SSL certificate, domain and 2FA for your online store in CloudCart

In short: every CloudCart store runs on https. Your cloudcart.net address has an SSL certificate from day one, and for your own domain you install a Let's Encrypt certificate with one button; it renews itself 25 days before it expires. Two-factor authentication (2FA) protects the admin with a 6-digit code from your phone, and staff permissions are granted section by section, for 1 to 10 accounts depending on the plan.

This guide is for store owners on CloudCart, the Bulgarian ecommerce platform, whether you sell in Bulgaria, from Bulgaria or across the EU. It gives the admin path and field names for each setting, checked against the platform documentation and the Domain, SSL and GDPR and Team and permissions pages.

What each security measure protects

Each of the three main measures closes a different door: 2FA guards the login to the admin, the SSL certificate guards the data travelling between the customer and the store, and staff permissions limit the damage if one account is compromised.

Measure	What it protects against	Where it is in CloudCart
Two-factor authentication (2FA)	A login with a stolen or guessed password	Profile (top-right menu) → Two-factor authentication
SSL certificate (https)	Intercepted data and the "Not secure" warning in the browser	Settings → Domains → SSL action on the domain row
Permissions by section	Access to orders, customers or settings a person does not need	Settings → Staff → the moderator's row
PAT token with limited rights	An AI agent or script with more access than it needs	Settings → PAT tokens

Does a CloudCart store come with an SSL certificate?

Yes. Your CloudCart address (yourstore.cloudcart.net) has a certificate from the first day, and for your own domain you install a Let's Encrypt certificate with one button or upload one you bought elsewhere. An SSL certificate lets the browser confirm the site is yours and encrypts the connection: the address starts with https and shows a padlock.

Without a valid certificate, Chrome has marked sites as "Not secure" since version 68 (Chromium Blog), and Google uses https as a ranking signal (Google Search Central). For a store, that means less trust at checkout and a weaker position in search.

DV, OV, EV and wildcard: which certificate an online store needs

Certificates differ in how much the issuer checks before signing. Bulgarian hosting companies sell all four types, so the choice looks harder than it is.

Type	What is checked	Renewal	In CloudCart
DV (domain validation)	That you control the domain	Let's Encrypt: every 90 days, automatic	Automatic install, renewed by the platform
OV (organization validation)	The domain and the company behind it	Manual, by you	Upload in Manual install
EV (extended validation)	The domain and a fuller company check	Manual, by you	Upload in Manual install
Wildcard	All subdomains of one domain	Manual, by you	Upload in Manual install

Let's Encrypt issues domain-validated certificates only and states in its FAQ that default certificates are valid for 90 days and that it has no plans to issue OV or EV. The padlock and encryption are the same for DV and OV, so for most stores the automatic certificate is the right choice: nobody has to remember a renewal date.

How to install SSL for your domain

1. Point the domain to CloudCart. See the domain section below.
2. Open Settings → Domains. On the domain row, click SSL.
3. Choose Automatic install. If needed, the window first offers to install the Let's Encrypt Manager app: in some countries it is a paid app, and the price is shown on the button.
4. Click Automatic install. The platform verifies the domain through Let's Encrypt and issues one certificate covering both yourstore.bg and www.yourstore.bg.
5. Check the status. The window shows the installed certificate with a green Automatic label and its expiry date.

CloudCart checks all certificates daily and renews any with less than 25 days left. A failed renewal shows a red SSL ERROR box; the usual cause, "Header x-powered-by not found for domain", means the domain no longer points to CloudCart. If a certificate does expire, the store keeps running: the primary domain switches back to the cloudcart.net address until you fix the domain and reinstall the certificate.

Your own certificate from another provider

An OV, EV or wildcard certificate goes in the same window, in the Manual install tab, when the domain has no certificate installed: you generate the CSR and private key, then paste the certificate and the chain. It carries a purple Manual label and does not renew itself. To switch back to automatic, first click Remove.

How to connect or buy a domain for the store

You add a domain in Settings → Domains → + Add domain in one of two ways: connect a domain you already own at another registrar (Add existing), or buy a new one straight from the admin (Buy new). The store works on its cloudcart.net address from day one, and that address stays as a fallback once you add your own.

	Your own domain (Add existing)	New domain (Buy new)
Registration	Stays with your current registrar	Bought in the admin; the search shows available extensions and prices
Renewal	You pay your registrar	A Renew button appears 30 days before expiry
DNS	Switch nameservers to Cloudflare from the admin (recommended), or add a CNAME record if your plan has an unused CNAME slot	Managed from the admin

With Cloudflare nameservers you edit DNS records in the admin and the store gets DDoS protection. Your email stays with its provider: add its MX records in the admin's DNS settings and mail keeps flowing.

The primary domain is the address used in canonical tags, the sitemap and customer emails. Set as primary works once DNS points to CloudCart and SSL is valid, and other active domains 301-redirect to it, so Google sees one address.

A .bg domain: who runs it and how you connect it

The .bg extension is Bulgaria's country code domain, and according to the IANA root zone record it is managed by Register.BG. The Cyrillic version of the extension (xn--90ae in DNS) is a separate top-level domain, managed by Imena.BG according to its IANA record. Eligibility and documents for .bg are set by the registry, so read the current rules on register.bg before you buy, especially with a company outside the EU.

A .bg domain from a Bulgarian registrar is connected with Add existing and gets its Let's Encrypt certificate the same way. Many stores keep both .bg and .com: choose one as primary and the other redirects to it. A name in Cyrillic letters also works; DNS and the certificate use its Punycode form (xn--...).

Important: the Add domain window has no transfer option. The domain stays with your registrar and you point it to the store; for a manual transfer, write to support@cloudcart.com.

What two-factor authentication is and why you turn it on

Two-factor authentication (2FA, also called two-step verification) is a login with two proofs of different kinds: the password you know and a code from a device you hold. In CloudCart the second factor is a TOTP code (Time-based One-Time Password, the RFC 6238 standard): 6 digits that the app on your phone changes every 30 seconds.

The code protects the admin even after a password leaks through a phishing email or another site's breach. Whoever gets in sees customers' names, addresses and phones. GDPR, applicable since May 25, 2018, requires "appropriate technical and organisational measures" for personal data (GDPR, Article 32), and 2FA is the simplest of them. The rest of your GDPR duties are in the guide to GDPR and cookies in CloudCart.

How to turn on two-factor authentication (2FA) in CloudCart

Each staff member turns on 2FA for their own account in about 2 minutes: scan a QR code with an app, enter the first code and save the restore codes. Any TOTP app works: Google Authenticator, Microsoft Authenticator, Authy or 1Password.

1. Install an authenticator app on your phone.
2. Open the 2FA screen. In the admin, click your profile (top-right menu) → Two-factor authentication.
3. Scan the QR code (STEP 1). In the app, choose to add an account and point the camera at the code on screen.
4. Enter the confirmation code (STEP 2). Type the current 6 digits from the app and click Validate.
5. Save the restore codes (STEP 3). The platform creates 12 one-time codes. Download them (file cc2fa.csv), print them or copy them. The Finish button appears only after one of these three actions.

From then on, every login asks for email, password and the 6-digit code.

Important: 2FA is personal, per staff member. CloudCart has no switch that lets the owner turn it on for the whole team at once. Ask every employee to set it up on their first day.

Email code or app: which to choose

The app is safer. Without it, a protected action such as adding a moderator sends a 6-digit code by email, valid for 60 minutes, so your second factor is only as safe as your mailbox. Once the app is set up, email codes stop.

What to do if you lose the phone with your codes

If you lose your phone, you sign in with a restore code: on the verification screen click "Use a restore code instead" and enter one of the 12 codes you saved. Each code works once. Codes are personal, so keep yours in a password manager or a locked drawer, away from the phone.

If you have neither the phone nor the restore codes, write to support@cloudcart.com. Support can switch off 2FA on the account after verifying your identity.

How to give an employee access to the admin

You give an employee access by adding them as a moderator in Settings → Staff → Add moderator and ticking only the sections they work with. The owner (Administrator) sees everything; moderators see only their sections.

1. Click Add moderator. If the plan has no seats left, you see "You have reached the maximum number of administrators allowed".
2. Confirm with a code. Adding a moderator always asks for a 2FA code, from the app or by email.
3. Fill in the profile. Username and email must be unique across the platform.
4. Tick the permissions. Access permissions shows the admin tree (Orders, Products, Customers, Marketing, Settings, Reports, Apps); a ticked section includes its subsections.
5. Click Save. The employee gets access right away.
6. Ask the employee to turn on 2FA with the steps above.

For example, the warehouse gets Orders and Products, accounting gets Orders and Reports. A section without a tick disappears from the moderator's menu, and a moderator cannot change their own permissions.

How many staff accounts each plan allows

Plan	Price per month (billed annually, excl. VAT)	Admin accounts
Baby Pack	€14	1
Starter Pack	€33	3
CC Pro	€83	5
CC Master	€249	10

Prices and limits are from the pricing page as of November 2026. The owner counts towards the limit. Extra seats are bought as a pack. For a large team with separate departments, ERP and several stores, see CloudCart Enterprise.

What to do when an employee leaves or a password leaks

When an employee leaves, you delete their account and sign everyone out: deleting stops new logins, and Force sign out ends sessions that are already open.

1. Delete the moderator. Bin icon on their row, then Delete.
2. Click Force sign out. It signs out every admin account at once, yours included.
3. Sign in again and change the password. Use Change your password in your profile.
4. Check the PAT tokens. Replace the ones the employee could see.

How to give an AI agent access without risking the store

An AI agent such as Claude Code, ChatGPT Codex or Gemini CLI (see the store run by an AI assistant) works with your store through a PAT (Personal Access Token), which only the owner creates in Settings → PAT tokens. The agent never gets your password.

With Custom Permissions you choose None, Read or Read & Write for each of the 8 resources (Products, Orders, Customers, Inventory, Discounts, Blog, Settings, Webhooks). An agent that writes product descriptions and SEO texts works with Products and Blog and never sees a single customer. You add an expiry date and up to 20 allowed IP addresses, and deleting the token cuts access immediately.

For a morning sales report, Read Only is enough (the admin marks it as recommended). Give each agent its own token so you can switch them off one by one.

How to restore the store after a mistake and stop fake orders

You restore the store after a mistake from the daily backups in Settings → Backup & Restore, and you stop fake orders from one address in Settings → Block Client IP addresses. Both cover damage 2FA cannot: staff errors, bad imports and cash on delivery (COD) orders nobody will pay for.

A CloudCart backup covers the whole store: products, orders, customers and settings. The platform makes one every day. A partial restore (a separate add-on) brings back only selected parts, such as products, and every restore first saves a safety backup and asks for a 2FA code. Which plans include backups and how many days are kept is on the pricing page.

A blocked IP address can still browse the store, but its COD or bank transfer order arrives in the admin as cancelled, with a note on the reason. Online card payments are not blocked, because the money is already paid.

The difference between COD and card payments is covered in the guide to cash on delivery and card payments.

Security good practice for your team

• 2FA with an app for everyone, on day one.
• One person, one account. A shared password hides who changed an order.
• Permissions by task. Start with the minimum and add sections on request.
• Automatic SSL for every domain. With a manual certificate, set a reminder 30 days ahead.
• A review every 3 months. Delete unused staff accounts and PAT tokens.

If you are setting up a new store, put these on the checklist for the first 30 days of an online store, next to the domain you chose while working on the brand name and logo.

Mistakes to avoid

• Closing the window before STEP 3. Without restore codes, a lost phone means an email to support and a wait.
• Removing the certificate from the primary domain. Remove stops https at once; install the new one first.
• Changing nameservers without adding MX records. Your mail stops.
• Giving an AI agent Full Access "just in case". Read Only or Custom Permissions cover most tasks.

Frequently asked questions