Complete User Guide (Updated)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#website\",\"url\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/\",\"name\":\"Knowband Blog | Ecommerce Modules\",\"description\":\"Magento, Prestashop, Opencart, Shopify\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#organization\",\"name\":\"Knowband Blog | Ecommerce Modules\",\"url\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/09\\\/cropped-knowband_logo-v2.png\",\"contentUrl\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/09\\\/cropped-knowband_logo-v2.png\",\"width\":153,\"height\":61,\"caption\":\"Knowband Blog | Ecommerce Modules\"},\"image\":{\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Knowband\",\"https:\\\/\\\/x.com\\\/KnowbandPlugin\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/fr\\\/#\\\/schema\\\/person\\\/d06d387c1a539103dd802941df1953c0\",\"name\":\"Olivia Smith\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/plugins\\\/wp-user-avatar\\\/deprecated\\\/wp-user-avatar\\\/images\\\/wpua-96x96.png\",\"url\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/plugins\\\/wp-user-avatar\\\/deprecated\\\/wp-user-avatar\\\/images\\\/wpua-96x96.png\",\"contentUrl\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/wp-content\\\/plugins\\\/wp-user-avatar\\\/deprecated\\\/wp-user-avatar\\\/images\\\/wpua-96x96.png\",\"caption\":\"Olivia Smith\"},\"description\":\"Olivia ist eCommerce-Technikberaterin bei Knowband und unterst\u00fctzt H\u00e4ndler dabei, das Beste aus Plattformen wie PrestaShop, Shopify, Magento, WooCommerce und OpenCart herauszuholen. Ihre Beitr\u00e4ge reichen von der Plugin-Einrichtung \u00fcber die Shop-Anpassung bis hin zu Performance und Fehlerbehebung \u2013 immer mit dem Ziel, Shopbetreibern praktisches, direkt umsetzbares technisches Wissen zu vermitteln. Bei Knowband sind wir Experten der eCommerce-Branche mit Schwerpunkt auf der Entwicklung von Plugins. Mit langj\u00e4hriger Erfahrung bieten wir die besten Plugins f\u00fcr Plattformen wie Magento, PrestaShop, OpenCart und Shopify. Zudem entwickeln und passen wir Module individuell f\u00fcr Websites und Onlineshops an. Unser Team bleibt stets auf dem neuesten Stand der Branchentrends und liefert innovative L\u00f6sungen zur Verbesserung der Funktionalit\u00e4t von eCommerce-Websites. Mit einem kundenorientierten Ansatz ist Knowband ein vertrauensw\u00fcrdiger Partner f\u00fcr eCommerce-Plugin-L\u00f6sungen.\",\"url\":\"https:\\\/\\\/www.knowband.com\\\/blog\\\/author\\\/olivia\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OpenCart Advanced Security Manager Extension | User Guide","description":"Secure your OpenCart store with Advanced Security Manager, add 2FA, malware & brute-force protection. Easy setup, real-time protection. Try it now!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/","og_locale":"en_US","og_type":"article","og_title":"OpenCart Advanced Security Manager Extension | User Guide","og_description":"Secure your OpenCart store with Advanced Security Manager, add 2FA, malware & brute-force protection. Easy setup, real-time protection. Try it now!","og_url":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/","og_site_name":"Knowband Blog | Ecommerce Modules","article_publisher":"https:\/\/www.facebook.com\/Knowband","article_published_time":"2026-07-06T11:39:42+00:00","article_modified_time":"2026-08-04T12:04:51+00:00","og_image":[{"width":760,"height":300,"url":"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg","type":"image\/jpeg"}],"author":"Olivia Smith","twitter_card":"summary_large_image","twitter_creator":"@KnowbandPlugin","twitter_site":"@KnowbandPlugin","twitter_misc":{"Written by":"Olivia Smith","Est. reading time":"21 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/#article","isPartOf":{"@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/"},"author":{"name":"Olivia Smith","@id":"https:\/\/www.knowband.com\/blog\/fr\/#\/schema\/person\/d06d387c1a539103dd802941df1953c0"},"headline":"OpenCart Advanced Security Manager Extension &#8211; Complete User Guide (Updated)","datePublished":"2026-07-06T11:39:42+00:00","dateModified":"2026-08-04T12:04:51+00:00","mainEntityOfPage":{"@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/"},"wordCount":4072,"publisher":{"@id":"https:\/\/www.knowband.com\/blog\/fr\/#organization"},"image":{"@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/#primaryimage"},"thumbnailUrl":"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg","keywords":["OpenCart 2FA Extension","OpenCart Admin Security Extension","OpenCart Brute Force Extension","OpenCart Brute Force Protection Plugin","OpenCart CAPTCHA Extension","OpenCart Content Protection Extension","OpenCart Firewall Extension","OpenCart IP Restriction Extension","OpenCart Login Security Extension","OpenCart Password Protection Extension","OpenCart Secure Backend Plugin","OpenCart Security Extension","OpenCart Security Headers Extension","OpenCart spam protection extension","OpenCart Two Factor Authentication Extension","OpenCart WAF Extension"],"articleSection":["Opencart User Manual","User Manual"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/","url":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/","name":"OpenCart Advanced Security Manager Extension | User Guide","isPartOf":{"@id":"https:\/\/www.knowband.com\/blog\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/#primaryimage"},"image":{"@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/#primaryimage"},"thumbnailUrl":"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg","datePublished":"2026-07-06T11:39:42+00:00","dateModified":"2026-08-04T12:04:51+00:00","description":"Secure your OpenCart store with Advanced Security Manager, add 2FA, malware & brute-force protection. Easy setup, real-time protection. Try it now!","breadcrumb":{"@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/#primaryimage","url":"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg","contentUrl":"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2026\/07\/OpenCart-Security-Manager-Extension-Complete-User-Guide-1.jpg","width":760,"height":300,"caption":"OpenCart Advanced Security Manager Extension by Knowband User Manual"},{"@type":"BreadcrumbList","@id":"https:\/\/www.knowband.com\/blog\/user-manual\/opencart-advanced-security-manager-extension\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.knowband.com\/blog\/fr\/"},{"@type":"ListItem","position":2,"name":"OpenCart Advanced Security Manager Extension &#8211; Complete User Guide (Updated)"}]},{"@type":"WebSite","@id":"https:\/\/www.knowband.com\/blog\/fr\/#website","url":"https:\/\/www.knowband.com\/blog\/fr\/","name":"Knowband Blog | Ecommerce Modules","description":"Magento, Prestashop, Opencart, Shopify","publisher":{"@id":"https:\/\/www.knowband.com\/blog\/fr\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.knowband.com\/blog\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.knowband.com\/blog\/fr\/#organization","name":"Knowband Blog | Ecommerce Modules","url":"https:\/\/www.knowband.com\/blog\/fr\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.knowband.com\/blog\/fr\/#\/schema\/logo\/image\/","url":"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2016\/09\/cropped-knowband_logo-v2.png","contentUrl":"https:\/\/www.knowband.com\/blog\/wp-content\/uploads\/2016\/09\/cropped-knowband_logo-v2.png","width":153,"height":61,"caption":"Knowband Blog | Ecommerce Modules"},"image":{"@id":"https:\/\/www.knowband.com\/blog\/fr\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Knowband","https:\/\/x.com\/KnowbandPlugin"]},{"@type":"Person","@id":"https:\/\/www.knowband.com\/blog\/fr\/#\/schema\/person\/d06d387c1a539103dd802941df1953c0","name":"Olivia Smith","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.knowband.com\/blog\/wp-content\/plugins\/wp-user-avatar\/deprecated\/wp-user-avatar\/images\/wpua-96x96.png","url":"https:\/\/www.knowband.com\/blog\/wp-content\/plugins\/wp-user-avatar\/deprecated\/wp-user-avatar\/images\/wpua-96x96.png","contentUrl":"https:\/\/www.knowband.com\/blog\/wp-content\/plugins\/wp-user-avatar\/deprecated\/wp-user-avatar\/images\/wpua-96x96.png","caption":"Olivia Smith"},"description":"Olivia ist eCommerce-Technikberaterin bei Knowband und unterst\u00fctzt H\u00e4ndler dabei, das Beste aus Plattformen wie PrestaShop, Shopify, Magento, WooCommerce und OpenCart herauszuholen. Ihre Beitr\u00e4ge reichen von der Plugin-Einrichtung \u00fcber die Shop-Anpassung bis hin zu Performance und Fehlerbehebung \u2013 immer mit dem Ziel, Shopbetreibern praktisches, direkt umsetzbares technisches Wissen zu vermitteln. Bei Knowband sind wir Experten der eCommerce-Branche mit Schwerpunkt auf der Entwicklung von Plugins. Mit langj\u00e4hriger Erfahrung bieten wir die besten Plugins f\u00fcr Plattformen wie Magento, PrestaShop, OpenCart und Shopify. Zudem entwickeln und passen wir Module individuell f\u00fcr Websites und Onlineshops an. Unser Team bleibt stets auf dem neuesten Stand der Branchentrends und liefert innovative L\u00f6sungen zur Verbesserung der Funktionalit\u00e4t von eCommerce-Websites. Mit einem kundenorientierten Ansatz ist Knowband ein vertrauensw\u00fcrdiger Partner f\u00fcr eCommerce-Plugin-L\u00f6sungen.","url":"https:\/\/www.knowband.com\/blog\/author\/olivia\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/posts\/836293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/comments?post=836293"}],"version-history":[{"count":5,"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/posts\/836293\/revisions"}],"predecessor-version":[{"id":836572,"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/posts\/836293\/revisions\/836572"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/media\/836513"}],"wp:attachment":[{"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/media?parent=836293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/categories?post=836293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.knowband.com\/blog\/wp-json\/wp\/v2\/tags?post=836293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}