Storefront Password Protection and Login
To prevent shoppers from finding your storefront during development and testing, restrict access. Limit storefront access to merchants and other people involved in the project. This limit prevents crawlers and search engine robots from indexing your storefront and making it available to search engines. Both dynamic content, such as pages, and static content, such as images, are protected.
Configure a storefront password on Business Manager that requires authentication of users trying to access the storefront. This feature blocks access to both dynamic pages and static pages. If a site is storefront protected and the storefront user hasn't provided the appropriate credentials, an HTTP response 403 (Access Forbidden) is returned.
When a shopper or user tries to access a storefront that is in the development stage and has password protection enabled, an Authentication Required window opens. See Setting Protection Flags and Assigning Passwords to learn how to enable or disable storefront password protection.
Business Manager users with the functional permission
Access_Protected_Storefront can always log on to the storefront. To let other users access the
Storefront, create a shared login. The default username is storefront
, though
you must assign your own password ( to be entered for an authentication request). The
storefront administrator sets the flag and password through Business Manager.
When a shopper forgets their password and asks for a reset, the password reset token expiration period is 30 minutes.
Storefront Default Password Requirements
The default requirements for storefront passwords (managed via customerlists) are as follows:
- Minimum password length: 8
- Minimum number of special characters: 1
- Must contain letters: true
- Multiple letters must be of mixed case: true
- Must contain numbers: from false to true: true
Sites with customerlists created before Release 17.5 retain the previous defaults if the settings were not configured, as follows:
- Minimum password length: 1
- Minimum number of special characters: 0
- Must contain letters: false
- Multiple letters must be of mixed case: false
- Must contain numbers: false
If these settings were configured before Release 17.5, the existing settings are retained.
The API enables you to perform password checks and obtain the constraints for display to the customer, as follows:
boolean : dw.customer.CustomerMgr.isAcceptablePassword(String password)
dw.customer.CustomerPasswordConstraints :
dw.customer.CustomerMgr.getPasswordConstraints()