Two-Factor Authentication (2FA)

Add a second check beyond the password so a stolen login is not enough. 2FA asks for something you know and something you have — a code from your phone, an authenticator app, or a one-time message — before access is granted.

Why it matters

Passwords leak. Phishing works. Shared credentials travel. A second factor stops most drive-by account takeovers because the attacker needs your password and a proof that only the real user can produce in the moment.

What you get

• Login and sensitive actions protected with a second factor
• Support for authenticator apps and one-time codes
• Clear enroll and recover flows so users are not locked out
• Admin visibility into who has 2FA enabled

How it works

1. User signs in with their normal username and password.
2. They approve a second step — app code, SMS, or another enrolled method.
3. Only after both checks pass do they reach the account or admin action.

Built for real operations

2FA is not a sticker on a login form. It is a capability: enroll once, challenge when it counts, recover when a phone is lost, and keep the rest of the stack — email, hosting, desktop tools — behind a door that does not open on a password alone.

Turn on 2FA for every admin account first. Then roll it out to users who can touch billing, customer data, or production systems.