How a community conversation about dormant admin accounts turned into ElixDigiAdminGuard -- a zero-config plugin that closes Shopware's admin account security gap.
On March 30, 2026, Matheus Gontijo (iMi digital GmbH) posted a pointed question on LinkedIn: "Do you have a reminder or internal policy to remove admin users who are no longer part of your company?" The post resonated because the problem is universal, well-understood, and consistently unaddressed. Shopware 6 has no built-in mechanism to manage admin account lifecycle.
The risk compounds over time. Credentials get shared, stored in compromised password managers, or simply forgotten. The longer an account sits unused, the more likely it becomes a liability.
ElixDigiAdminGuard was built to close this gap with zero friction. Install the plugin and immediately see every admin account with its last login date and inactivity status. No configuration required to start seeing value.
Instant visibility into every admin account with last login dates, inactivity status, and role assignments. No setup required.
Intercepts successful OAuth token responses to track admin logins without modifying Shopware core tables or requiring external dependencies.
Visual warnings at 90 days inactive, danger badges at 180 days. Optional auto-disable is off by default. Super admin accounts are always protected.
Every action logged -- login tracking, status changes, account disabling, email notifications. Exportable as CSV for GDPR and ISO documentation.
The core challenge was that Shopware 6.7 provides no last_login field on the user entity and fires no event when an admin logs in. Here's how we solved it:
A KernelEvents::RESPONSE subscriber intercepts successful password-grant responses on the /api/oauth/token endpoint, extracting the username and upserting a tracking record via raw DBAL.
Login data is stored in a dedicated table, never modifying the core user table. The plugin remains non-invasive and safe to remove at any time.
A single SQL query LEFT JOINs the tracking table with the user table, computing days since last login or days since account creation for users who have never logged in.
Daily tasks update status flags, optionally disable inactive accounts, clean up old audit entries, and send email reports with configurable frequency.
Registered under Settings > Plugins > Admin Guard using the FroshTools pattern: tabbed child routes with sw-data-grid components for user list and audit log.
"The best security tools solve problems people already know they have but haven't gotten around to fixing."
Whether you need a custom security plugin, admin workflow automation, or a full security audit for your Shopware store, we build solutions that protect your business without adding complexity.
Talk to an EngineerCase study by Huzaifa Mustafa