---
schema_version: "1"
id: d562310c67942abc9ff7d42f8a4aa29a8ebbeb79845ec200da9be73b1ce0b869
title: Storefront Password Protection and Login
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_storefront_password_protection.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_storefront_password_protection.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7cab3f41b2a32f5208df8f11ebc15ac892da9379d11f9bbd41df2b02c2654948
description: To prevent shoppers from finding your B2C Commerce storefront during development and testing, restrict access. Limit storefront access to merchants and other people involved in the project. This limit prevents crawlers and search engine robots from indexing your storefront and making it available to search engines. Both dynamic content, such as pages, and static content, such as images, are protected.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Storefront Password Protection and Login

To prevent shoppers from finding your B2C Commerce storefront during development and testing, restrict access. Limit storefront access to merchants and other people involved in the project. This limit prevents crawlers and search engine robots from indexing your storefront and making it available to search engines. Both dynamic content, such as pages, and static content, such as images, are protected.

Configure a storefront password on Business Manager that requires authentication of users trying to access the storefront. This feature blocks access to both dynamic pages and static pages. If a site is storefront protected and the storefront user hasn't provided the appropriate credentials, B2C Commerce returns these HTTP errors.

- 401–Access using a shared password
- 401–Access using a users password ore access key
- 403–Access using the Storefront Toolkit
- 403–Access using the Storefront Toolkit without functional permission

When a shopper or user tries to access a storefront that is in the development stage and has password protection enabled, an Authentication Required window opens. See [Setting Protection Flags and Assigning Passwords](https://help.salesforce.com/s/articleView?id=cc.b2c_setting_protection_flags_and_assigning_passwords.htm&release=264.0.0&type=5 "When you create a B2C Commerce site, there’s no password protection enabled by default. The administrator must set the protection flag and assign a password.") to learn how to enable or disable storefront password protection.

Business Manager users with the functional permission Access\_Protected\_Storefront can always log on to the storefront. To let other users access the Storefront, create a shared login. The default username is `storefront`, though you must assign your own password (to be entered for an authentication request). The storefront administrator sets the flag and password through Business Manager.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note When activating the storefront protection, invalidate the static content cache to enforce protection of static content. Otherwise any unprotected content that was already delivered is valid until it expires. If the password changes, invalidate the static content cache to enforce the usage of the new password. Otherwise the delivered content is served until it expires.

When a shopper forgets their password and asks for a reset, the password reset token expiration period is 30 minutes.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note The password reset token expiration period for Business Manager users is 120 minutes.

## Storefront Default Password Requirements

The default requirements for storefront passwords (managed via _customerlists_) are as follows:

- Minimum password length: 8
- Minimum number of special characters: 1
- Must contain letters: true
- Multiple letters must be of mixed case: true
- Must contain numbers: from false to true: true

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note

Sites with _customerlists_ created before Release 17.5 retain the previous defaults if the settings weren't configured, as follows:

- Minimum password length: 1
- Minimum number of special characters: 0
- Must contain letters: false
- Multiple letters must be of mixed case: false
- Must contain numbers: false

If you configured these settings before Release 17.5, B2C Commerce retains the existing settings.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png)

Important

Use the API to perform password checks and obtain the constraints for display to the customer, as follows:

```
boolean : dw.customer.CustomerMgr.isAcceptablePassword(String password)
 dw.customer.CustomerPasswordConstraints :
 dw.customer.CustomerMgr.getPasswordConstraints()
```