A WordPress login gets staff in the door. The PIN gate is what keeps casual access to the actual work behind a second layer. It’s not for shops where one person does everything from a private machine. It’s for shops with a tablet on the warehouse counter, a casual packer or two, a manager who occasionally walks away from their desk while logged in.
Off by default, because most shops won’t need it. Switch it on at Packsie Settings > Security: Staff PIN when the shape of your team or your floor makes it worth the small extra step.
What it adds
Three layers, all configurable independently:
- PIN required to use the dashboard. After WordPress login, a PIN modal sits between the user and the dashboard. They enter their PIN once, it’s good for the configurable session duration (default 8 hours — long enough to cover a normal shift, short enough that an unattended browser doesn’t hand the dashboard to anyone passing by tomorrow morning).
- Idle lock. Configurable inactivity threshold (default 1 hour). After that long without mouse / keyboard / scroll / touch activity, the dashboard locks behind a full-screen overlay. PIN to resume. Long-locked sessions (default 8 hours) force a full WordPress re-login instead — useful for shift-end / overnight scenarios where you’d rather not let yesterday’s PIN unlock today’s session.
- PIN re-entry on refund. Optional extra: when a manager approves a refund, the system asks for the PIN again right at that moment, even if the manager’s PIN session is still valid. Single-use token, expires in 60 seconds, can’t be replayed. Useful for shops where the same person packs and approves — adds a small confirmation gate at the moment money moves.
The PIN itself
Per-staff. Each user sets their own. 4 to 12 digits. Common patterns rejected at set time (1234, 0000, 111111, year-of-birth, repeated digits — the patterns an attacker tries first). Hashed at rest with the same hashing WordPress uses for passwords; nobody (including you) can see another user’s PIN.
Two ways a user gets one:
- They set it themselves on first dashboard access after PIN is enabled. The modal flips into “set up your PIN” mode with confirm field.
- An admin sets it on their behalf from the WP user profile (Users > Edit a user > Packsie Staff PIN section). Useful for onboarding a new packer at the warehouse counter — sit with them, set their PIN to whatever they want, hand over.
Admins can also clear a PIN (forces user to set new on next access) or clear a lockout (without forcing PIN reset — useful when a legitimate user mistypes a few times).
Brute-force protection
PIN alone is weak. PIN with the right scaffolding around it is strong. The scaffolding:
- 3 wrong attempts → 5-minute lockout. The dashboard shows a countdown.
- 5 wrong attempts (cumulative within an hour) → 30-minute lockout.
- 10 wrong attempts → escalates to “admin must clear” status. Stored on the user profile so even after the time-based lockout would naturally expire, the user can’t get back in until an admin actively unlocks them.
The 1-hour cumulative window is short enough that an honest mistyper-during-tea-break starts fresh, but long enough that an attacker can’t rest 5 minutes between bursts to skip the escalation.
A 6-digit PIN with this scaffolding takes thousands of lockouts to brute-force the keyspace. Practically infeasible — attackers give up. Without the scaffolding, the same PIN is solvable in seconds.
Admins are exempt
Administrator-role users don’t see the PIN modal. Same with idle lock and refund-PIN re-entry. The reason: admins are the recovery path. If PIN config gets corrupted, if a user gets stuck, if the system needs unsticking, admins are the people who do that. Locking them out alongside everyone else means there’s no escape hatch.
This is the standard pattern (admins exempt, others gated by configurable rules). If your concern is admin accounts specifically, the right answer is two-factor authentication for those accounts via a paired plugin (WP 2FA, Two Factor, etc.) — which is a separate axis from the PIN gate.
Audit trail
Every PIN event lands in the Packsie audit log: PIN set, PIN validated, failed attempt with attempt count and lockout level, admin reset, admin lockout-clear, idle-lock resume. The audit log is filterable by user, so when something feels off you can see “this user has had 8 failed PIN attempts in the last hour” at a glance.
The same audit log captures other staff-dashboard events you may want to check separately: customer profile views (who looked up which customer, when), refund authorisations, manager approvals on substitutes and return resolutions, and item restocks on returns. Useful when “who saw that customer’s order history last Tuesday?” comes up.
Configuration
At Packsie Settings > Security: Staff PIN:
- Require PIN — master toggle. Off by default.
- PIN session duration — 4 / 8 / 12 / 24 hours. How long a successful PIN entry lasts before re-prompting on a fresh dashboard load.
- Block common PINs — on by default, rejects the 1234-style patterns at PIN-set time.
- PIN re-entry on refund — adds the 60-second-token gate to refund approvals.
- Idle lock — auto-locks the dashboard after inactivity.
- Idle timeout — 15 / 30 / 60 / 120 minutes. How long without activity before the lock engages.
- Long-lock threshold — 4 / 8 / 12 hours, or “never”. After this much idle time, PIN alone won’t resume; user must do a full WP re-login.
Why we built it this way
The honest reason: a frontend staff dashboard with customer profiles, order data, and refund authority on it is a different security shape than an admin sitting at their own laptop with their own login. Once you’ve put the dashboard on a tablet that warehouse staff share, the threat model changes. The PIN gate is the version of “lock the dashboard properly” that’s quick enough not to slow your team down, scoped enough not to interfere with admin recovery, and serious enough that a forgotten tablet doesn’t become a back door. Off when you don’t need it. Configurable when you do.