Manage passwords

Optimizely Configured Commerce provides several ways to manage user passwords.

Passwords must match already-configured settings. To change or view the password settings, go to Administration > Settings > Account Management.

Users receive a link to reset their password when they click Forgot Password, which guides them through a typical workflow. Console users can reset website user passwords, and both console and website users can update their passwords independently.

By default, the Reset Password link expires after two days. To change this setting, go to Administration > Settings and edit the Emailed Password Link Valid For Days setting for Console Security or Website Security.

You can also update the message website users see when they reset their password after clicking the email link.

When a console user forgets their password, they can click Forgot Password on the Admin Console's sign-in page.

A dialog displays for them to enter their Username.

When they click Send Email, it sends an email with a link to reset the password. The user can click Reset Password in the email, enter a new password, confirm it, and click Reset Password. The system redirects them to the sign-in page where they can use the updated password.

If they click on the expired link, they are prompted to click Forgot Password and follow the process again.

Website user

When a website user forgets their password, they can click Forgot Password on the storefront's sign-in page.

A dialog displays for them to enter their Username.

When they click Send Email, it sends an email with a link to reset the password. The user can click Reset Password in the email, enter a new password, confirm it, and click Reset Password. The system redirects them to the sign-in page where they can use the updated password.

If they click on the expired link, they are prompted to click Forgot Password and follow the process again.

In the interest of application security, users are encouraged to change their console or website password periodically.

An ISC_Admin can reset passwords for console and website users. An ISC_User can reset website user passwords.

Configured Commerce sends the user an email with instructions to reset their password.

Website Administrators do not have access to the Admin Console, so website users must contact your customer service department to have their user passwords reset.

Configured Commerce sends the user an email with instructions to reset their password.

Use the Reset Password bulk action on the Website Users list to send password reset emails to multiple users at once. The bulk action is useful when onboarding a group of users, after a suspected credential exposure, or when enforcing a site-wide password rotation.

If no users are selected and no filters are applied, the Selected and Filtered options are disabled.

Configured Commerce sends each selected user a password reset email with a link to set a new password. The email uses the template for the user's assigned website. If Restrict Users to Assigned Websites is No and you selected a website in step five, Configured Commerce uses that website's email template instead. The user's password is not website-specific. The same password works across all websites the user has access to.

Optimizely Configured Commerce offers several options to control the specifics of timeouts and lockouts. These settings are located in the Admin Console: Administration > Settings.

Search for Site Timeout Minutes to adjust the timeout period for website users. Enter the number of minutes of user inactivity after which they are signed out and must sign back in. (Requires website restart). Default value: 15

In the Admin Console, users receive a notification after 12 minutes of inactivity. After 15 minutes, they are logged out and redirected to the login page. When they sign in again, they return to where they left off.

On Spire storefronts, the site detects the timeout on the next request and signs the user out automatically. Users on pages that require authorization are redirected to sign in.

PA-DSS compliance

PA-DSS requires a timeout of 20 minutes or less. If you accept credit card transactions, you should not override this setting in the Admin Console. Because some clients do not take credit cards as payment and rely on purchase orders, it may be necessary to adjust the time settings. However, changing timeout settings could possibly cause a site or environment to fall out of compliance with security standards such as PA-DSS.

Search for Lockout Time in Minutes. By default, this setting is enabled for both Console Security and Website Security to lock out users who fail to log in successfully after a certain number of attempts.

You can set the Max Failed Attempts Before Lockout and Lockout Time in Minutes. By default, users who make five sequential failed login attempts are locked out for ten minutes. Afterward, the user has five more attempts to log in. If those fail, the user is locked out for ten minutes again. This cycle repeats until they successfully log in.

The password expires after 90 days for users with the roles ISC_Admin, ISC_System, or ISC_Integration. This expiration is set in the code and is not configurable.

Website user password expiration is configurable. Enable Password Expiration Enabled in Account Management system settings to require password changes after a set period.

When Password Expiration Enabled is On, configure these settings:

Enabling Password Expiration Enabled requires confirmation. The Admin Console displays a dialog warning that users with passwords older than Password Expiration Days will be prompted to change their password on their next login. This applies retroactively to existing users.

When a website user's password expires, the site requires a password change before granting access. Users are prompted to change their password at login.

When Password Expiration Enabled is Off, website user passwords do not expire.