A stolen admin password should not be enough.
The WordPress and PrestaShop login screen is the most attacked page on your whole site. BOLFAF installs and enforces two factor authentication, so every single admin sign in needs a code from an authenticator app — not just a password.
Powered by BOLFAF
How admin accounts actually fall
Nobody breaks into WordPress by guessing the login form. They take the password first, somewhere else.
Credential stuffing
Your admin email and password are almost certainly already in a breach. Bots replay known logins against every site they can reach, all day.
Hosting and backup leaks
A shared host, an exposed backup file or a stale database dump hands over a list of admin accounts for every site on that server.
Phishing and fake support
A convincing reset email, a plugin support form, a leaked session cookie. The password is one step in a chain the attacker already started.
The fix is unglamorous. A second factor that changes every thirty seconds turns a stolen password into a dead end. The attacker would need your phone as well.
How BOLFAF does it
We install it, we enforce it, and we get out of the way. You keep running your shop exactly as before.
-
01
You approve the install
We register your site and hand you access to the BOLFAF panel. You never hand over your admin password.
-
02
Every admin scans a code
Each of your staff scans a QR code once with Google Authenticator, Authy or 1Password. That is their setup, finished.
-
03
Every login demands a code
From then on, a password on its own opens nothing. Guessing codes triggers an escalating lockout, and every attempt is logged.
What is included
One service, done properly. No plugins to configure yourself and no monthly surprise.
- Two factor enforced on every single admin login, not optional
- Authenticator apps plus single use recovery codes
- Exponential lockout after five wrong codes, per account
- An audit trail of every success, failure and reset
- Administrators can unlock a colleague who loses their phone
- A clearances model that re-checks the second factor while you work
A login attempt, defended
Step one
admin@yourstore.com
Password correct
Step two
Six digit code required
0 4 1 9 2 7
Five wrong codes
Locked for a minute, then longer
Every attempt written to the audit trail
Where it runs
Built for the platforms where a compromised login costs a shop real money.
WordPress
Protects wp-login.php and every administrator account on the install.
PrestaShop
Guards the back office and its employee accounts against credential stuffing.
Laravel
The same clearance API secures any Laravel application you point it at.
One price per estate, not per seat
You choose how many sites to protect, and that whole estate is billed at one price. No extra charge per administrator. See the plans and what each one includes.
View pricing