Some stores serve professional customers, selected members or invited buyers. The goal may be to keep prices, product details and purchasing features unavailable to unauthenticated visitors. The restriction must be defined precisely before implementation.
Decide what is actually private
Is the entire store restricted, or only prices, product pages and checkout? Determine whether public pages should explain the business and how a new customer requests access. Document permitted exceptions such as legal pages and login routes.
Protect routes, not only theme components
Removing menu items does not prevent direct access to product URLs, downloads, search results, APIs or cached pages. Apply authorization on the relevant server-side routes. Test that media and exported files do not inadvertently expose private information.
Make customer onboarding manageable
Plan account approval, password reset and customer support procedures. Explain what a visitor sees when access is denied. Avoid a loop in which an unauthenticated user cannot reach the login or registration workflow needed to become authorized.
Separate privacy from search indexing
noindex and robots.txt are indexing instructions, not confidentiality controls. A genuinely restricted catalogue needs access enforcement. Decide whether public landing pages should remain crawlable and ensure that canonical and sitemap outputs reflect that plan.
Cover technical edge cases
Test search, category pages, manufacturer pages, cart URLs, API endpoints, previews, feeds and third-party modules. Confirm that caches vary or are disabled where private and public states differ. Review staff and customer-group permissions.
An essential acceptance suite
As a guest, attempt a protected product URL and file download directly. As an authorized customer, verify legitimate browsing and ordering. Repeat after logout, with another account and with caches enabled. Also verify login, password reset and error pages.
Frequently asked questions
Does maintenance mode make a catalogue confidential?
Not necessarily. Check the exact access behaviour and any exceptions; indexing controls and security controls are different.
Is removing product links from navigation enough?
No. Direct URLs and other endpoints must enforce the intended permissions.
Related guides on Concepty
- Customer documents in PrestaShop: secure uploads, permissions and retention
- WordPress website hacked: first steps to contain damage and recover safely
- Developing a custom PrestaShop module
- Explore the matching Concepty plugin or module
For a specific implementation or compatibility question, explore Concepty services or contact Concepty.