Users

Two-step verification (2FA)

A code after the password, and how to recover a locked account

Two-step verification asks for a 6-digit code after the password, so a stolen password alone can't open an account. It stays off until you switch it on. After that, each user decides whether to use it on their own account. You can't make it mandatory for a user or a role

Before you switch it on

Test your email. Open Setting → Notifications → Email and press Send test email. Email codes and security notices depend on it
Update your mobile app, if you have one. Open Mobile App, press Rebuild bundle, and give apps time to update. An app with the old screens doesn't know the code step, so anyone with two-step on can't finish signing in there. Apps built before Cordova V1.1.00 can't update over the air and need a new build
Check your Firewall. If Enforce is on, read the Firewall section below first

Then open Setting → User → Two-step verification and choose your options

Setting	What it does	Suggested
Turn on two-step verification	The main switch. Turning it off returns everyone to password-only sign-in at once. Users' set-ups are kept for when you turn it back on.	On
Authenticator app	Lets users set up Google Authenticator, Microsoft Authenticator, Authy or similar. Turning this off only stops new set-ups.	On
Email codes	Lets users get codes by email. Turning this off only stops new set-ups.	On
Email fallback for a lost authenticator	Adds a "Lost your phone?" link that emails a code. Anyone with access to the user's inbox can then get past the app, and the user is emailed each time it's used.	Off
Also ask for a code on the admin panel login	See "The admin panel" below.	On, after your admins have set it up
Confirm new accounts with an emailed code	New sign-ups enter a code before their first session works. Only applies while "verify email at signup" is off in the Guest role.	Your choice
Remember this device (days)	How long a device can skip the code when the user ticks the box. Up to 365. 0 removes the option.	30

What your users do

Setting it up. Users open Settings → Two-step verification, the tab next to Security. For the authenticator app, they scan the QR code and enter the code it shows. On a phone they can type the key shown under the QR code instead. For email codes, they enter the code sent to their address. They can use both and pick a preferred one. Social accounts with no real email address can only use the authenticator app

Backup codes. The first method a user turns on gives them 3 backup codes, shown only once. Each works one time. Ask users to save them somewhere other than their phone. They can get a new set in the same tab, which cancels the old one

Signing in. After the password, the account stays signed out until the code is entered. This applies to password and social sign-in, and to signing in after a forgotten password, so resetting a password doesn't skip the code. Users can switch method on the code screen

Sensitive actions. Users with two-step on must enter a fresh code to:

change their password or email address
delete their account
request a withdrawal
turn a method off, add another method or get new backup codes

A verified code opens these actions for one minute. After entering the code, the user presses the original button again

Changing email. This option sits in the same tab and is only available to users with two-step on. The code goes to the new address, and the old address gets a notice

Limits

Situation	What happens
Emailed code	Valid for 10 minutes
Asking for a new email code	Once a minute, 5 per hour
Authenticator code	Changes every 30 seconds. Each code works once, so a second sign-in has to wait for the next one
5 wrong codes in one sign-in	Back to the sign-in page
10 wrong codes on one account within 15 minutes, from any device	Locked for 15 minutes. Even the right code is refused, and the user is emailed

When someone can't get in

Problem	Fix
Authenticator codes are always wrong	The phone's clock is usually off. Turn on automatic time on the phone. Your server's clock must also be correct.
The email code doesn't arrive	Check spam, then send a test email from Setting → Notifications → Email. Also check the limits above.
Lost phone, still has backup codes	Choose "Use a backup code" on the code screen, then get new codes afterwards.
Lost phone and backup codes	Go to Users → User List and use Reset two-step verification, on one user or in bulk. The user is emailed and signs in with just their password until they set it up again. Confirm who is asking first, because this removes their protection.
"Someone is guessing your verification codes" email	The lock worked, and someone probably knows that user's password. They should change it.
Nobody can sign in	Turn off the main switch. Password-only sign-in returns at once.

The admin panel

Admins set up two-step on their website account, not in the admin panel. The account needs a User role as well as its Admin or Moderator role. Without one it can't sign in on the website, so it can't set up two-step and keeps signing in to the admin panel with a password only

Turn on "Also ask for a code on the admin panel login" only after your admins have set it up. The panel never offers Remember this device or the email fallback, so keep your backup codes safe

Any moderator who can edit users can also press Reset two-step verification, including on an admin's account. Give that access only to people you trust with it

If you lose your phone and backup codes. Another admin can reset you. If you are the only admin, open your database in phpMyAdmin and run this with your own email address:

DELETE FROM _u_two_factor WHERE user_id = (SELECT ID FROM _u_list WHERE email = 'you@example.com');

You can then sign in with your password. Set two-step up again straight away

Firewall

This matters only if Enforce is on in the Firewall. With the default thresholds:

Three wrong codes from one address within 10 minutes block that address for 24 hours
Reusing an authenticator code blocks it too, for example signing in on a phone and a laptop with the same code within 30 seconds

Everyone sharing that address is blocked with them, such as a household or an office. To remove a block, use Unblock on the Firewall's Blocks page. To prevent it, add addresses you trust to the IP whitelist

Worth knowing

Moving to a new server: copy api/app/config_license.php as it is. It holds your sign_key. If that value changes, authenticator set-ups and backup codes stop working and users must set them up again
Language: the screens and emails are in English until you translate them in Setting → Languages
Statistics: Statistics → Users shows adoption, sign-ins, code success rate, locked accounts and backup code use. A rise in locked accounts means someone is trying stolen passwords