Customer accounts on your store

What it is

Customer accounts let a shopper sign up on your store with an email address and a password. Once they are logged in, checkout fills their name, phone and address in for them, and every order they place while logged in collects in one place they can open any time. It is off by default and takes one checkbox to turn on.

The account belongs to your store only. It is not a SitesPlaced login, it does not work on any other SitesPlaced store, and it gives the shopper nothing except their own orders and details on your store.

Switch it on

1. 1Open your store dashboard and go to Settings.
2. 2Find the Checkout section, or type *accounts* into the Search settings… box at the top.
3. 3In the Customer accounts card, tick Enable customer accounts.
4. 4Press Save in the bar at the bottom of the page.

That is the whole setup. There is nothing to configure, no email template to write and no separate password policy to set.

What changes for shoppers

• At checkout, a small strip appears above the form. A logged-out shopper sees *Checking out as a guest* with Log in or create an account links. A logged-in shopper sees *Ordering as [their name]* with a link to their account.
• Their details fill themselves in. Name, phone, email and the saved address appear in the checkout form the moment the page loads. They can still edit any of it.
• The header account icon becomes a real account. If you have switched the Account icon on under Settings → Navigation & menu → Header icons, it opens their account page. With accounts off, that same icon takes shoppers to order tracking instead.
• The store menu shows it too. In the slide-out menu on a phone, the same entry reads *My account* when accounts are on, and *Track order* when they are not.
• The first address they type is remembered. If a shopper signs up and then checks out with an empty profile, their phone and address are saved so the next order is prefilled.
• One-click checkout is prefilled too. If you use Razorpay Magic or Shiprocket's checkout, the shopper's saved name, email and phone are handed over so they do not retype them.

What a shopper sees once signed in

Their account page greets them by first name and shows their email, with three tabs and a Log out link.

• Orders lists the orders they placed while logged in, newest first, up to the last 50. Each shows the order number, the date, the items, the total and the status, worded the way your dashboard words it: *Placed*, *Confirmed*, *Shipped*, *Out for delivery*, *Delivered* or *Cancelled*. If you collect product reviews, a Write a review link sits next to each item on a shipped or delivered order.
• My details is their saved name, phone and delivery address. Whatever they save here is what fills their next checkout. If your store does not ask for a postal code at checkout, this form does not ask for one either.
• Password lets them change their password by typing the current one first.

Passwords and forgotten passwords

• A password must be between 8 and 128 characters. There are no other rules.
• Passwords are never stored as text. They are hashed, and even we cannot read them back.
• After 8 wrong attempts the account is locked for 15 minutes and says so. This stops someone guessing their way in.
• A wrong password and an unknown email give the same message, *Incorrect email or password*, so nobody can use the login form to find out who shops with you.
• Forgot password emails a reset link that works once and expires after an hour. The email is sent in your store's name, so it reads as coming from you.
• A shopper stays logged in for 30 days on that device, or until they press Log out.

The privacy position

• Accounts are per store. A shopper who has an account with you does not have one with any other SitesPlaced store, and the login on one store cannot be used on another.
• The email address is not verified at sign-up. Treat it as a contact detail the shopper typed, not proof of identity. It is why order history is tied to the login rather than to the email.
• The session is a signed, browser-only cookie. Nothing about the shopper is readable from it by a script on the page, and it cannot be moved to another store.
• Account pages are not indexed by search engines.
• These are your customers. SitesPlaced does not email them, market to them, or use the list for anything other than running your store. If you want to email them, collect a newsletter subscription separately, which is what the Subscribers tab is for.

Turning it off again

Untick the box and save. The account pages stop working, the header icon goes back to order tracking, and checkout stops showing the log in strip. Nothing is deleted: the accounts and the orders attached to them stay exactly where they are, and switching the setting back on brings everyone's account back with their saved details intact.