1. Home
  2. Magento® 2 Extensions
  3. Fraud/Security
  4. Security
Free installation badge Product image of Security
Standard
User Guide
Professional
User Guide
Installation
Installation Guide
Magento Edition *
Version * Compare versions
FREE installation Tooltip
Ends in:
03 : 00 : 00 : 00
Get 10% OFF
$99
icon logo magento 2.4.4 - 2.4.8
Tooltip
Hyva logo Theme
Tooltip

Security Extension for Magento 2

v4.1.0
5.0
(28 reviews)
Read all >
The Magento 2 Security extension protects your store from hacking attempts, brute-force attacks, and bot traffic with layered security measures. From security checklists and activity monitoring to two-factor authentication and Google reCAPTCHA, it helps secure both the admin panel and customer areas while maintaining a smooth shopping experience.
tick icon
Compatible with Hyva theme
tick icon
Compatible with Magento 2.4.8
tick icon
Compatible with API/GraphQL
Free Installation
60 days money back guarantee
Hightlight Features of Magento 2 Security Extension
Identify risks with a security checklist
Dectect abnormal login behavior with login log grid

The importance of a robust security solution

The Importance of a Robust Security Solution

Monitor security activity across your Magento store

Keep an eye on security activity in your Magento store and understand what’s happening behind the scenes. It gives you better visibility into important events, so you can stay aware and react quickly when something looks unusual.

Security checklist
Inspect all login logs
View all action logs Pro
Check file changes Pro
Built-in security checklist

Provide a quick security checklist

The Magento 2 Security extension offers a built-in security checklist that helps you quickly identify common risks. It checks important areas like admin usernames, CAPTCHA settings, Magento version, and database prefix configuration, so you can spot vulnerabilities early and keep your store protected without technical hassle.
Inspect all login logs

Inspect all login logs

Our Security module records all admin and customer login attempts, including time, username, IP address, browser, URL, and login status. With these logs, you can quickly review suspicious activity, trace unusual IPs, and take action such as strengthening passwords, enabling two-factor authentication, or blocking risky access.
Track what admins do in the backend with action logs

View all action logs Pro

Action logs let you track what admins do in the backend, such as saving settings, editing data, or making system changes. Each record includes time, IP address, username, and action details, so you can review recent changes and investigate errors. Logs can also be compressed and backed up to reduce performance impact.
Review file changes with alerts

Check file changes Pro

Monitor critical system files and detect any unexpected changes in the backend. Magento 2 Security extension scans files using secure hashes to identify additions, edits, or deletions, records them in the admin log, and sends alerts when changes are found. This helps you spot potential hacks early and protect your store from hidden threats.

Protect admin access with two-factor authentication

Add an extra layer of protection with two-factor authentication. Admin accounts remain protected even when passwords are compromised, reducing unauthorized access without disrupting daily workflows.

Two-factor authentication for admin accounts
Remember trusted devices for a set period
Enable two-factor authentication for admin accounts

Two-factor authentication for admin accounts

Require admin users to complete two verification steps before accessing the backend. After entering a username and password, admins must provide a unique authentication code to continue. If either step fails, access is denied, helping keep store data safe from unauthorized logins.
Remember trusted devices for a defined period

Remember trusted devices for a set period

Avoid repeated verification on trusted devices by marking them as secure for a set time, such as 30 or 60 days. All trusted devices are listed clearly with details like device name, IP address, location, and last login time, allowing you to review or remove any device at any time, ensuring ongoing control over admin access.

Block bots and spam with Google reCAPTCHA

Add Google reCAPTCHA to customer actions

Secure key customer actions with both visible and invisible reCAPTCHA. Visible challenges appear only when needed, such as during login or product reviews, while invisible reCAPTCHA runs silently in the background to detect abusive behavior.
Apply visible or invisible reCAPTCHA to customer actions
Add reCAPTCHA to common frontend forms

Apply reCAPTCHA to any forms

Easily enable Google reCAPTCHA on common frontend forms, including login, registration, forgot password, contact, product reviews, blog comments, and FAQ submissions. By verifying real users, you can prevent fake accounts, spam messages, and automated attacks across your store.

Enable reCAPTCHA for admin access

Extend bot protection to the Magento backend by enabling reCAPTCHA for admin login and password recovery. This prevents automated attacks targeting your admin panel and helps ensure that only legitimate users can request access or reset credentials.
Apply Google reCAPTCHA for admin access

More features of Magento 2 Security extension

Away mode Pro

Away Mode temporarily blocks all login attempts when admins are unavailable, such as during nights, holidays, or maintenance periods. Both customer and admin logins are restricted, helping reduce the risk of break-ins without constant monitoring. Admins can easily schedule the active period and disable Away Mode when needed.

Limit failed login attempts

Set limits on how many failed login attempts are allowed within a defined time frame. When the limit is exceeded, access is automatically restricted and store owners are notified, helping you detect and respond to potential brute-force attacks early.

Warning emails

Our Security module proactively safeguards your store by instantly alerting you via email to any suspicious activity, such as:
check
Compromised login attempts (potential hacking attempts)
check
File changes that may indicate malware or unauthorized access

Blacklist/whitelist IPS

This feature allows you to create lists of allowed and blocked IP addresses, preventing external attacks and protecting your data. Simply enter the forbidden IP addresses into the Blacklist field and the allowed IP addresses into the Whitelist field.

Action log backup

Action logs are backed up frequently to prevent data loss. You can set the update frequency for action logs (daily, weekly, or monthly) and clear the log after each backup in the backend.

What customers say about us

Product reviews: 28
Overall rating: 5.0
5
4
3
2
1
4.8
frame
Read all reviews
How much do you like this product?
Leave your email to get reward points for reviews
Submit a relevant review of 30+ words to earn 5 reward points (one-time per extension)
Darwin
31 January 2024
Verified purchase
walter
21 December 2022
Verified purchase
Chelto
02 May 2022
Verified purchase
Huestis
19 April 2022
Verified purchase
faraz bashir
16 April 2021
Verified purchase

Release notes

  • v4.1.0 (Magento v2.4.x)

    25 December 2025

    • New Feature: Added new feature Google Recaptcha
    • New Feature: Added new feature Two-Factor Authentication

  • v4.0.6 (Magento v2.4.x)

    27 April 2025

    Standard:

    • Compatibility: Now compatible with Magento 2.4.8

    Professional:

    • Compatibility: Now compatible with Magento 2.4.8

  • v4.0.5 (Magento v2.4.x)

    31 May 2024

    Standard:

    • Compatibility: Now compatible with Magento 2.4.7

    Professional:

    • Compatibility: Now compatible with Magento 2.4.7

  • v4.0.4 (Magento v2.4.x)

    21 May 2023

    • Compatibility: The extension is now compatible with Magento 2.4.6

  • v4.0.3 (Magento v2.4.x)

    30 August 2022

    • Compatibility: The extension is now compatible with Magento 2.4.4

  • v4.0.2 (Magento v2.4.x)

    25 October 2021

    • Compatibility: The extension is now compatible with Magento 2.4.3
    • New Feature: We added Clear Login Logs
    • Bug Fix: We fixed minor bugs

  • v1.1.7 (Magento v2.3.x)

    25 October 2021

    • Compatible with Magento v2.3.7
    • Added Clear Login Logs
    • Fixed minor bugs

  • v4.0.1 (Magento v2.4.x)

    25 May 2021

    • Compatible with Magento v2.4.2

  • v4.0.0 (Magento v2.4.x)

    10 November 2020

    • Supported Magento v2.4

  • v1.1.6 (Magento v2.3.x)

    29 June 2020

    • Fixed minor bugs

  • v1.1.5 (Magento v2.3.x)

    30 December 2019

    • Fixed minor bugs
    • Improved code style & performance

  • v1.1.4 (Magento v2.3.x)

    26 June 2019

    Compatible with Magento 2.3.1

  • v1.1.3 (Magento v2.3.x)

    13 August 2018

    • Update Module license

    Security Pro

    • Fixed error when compiling module on Magento 2.2

  • v1.1.2 (Magento v2.3.x)

    06 April 2018

    • Update email template “lock-user”

  • v1.1.1 (Magento v2.3.x)

    02 April 2018

    Fix bug get wrong IP address if server use Varnish Cache

  • v1.1.0 (Magento v2.3.x)

    29 March 2018

    • Add Checklist feature
    • Add Module Activation
    • Move backend module menu to Magento System menu

  • v1.0.0 (Magento v2.3.x)

    14 March 2018

    Initial module v1.0.0

Load More

Frequently Asked Questions

You can enable the extension by following these steps:
Step 1: Go to Stores > Settings > Configuration > Mageplaza> Security.
Step 2: In the Enable field, choose Yes to turn the Security module on.
Step 3: Click on Save Config to save your changes.

With our extension, you can perform various actions to secure your website, like:
Setting up unrecognized admin panel login alerts
Restricting unauthorized access by creating a blacklist and whitelist IP addresses
Sending brute force attack email notifications to store owners

If the maximum number of times logins fail is reached, a warning email will be sent to email addresses that are set.

You sure can. It is easy to customize warning email templates in Magento 2. There are 4 steps to customize the email template. Read this step-by-step customize the email template guide now!

If you get locked out of your Magento 2 store, the module will automatically display all warnings of possible security risks and send messages to the email address. If you assume that this is a mistake, please follow our guide to unblock.

Exactly! It logs both Failure and Success status.

Mageplaza Security is compatible out-of-the-box with Magento Open (Community), Magento Commerce (Enterprise), Magento Cloud 2.2.x, 2.3.x, 2.4.x..

Yes, Security is compatible with Hyva theme. However, the checkout only supports hyva-themes/magento2-theme-fallback. To learn how to enable checkout on Hyva, please follow this guide.

Mageplaza provides FREE Hyva Checkout Compatibility for all of our extensions upon requests. You can request by contacting us via email, live chat, or support ticket. Our team will respond within 24 hours and ask for details such as Order ID, extension name, Magento & Hyva versions, and any special requirements. To qualify, your module subscription must be active. If your subscription has expired, renewal is required as some older modules do not support Hyva. Additional customization requests may incur extra costs, and our team will inform you before proceeding. For assistance, feel free to reach out - we're here to help!

Magento Edition *
Version * Compare versions
FREE installation Tooltip
Ends in:
03 : 00 : 00 : 00
Get 10% OFF
$99
icon logo magento 2.4.4 - 2.4.8
Tooltip
Hyva logo Theme
Tooltip

Pricing

Choose your suitable edition.

Standard

$ 99 first year
Includes support & updates for 1 year Tooltip
60 days money back guarantee
Read our policies
Features:
check
Supports for Magento 2 Community Edition (Magento Open Source)
check
Include Google reCaptcha
check
Include Two-factor Authentication

Professional

Most popular
$ 149 first year
Includes support & updates for 1 year Tooltip
60 days money back guarantee
Read our policies
Everything in Standard, plus:
check
File change detection
check
Away mode
check
Alert Emails
check
Blacklist/Whitelist IPs
Can't see the feature you're looking for?
Describe it and we will customize this extension to suit your needs!
Request customization
feature looking icon