---
title: "Store security settings"
source: https://support.storeconnect.com/articles/store-security-settings
type: article
format: markdown
site: StoreConnect Support — product and developer documentation for StoreConnect
site_index: https://storeconnect.com/llms.txt
docs_index: https://support.storeconnect.com/llms.txt
note: Append .md to any page or article URL on this site to get its Markdown form.
---
# Store security settings

Use this topic to tune how your store handles account lockout, password reset links, session length, email confirmation, and Content Security Policy. All of these settings have safe defaults and are optional, so change one only when you have a reason to.

Each setting is a [store variable](store-variables). To change any of them, open the **Store** record, go to the **Store Variables** related list, and add or edit a variable using the **Key** shown in the tables below. Settings take effect on the next request; there is nothing to deploy.

User enumeration protection is the exception. It is always on and has no store variable.

## Account lockout

Account lockout protects customer accounts from brute-force login attempts. After a configurable number of failed login attempts, the account is temporarily locked.

| Store variable | Default | Description |
|----------------|---------|-------------|
| `passwords.lockout.failed_attempts_threshold` | `5` | Number of consecutive failed login attempts before the account is locked |
| `passwords.lockout.max_duration_minutes` | `15` | How long the account stays locked (in minutes) before automatically unlocking |

**How it works:**

- After the threshold is reached, the account locks and the customer cannot log in until the lockout duration has elapsed
- The account unlocks automatically after the configured duration, and no manual intervention is required
- When a customer resets their password, the lockout is cleared immediately
- To protect against account enumeration, the login error message is generic regardless of whether lockout is the cause (see [User enumeration protection](#user-enumeration-protection))

:::note
Manual admin unlock is not currently supported. If a customer needs immediate access, they can use the password reset flow to clear the lockout.
:::

## Password reset link expiry

When a customer requests a password reset, the emailed link is valid for a limited time. After it expires, the link no longer works and the customer must request a new one.

| Store variable | Default | Description |
|----------------|---------|-------------|
| `passwords.reset.within_minutes` | `360` | How long a password reset link stays valid, in minutes (`360` = 6 hours) |

**How it works:**

- A reset link stops working once the configured window elapses, or as soon as it has been used or replaced by a newer request.
- A customer who follows an expired, used, or superseded link is returned to the Forgot your password form with a message explaining the link is no longer valid, so they can request a fresh one without contacting support.
- A value of zero or below, or a non-numeric value, falls back to the 360-minute default, so a misconfigured variable can never expire every link instantly.

:::note
6 hours is the default. If you email reset links well in advance, review this window and increase it if needed. For the customer-facing reset steps, see [Reset a customer password](how-to-reset-a-password).
:::

## Session timeouts

Session timeouts limit how long a customer session remains active, reducing the risk of unauthorized access on shared devices.

| Store variable | Default | Description |
|----------------|---------|-------------|
| `session.inactivity_timeout_minutes` | `30` | Minutes of inactivity before the session expires and the customer is logged out |
| `session.absolute_timeout_minutes` | `60` | Maximum session duration in minutes from login, regardless of activity |

**How it works:**

- The inactivity timeout resets with each request. If the customer makes no requests for the configured period, they are logged out.
- The absolute timeout counts from the time of login. Once reached, the session ends even if the customer is actively browsing.
- Both timeouts apply to web browser sessions only. POS sessions are not affected.

To effectively disable a timeout, set it to a very large value (e.g., `999999`).

## Email confirmation grace period

By default, new customers must confirm their email address before they can log in. You can configure a grace period to allow limited access before confirmation is required.

| Store variable | Default | Description |
|----------------|---------|-------------|
| `logins.unconfirmed_access_minutes` | `0` | Minutes a newly registered customer can access their account before email confirmation is required |

When set to `0` (the default), new customers must confirm their email before they can log in to their account. When set to a positive number, they can access their account for that many minutes before confirmation is enforced.

The confirmation email is always sent, and email confirmation cannot be turned off entirely. This store variable only controls *when* an unconfirmed account is blocked from logging in, not *whether* confirmation is required.

Keep these points in mind:

- Completing a purchase does not require confirmation. A customer can check out and their order is placed whether or not they confirm. The grace period only affects access to the account area afterward.
- The grace period is a one-time countdown that starts when the account is created. It does not reset on each login, and requesting a new confirmation email does not restart it. Once it elapses, the customer is blocked from logging in until they confirm their email. Their original confirmation link still works.
- There is no maximum value. Setting a large value, for example `52560000` (about 100 years), defers the block so far into the future that it is never reached in practice, rather than truly removing it. The confirmation email is still sent.

For the full flow, what the customer sees while unconfirmed, and the steps to set this variable, see [customer email verification](customer-email-verification).

## Content Security Policy

Content Security Policy (CSP) is a store-level security header that controls what resources the browser is allowed to load for your store, including scripts, styles, images, fonts, and frames. **CSP is disabled by default**, so no CSP header is sent unless you configure it using store variables.

| Store variable | Default | Description |
|----------------|---------|-------------|
| `content_security_policy` | _(blank, CSP disabled)_ | Set to a CSP policy string to enable CSP. When blank, no CSP header is sent. |
| `content_security_policy_type` | _(blank, report-only when CSP is active)_ | Set to `enforce` to block violating resources. Leave blank to use report-only mode. |

**Modes:**

- **Disabled (default):** No CSP header is sent. No policy is applied or reported. This is the default until you set the `content_security_policy` store variable.
- **Report-only:** Sends a `Content-Security-Policy-Report-Only` header. Policy violations are reported to the browser console but not enforced, and no content is blocked. This is the default mode once CSP is enabled, unless `content_security_policy_type` is set to `enforce`.
- **Enforce:** Sends a `Content-Security-Policy` header. Violations cause the browser to block the resource.

To enable CSP, create a store variable with key `content_security_policy` and set the value to your policy string.

:::tip
Start with report-only mode to identify any policy violations before switching to enforce mode. A restrictive policy can block third-party scripts, styles, or images (such as analytics, chat widgets, or CDN-hosted assets).
:::

**Example permissive policy** (suitable for initial testing):

```
default-src 'self'; script-src 'self' 'unsafe-inline' *; style-src 'self' 'unsafe-inline' *; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' *; media-src 'self' *; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
```

:::tip
Use a CSP generator such as [Report URI's CSP generator](https://report-uri.com/home/generate) to help build your policy string.
:::

## User enumeration protection

User enumeration protection prevents attackers from discovering whether a given email address has an account in your store. Without it, an attacker could use your login or password reset form to silently probe email addresses. A different response for "account exists" versus "account does not exist" would let them build a list of your customers' emails.

This protection is **always enabled**. It cannot be disabled and requires no configuration.

**How it works:**

- **Forgot password:** Whether or not the email is registered, the response is always *"You will receive an email with instructions on how to reset your password in a few minutes."* No information is disclosed about whether the account exists.
- **Login:** Error messages are intentionally generic. An attacker cannot distinguish between a wrong password and a non-existent account, and cannot confirm an account exists by triggering an account lockout message.

:::note
This is a platform-level security feature. There are no store variables to configure.
:::

**For more granular control**, you can set HTTP security headers (including `Content-Security-Policy`, `X-Frame-Options`, `Referrer-Policy`, and CORS headers) on a per-page or per-template basis using the [Liquid header tag](liquid-header-tag) in your theme templates. This allows dynamic policies based on Liquid variables and is useful when a single store-wide policy is too broad or restrictive.

---

## Follow StoreConnect

- [Email Newsletter](https://storeconnect.com/c/lp-newsletter)
- [LinkedIn Newsletter](https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7444956928444862464)
- [YouTube](https://www.youtube.com/channel/UCngKdP2x8l1wcbAKW3tvU8g)
- [LinkedIn](https://www.linkedin.com/company/storeconnect)
- [X / Twitter](https://x.com/storeconnecthq)

## Popular Links

- [Partners](https://storeconnect.com/partners)
- [Become a Partner](https://storeconnect.com/become-a-partner)
- [News](https://storeconnect.com/articles/news)
- [Events](https://storeconnect.com/articles/events)
- [Live Events](https://storeconnect.com/live-events)
- [Feature Comparison](https://storeconnect.com/how-we-compare)
- [Download a free trial](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FMkeKUAT)
- [Book a Demo](https://storeconnect.com/contact)

## Documentation

- [Help documentation](https://support.storeconnect.com/help-documentation)
- [AI agents](https://support.storeconnect.com/ai)
- [Videos & tutorials](https://support.storeconnect.com/videos-tutorials)
- [Developer reference](https://support.storeconnect.com/developer-reference)
- [Release notes](https://support.storeconnect.com/release-notes)
- [Troubleshooting](https://support.storeconnect.com/troubleshooting)
- [Trust Center](https://trust.getstoreconnect.com/)
- [Status Page](https://status.storeconnect.com/)

## Contact

- info@getstoreconnect.com
- US +1 415 745 3230
- AUS +61 2 8365 2308

100 S Ashley Dr, Suite 600-2461
Tampa FL 33602-600 USA

Level 22, Sydney Place
180 George Street
Sydney, NSW, 2000, AUS

## Machine-readable

- [Site index for agents](https://storeconnect.com/llms.txt): curated map of the StoreConnect site in llms.txt format
- [Documentation index for agents](https://support.storeconnect.com/llms.txt): full technical and product documentation map

Every page and article on this site has a Markdown rendering: append `.md` to its URL.

Continue in Markdown: [Help documentation](https://support.storeconnect.com/help-documentation.md) · [Developer reference](https://support.storeconnect.com/developer-reference.md) · [Videos & tutorials](https://support.storeconnect.com/videos-tutorials.md) · [Release notes](https://support.storeconnect.com/release-notes.md)

---

StoreConnect Support — https://support.storeconnect.com/articles/store-security-settings