Customer Login Alerts for Magento 2
SKU: MGD-M2XP-AUT-LOGINALERT
12 Months Included Support, with options to extend · 30 Days money-back guarantee · Renewals 40% off
Overview
In stock Magento, a login is a silent event.
Your customers can't watch an account they can't see
A customer sets a password and trusts you with it. From that point on, someone could sign in from another country, at 3 a.m., on a device they've never owned — and the real customer would have no idea until a strange order arrived or a review turned angry. In stock Magento, a login is a silent event. No email. No signal. No chance for the customer to say "that wasn't me" while it still matters.
For merchants selling anything worth stealing — electronics, jewelry, subscriptions, B2B accounts with saved payment terms — that silence is a liability. You have no lightweight, native way to give customers visibility into their own account access without commissioning custom development.
Turn every login into a signal your customer can act on
MagedIn Customer Login Alerts listens to Magento's native storefront customer_login event and, on each successful sign-in, sends the customer a security email built from your store's own branding. It's a clean "Security Alert: New Login to Your Account" message: a friendly greeting, a reassurance line, a tidy Login Details block, a clear "Was this you?" warning that tells them to change their password and review activity, and a Go to My Account button. If the login was legitimate, the customer feels looked after. If it wasn't, they now have the earliest possible warning — and a next step.
Built to be invisible to your login flow
Security tooling that breaks the thing it's protecting is worse than no tooling. This extension is fail-safe by construction: two independent \Throwable guard layers wrap the observer and the email sender, so a missing template, a slow or unreachable mail server, or any misconfiguration can never block, delay-fail, or break a customer's login. The login always completes. The worst case is a logged error — recording only the customer ID and store ID, never the customer's email or PII.
It's also honest about your infrastructure. The extension resolves the correct frontend store once and reuses it for the enabled check, sender identity, template, and timezone — and if a login happens under admin scope, it falls back to your default store view rather than sending a broken email with the wrong sender, URL, or timezone. Input is handled defensively: the IP comes through Magento's RemoteAddress and is validated with FILTER_VALIDATE_IP; the user agent is read through Magento's HTTP header abstraction, with control characters stripped to prevent header and log injection, trimmed, and capped.
Configured in the admin, adapted per store
Everything lives under Stores → Configuration → MagedIn → Customer Login Notification, with a dedicated ACL-protected admin menu entry. Every setting is scoped per store view, so a multi-brand or multi-region merchant can roll it out exactly where it belongs. Turn alerts on or off, choose whether to include the IP address and the browser/device, pick the email template, and select the sender identity. No schema changes. No setup patches. Installation is: enable the module, clear the cache. That's the whole footprint.
A login they never see
Another country, 3 a.m., a device they've never owned — and no signal at all.
A silent event
In stock Magento, a successful login sends no email, no signal — the customer has no idea their account was accessed.
Found out too late
The real customer only learns something is wrong when a strange order arrives or a review turns angry — long after it mattered.
Worth stealing
Electronics, jewelry, subscriptions, B2B accounts with saved payment terms — the more your catalog is worth, the bigger the liability.
No native way to fix it
There's no lightweight, native way to give customers visibility into their own account access — short of commissioning custom development.
Why choose this extension
It respects your login flow above all else.
The login flow is sacred
Most "security" add-ons introduce a new failure point into the single most important action on your store: signing in. This one can't. By design, a notification failure is caught and logged, and the customer proceeds as if nothing happened. Safety of the auth flow is the architecture, not a promise.
Built the way senior Magento engineers build
A thin adapter observer delegates to focused services — LoginNotifier, ClientInfoProvider, StoreResolver, EmailSender and a config helper — each with a single responsibility, constructor DI and full type hints. Every service and the observer are covered by unit tests, backed by an integration test.
A low-risk install
No declarative schema, no setup patches, no database tables, no core rewrites. Enabling and disabling the module leaves your schema untouched — predictable upgrades and a clean uninstall. For an agency deploying to a client's production store, that footprint matters as much as the feature.
Honest about what it is
This is a focused, lightweight, synchronous "alert on every successful storefront login" email — not a bloated security suite pretending to be ten things. It does one job, does it safely, and stays out of the way. What you read here is exactly what the code does.
It signals that you take security seriously
Every alert is a branded touchpoint that tells the customer, in their inbox, that your store is watching out for their account. For high-value catalogs and B2B relationships, that perceived diligence is part of the product.
Yours in every language
The email inherits your store's standard header and footer, is fully translatable via {{trans}}, is theme-overridable, and is admin-selectable — brand it once and it stays on brand in every store view and language.
Features
One job, done safely — and done right.
Catch account takeover early — automatically
On every successful storefront login, the customer gets an instant security email keyed to Magento's native customer_login event. No customer setup, no opt-in step, no missed logins.
Never risk a broken login
Two independent \Throwable guard layers wrap the observer and the email sender, so a bad template, a dead mail server, or a config mistake can fail quietly in the log — never in the customer's face. Authentication always proceeds.
Give customers the details to judge
The email carries the account email and login time always, plus IP address and browser/device when you enable them — each row appearing only when both the admin toggle is on and a real value exists.
Show the right brand, time and sender
The module resolves the frontend store once and reuses it for the enabled check, sender, template and timezone — rendering the login time in the store's own timezone and falling back to your default store view instead of ever sending from admin scope.
Harden the data before it's shown or logged
IPs are validated with FILTER_VALIDATE_IP; user-agent strings are read through Magento's HTTP header abstraction, stripped of CR/LF and control characters to block injection, trimmed and length-capped — while error logs deliberately keep customer email and PII out.
Roll it out your way, per store view
Enable/disable, IP inclusion, user-agent inclusion, template and sender identity are all configurable at the default, website or store-view level under the MagedIn admin tab, behind proper ACL.
Make the email truly yours
The template inherits your store's standard email header and footer, is fully translatable via {{trans}}, is theme-overridable and admin-selectable — brand it once and it stays on brand in every language.
Extend it without touching core
A single public extension point, EmailSender::sendLoginNotification(), is designed for plugins (there's an around-plugin example in the README) — no class preferences, no core rewrites, no overrides to maintain across upgrades.
How it works
Every login becomes a signal in the inbox your customer can act on.
The extension listens to Magento's native storefront customer_login event and, on each successful sign-in, sends a security email built from your store's own branding. If the login was legitimate, the customer feels looked after. If it wasn't, they now have the earliest possible warning — and a next step.
- A friendly greeting and a reassurance line for the legitimate case.
- A tidy Login Details block — time always, IP and device when enabled.
- A clear "Was this you?" warning and a Go to My Account button.
Hi Alex, we noticed a new sign-in to your account. If this was you, you can safely ignore this email.
Was this you? If you don't recognize this login, change your password and review your recent account activity right away.
Fail-safe by construction
Security tooling that breaks the thing it protects is worse than none.
The login always completes
Two independent \Throwable guard layers wrap the observer and the email sender, so a missing template, a slow or unreachable mail server, or any misconfiguration can never block, delay-fail, or break a customer's login.
Right store, or a safe fallback
The extension resolves the correct frontend store once and reuses it for the enabled check, sender, template and timezone — and if a login happens under admin scope, it falls back to your default store view instead of sending a broken email.
Defensive input, PII-free logs
The IP is validated with FILTER_VALIDATE_IP and the user agent read through Magento's HTTP header abstraction — control characters stripped, trimmed and capped. The worst case is a logged error recording only customer ID and store ID.
Use cases
Where a login alert earns its place.
Catching the takeover before the order ships
An electronics store carries items thieves love to resell. A customer's credentials leak in an unrelated breach, and an attacker logs in overnight.
The real customer wakes to a "New Login" email showing a time and IP they don't recognize, follows the "Was this you?" guidance, and changes their password.
Often before any fraudulent order is placed — a fraud attempt stopped by the person best positioned to spot it: the account's true owner.
B2B and shared credentials
A wholesale buyer account is quietly shared across a purchasing team, or a credential has drifted beyond the person it was issued to.
Repeated login alerts arriving from different locations and devices make the pattern visible to the account owner.
They can tighten access or ask you for proper per-user accounts. An invisible risk becomes a manageable conversation.
Transparency tuned per storefront
A retailer runs several store views across regions with different privacy expectations.
Enable alerts everywhere but include the IP only where appropriate, pick a region-specific sender and template, and render each login time in that store's timezone.
One extension, configured once per view, delivers a consistent security touchpoint that still respects local norms.
Works alongside
Part of a complete login story.
Login Alerts tells customers the moment their account is accessed. Pair it with the two MagedIn extensions that harden how they sign in in the first place.
Compatibility
Confirmed to run where you run.
Driven by this product's real edition and version compatibility attributes. Confirm the exact tested patch range with MagedIn for your environment.
- Magento Open Source (Community)
- Magento Commerce (Enterprise)
- Magento Commerce Cloud
- Magento B2B
- Magento 2.3.x
- Magento 2.4.x
Installation
Four commands. No static deploy on Hyvä.
Require the package with the Composer key you receive by email, enable, upgrade, and flush.
- 01 Require the package via Composer using the key you received by email.
- 02 Enable the module with bin/magento module:enable.
- 03 Run setup:upgrade to apply the module's schema and data.
- 04 Flush the cache and you're done.
$ composer require magedin/module-customer-login-notification
$ bin/magento module:enable
$ bin/magento setup:upgrade
$ bin/magento cache:flush
✓ No static content deploy needed on Hyvä
Specifications
The kind of extension a developer signs off on.
- Support Period
- 12 Months Included Support, with options to extend
- Refund Period
- 30 Days
- Extension Code
- 100% Open Source Code
- Editions Compatibility
- Magento Open Source (Community), Magento Commerce (Enterprise), Magento Commerce Cloud, Magento B2B
- Versions Compatibility
- Magento 2.3.x, Magento 2.4.x
Changelog
What's changed, release by release.
Release notes for this extension are coming soon.
FAQ
Questions, answered.
Still unsure whether it fits your setup? Talk to our team before you buy.
Which Magento versions and editions does it support?
It runs on both Magento Open Source and Adobe Commerce, on the Magento 2.4.x line (developed and verified around 2.4.7 / 2.4.8), with PHP 7.4 or 8.x. It relies only on the standard customer module, so there are no edition-specific requirements.
How do I install and set it up?
There are no schema changes, declarative schema, or setup patches — installation is enabling the module and clearing the cache. You then configure it under Stores → Configuration → MagedIn → Customer Login Notification, or from the dedicated MagedIn admin menu entry.
Will sending these emails ever slow down or break customer logins?
The login flow is protected by design. Two independent \Throwable guard layers wrap the observer and the email sender, so a missing template, an unreachable mail server, or a config error can never block or break a login — the login always completes and the failure is logged instead. Note that delivery is synchronous (in-request), so the module is intentionally lightweight rather than queued/async.
What exactly is in the email, and can I control it?
The customer always sees their account email and the login time (in the store's timezone). You can additionally include the IP address and the browser/device from the admin — each appears only when you've enabled it and a valid value is present. The email uses your store's standard header/footer branding, is fully translatable and theme-overridable, and you can select the template and sender identity per store view.
Does it work with social login, 2FA, or API logins?
It fires on Magento's native storefront customer_login event, so social login and 2FA are covered as long as they dispatch that standard event. It intentionally does NOT send alerts for REST/API token logins, and there is no notification for an admin "Login as Customer" action — this is a storefront-login alert.
We're behind a CDN or load balancer — will the IP be correct?
The reported IP is REMOTE_ADDR as Magento sees it. Behind Varnish, a load balancer, or a CDN, configure Magento's trusted-proxy settings so it resolves the true client IP; the extension then reports whatever Magento provides.
Is it multi-store friendly?
Yes. Every setting is scoped to default, website, or store view, and the module resolves the correct frontend store for the sender, template, and timezone on each login — falling back to your default store view rather than ever using admin scope.
Can developers extend it without hacking core?
Yes. EmailSender::sendLoginNotification() is a public, intended extension point with an around-plugin example in the README. There are no core rewrites or class preferences to maintain across upgrades.
Is this a full login-history or audit tool?
No — and it doesn't pretend to be. It's a focused "email the customer on every successful storefront login" feature. There's no login-history dashboard, no per-customer opt-out, and no audit trail stored in the database; it's a real-time alert, kept deliberately simple and low-footprint.
Related products
Pairs well with these extensions.
Frequently bought together
Complete the stack.
Every MagedIn extension shares the same licensing options. Set your edition, version and domain once — they are applied identically to each extension you add.
Write Your Own Review
Only registered users can write reviews. Please Sign in or create an account