A stolen password shouldn’t be enough to get into an account. 2FA adds a second login step: after their password, users enter a six-digit code from an authenticator app on their phone, or one sent to their email. Let users opt in, or require it for the roles that matter most.
Features
- Works with any standard authenticator app, such as Google Authenticator or Authy
- Set up by scanning a QR code or entering a key by hand
- QR codes are generated on your site, so the secret key never leaves it
- Optionally let users get their codes by email instead. Each code expires after 10 minutes
- 10 single-use backup codes for when a phone isn’t handy
- Require 2FA by role. Users in those roles are sent to set it up before they can continue
- The current password is needed to turn 2FA off
- Repeated wrong codes lock out the 2FA step for 10 minutes
- Administrators can see how each user gets their codes, and reset 2FA for anyone who loses their phone
- When Profiles is installed, users set up 2FA from the front-end profile page