Skip to main content
View plans
View Categories

Customer Security

6 min read

0:00 6:08

Customer Security controls how customers sign in to the Customer Portal. It has the same kinds of options as Staff Security, but they only affect customer logins.

Open Customer Security

  1. Click Settings at the bottom of the sidebar, under Administration.
  2. In the panel on the left, open Customers and click Customer Security.
    Customer Security Settings Page With Customer Security And Save Settings Highlighted
  3. Tick an option to turn it on and use its Settings button, or the window that opens, to set it up.
  4. Click Save Settings at the bottom right. To discard changes you haven’t saved, reload the page.

Note: customers can only sign in if the Customer Portal is turned on. See Customer Settings. You can also switch the portal on or off for a whole customer group on the group’s Portal tab.

Enable reCAPTCHA

Customers must tick Google’s “I’m not a robot” checkbox on the Customer Portal login page before they can sign in. This stops automated programs trying passwords over and over.

  1. Tick Enable reCAPTCHA and click its Settings button. If the page says Google reCAPTCHA keys are not configured, the keys still need to be added.
  2. In reCAPTCHA Settings:
    • Site Key: the public key from Google. The login page uses it to show the checkbox.
    • Secret Key: the private key the server uses to check each answer. Click Show to see what you typed. Keep it private.
    • Trusted IP Addresses: office or server IP addresses that can sign in without the checkbox. Separate them with commas. They apply to every login that has reCAPTCHA turned on, admin or customer. Only add fixed (static) addresses that you control and trust.
    • Validate reCAPTCHA: once both keys are entered, a test checkbox loads here. Complete it to check the keys work.

    Recaptcha Settings Window Opened From Customer Security

  3. Click Save Changes, then Save Settings at the bottom of the page.

Get your Google reCAPTCHA keys

Click Create or manage Google reCAPTCHA keys under the option. The window lists the steps:

  1. Open Google reCAPTCHA Admin (you need a Google account).
  2. Enter a label, for example Garage Invoice Customer Login.
  3. Under reCAPTCHA type, choose Challenge (v2) and then “I’m not a robot” Checkbox.
  4. Under Domains, enter the web address of your Garage Invoice app (for example yourgarage.garageinvoice.co.uk).
  5. Accept the reCAPTCHA Terms of Service and click Submit.
  6. Copy the Site Key and Secret Key into the reCAPTCHA Settings window.
    Create Or Manage Recaptcha Keys Window For The Customer Login

Note: the same keys are used for the staff login and the Customer Portal login. Changing them on one page changes them for both.

Tip: check the keys with Validate reCAPTCHA before you save. A wrong key or a missing domain can stop the checkbox loading on the login page.

Login Throttling

Login Throttling is always on. It limits repeated wrong passwords by checking the account, the address the attempt comes from, and both together. After too many wrong passwords, sign-in is blocked for a while. Accounts are never locked for good automatically.

  1. Click Settings next to Login Throttling.
  2. Choose:
    • Failed Attempts Before Lockout: how many wrong passwords are allowed before sign-in is blocked (5 by default).
    • First Lockout Duration: how many minutes the first block lasts (30 by default).
    • Repeated Lockout Duration: Keep the same duration every time, or Double after each lockout so repeated attempts are blocked for longer. Lockout progression shows the result, for example 30 minutes for the 1st lockout and 60 minutes for the 2nd and later.

    Customer Login Attempt Protection Window With Lockout Settings

  3. Click Save changes, then Save Settings.

Inactivity Logout

Signs customers out of the Customer Portal when they stop using it. Activity in any open portal tab counts (mouse, keyboard, touch or scrolling), so a tab left in the background doesn’t log them out while they work in another one. Public booking forms are not affected.

  1. Tick Inactivity Logout. The settings window opens.
  2. Enter Log Out After: the number of minutes with no activity, between 5 and 480.
    Customer Inactivity Logout Window With The Log Out After Minutes
  3. Click Save changes, then Save Settings.

When the time is up, a 60-second countdown appears. Customers are signed out when it ends unless they choose to stay logged in. If you click Cancel in the window, the option is unticked again.

Passkey Login and Two Factor Authentication

For customers, these two options make the features available. Each customer then manages their own passkeys and two-factor method from their profile in the Customer Portal.
Customer Security Options With Recaptcha Warning, Passkey And Two-Factor Options

  • Passkey Login: customers can register passkeys from their profile and sign in with face recognition, a fingerprint or their device PIN on supported devices.
  • Two Factor Authentication: customers can turn on email codes or an authenticator app from their profile, for a second step when signing in.

To require two-factor authentication, tick Two Factor Authentication, click its Settings button and choose:

  • Enforce two-factor authentication: customers must set it up before they can use their account.
  • Allow users to skip 2FA setup: customers may carry on without setting it up.

When it is enforced, Customer Portal contacts without two-factor authentication must set up Email or Authenticator App authentication before they can continue into the portal.
Customer Two-Factor Authentication Policy Window With Enforcement Options

Tip: enforcing two-factor authentication adds a step for every customer. If many of your customers only use the portal now and then, making it optional may suit them better.

Password Policy

Sets the rules for Customer Portal passwords. Tick Password Policy and the Password Policy Settings window opens.
Password Policy Settings Window For Customer Portal Passwords

  • Minimum Password Length: the fewest characters a password can have (12 by default).
  • Minimum Password Strength: Weak, Fair, Good or Strong. Sets how complex a password must be overall.
  • Require Uppercase Letter, Require Lowercase Letter, Require Number and Require Special Character: what every password must contain. The window lists the special characters that count.
  • Prevent Common Passwords: blocks passwords that many people use.
  • Block Passwords Found in Data Breaches: new and changed passwords are checked against Have I Been Pwned, a list of passwords leaked in data breaches. The check uses a privacy-preserving lookup.
  • Prevent Reuse of Previous Passwords: a new password can’t be the same as the current one or the previous five.
  • Require Password Change Every: makes passwords expire after 30, 60, 90, 180 or 365 days. When you turn this on, customers with older passwords may have to change them the next time they sign in.
  • Force Password Reset for All Users: signs out all Customer Portal contacts straight away. Everyone must set a new password the next time they sign in.

Click Save Policy, then Save Settings. If you click Cancel, the option is unticked again.

Note: the rules apply when a password is set or changed. Use Force Password Reset for All Users only when you mean it, for example after a security problem.

To help a customer who can’t sign in, see Send ‘Set Password’ Email to Contact.

What are your Feelings