Every member can protect their account: after the password, a code or a passkey is asked at each new sign-in. It is optional, and strongly recommended for your founder account.
Turn it on
- User Control Panel, Profile tab, Two-factor authentication screen.
- Choose an authenticator app (Google Authenticator, Aegis, 1Password, Bitwarden…) and scan the QR code, or add a passkey (phone or computer passkey, USB or NFC security key).
- For the app, enter the 6-digit code shown, then confirm activation.
- Keep the recovery codes somewhere safe: each allows one sign-in without the app, and they are shown only once.
Passkeys need a secure (HTTPS) address. “Trust this device” skips the code in a browser for a few days; “Forget trusted devices” cancels it. “New recovery codes” replaces the old codes.
Require it for administration
In the General tab of the administration control panel, User registration settings screen, set “Require two-factor authentication for administration” to Yes. Each administrator will then have to turn it on before entering the administration control panel.