Two-Factor Authentication Overview (Pro)

Overview

Two-Factor Authentication (2FA) adds an extra layer of security by requiring users to verify their identity with a second factor after entering their password. This Pro feature protects against stolen passwords and unauthorized access.

---

What is Two-Factor Authentication?

The Two Factors

Factor 1: Something You Know

Your password or passphrase

Factor 2: Something You Have

Access to your email (verification code)

---

Benefits of 2FA

Enhanced Security

---

Available 2FA Methods

Email-Based Verification (Available Now)

How it works:

1. User enters username and password
2. System sends 6-digit code to user's email
3. User retrieves code from email
4. User enters code on verification screen
5. Access granted upon successful verification

Specifications:

Code Length: 6 digits
Code Expiration: 10 minutes
Delivery Method: Email

Best for:

• General websites
• Business applications
• Membership sites
• E-commerce platforms

---

Future Methods (Coming Soon)

TOTP Authenticator Apps (Planned v1.1)

Google Authenticator
Microsoft Authenticator
Authy

SMS Verification (Planned v1.2)

Requires Twilio or similar service
Text message delivery
International support

---

Who Should Use 2FA?

Recommended User Roles

User Role	Require 2FA?	Rationale
Administrator	✅ Yes	Highest security risk—full site control
Editor	✅ Yes	Access to all content and publishing
Author	⚠️ Optional	Moderate risk—can publish content
Contributor	⚠️ Optional	Limited access—cannot publish
Subscriber	❌ No	Read-only access—minimal risk
Customer	⚠️ Optional	Consider for financial data access

---

Use Cases by Industry

Healthcare & Medical

HIPAA Compliance:

✓ Protect patient data
✓ Secure medical records
✓ Meet compliance requirements
✓ Required for: All staff with PHI access

---

Financial Services

PCI-DSS Compliance:

✓ Secure payment information
✓ Protect financial data
✓ Prevent fraud
✓ Required for: All staff with payment access

---

E-Commerce

Customer Protection:

✓ Secure customer accounts
✓ Protect order history
✓ Prevent fraudulent purchases
✓ Recommended for: High-value customer accounts

---

Corporate Intranet

Business Security:

✓ Protect company data
✓ Secure employee information
✓ Prevent unauthorized access
✓ Required for: All employees

---

Educational Platforms

Student Data Protection:

✓ Protect student records
✓ Secure grades and assignments
✓ Meet FERPA requirements
✓ Required for: Faculty and staff

---

User Experience Flow

Login Process Without 2FA

Traditional Login (3 steps):

1. Enter username
2. Enter password
3. Click "Log In" → Access granted

---

Login Process With 2FA

Enhanced Login (5 steps):

1. Enter username
2. Enter password
3. Receive email with verification code
4. Enter 6-digit code
5. Click "Verify" → Access granted

---

What Users See

Step 1: Normal Login Screen

Email or Username: john@example.com
Password: ••••••••••
☐ Remember Me

[Log In Button]

---

Step 2: Verification Code Screen

✉️ Email Verification Required

We've sent a 6-digit verification code to:
john@example.com

This code will expire in 10 minutes.

Enter Verification Code:
[___] [___] [___] [___] [___] [___]

[Verify Button]

Didn't receive it? [Resend Code]

---

Step 3: Success Message

✓ Verification Successful
Redirecting to your dashboard...

---

Configuration Options

Global Settings

Enable/Disable 2FA:

Settings → Attributes User Access → Security
Toggle: "Enable Two-Factor Authentication"

---

Role-Based Requirements

Select which roles require 2FA:

☑ Require for Administrators
☑ Require for Editors
☐ Require for Authors
☐ Require for Contributors
☐ Require for Subscribers
☐ Require for Customers

---

Excluded Roles

Exempt specific roles from 2FA:

☐ Support Staff
☐ Service Accounts
☐ Emergency Access

---

Code Settings

Verification Code Configuration:

Code Length: 6 digits (fixed)
Expiration Time: 10 minutes (fixed)
Delivery Method: Email
Resend Cooldown: 1 minute

---

Security Considerations

Strengths

---

Limitations

---

Email Requirements

Email Server Configuration

Requirements for 2FA emails:

---

Testing Email Delivery

Before enabling 2FA:

1. Go to Settings → Attributes User Access → Email
2. Click "Send Test Email"
3. Check inbox for test email
4. Verify email arrives within 2 minutes
5. Check spam/junk folder if not in inbox

---

Rollout Strategy

Phased Deployment (Recommended)

Phase 1: Administrators Only

Week 1: Enable 2FA for admin accounts
Test thoroughly, resolve any email issues

Phase 2: Editors and Staff

Week 2-3: Add editors and key staff
Monitor for issues, provide support

Phase 3: All Users

Week 4+: Enable for all applicable roles
Communicate changes to users in advance

---

Communication Plan

Before Enabling 2FA:

1. Email Announcement (1 week before):

Subject: Important: Two-Factor Authentication Coming Soon

Dear [User],

Starting [Date], we're implementing Two-Factor Authentication
for enhanced security. This will require you to enter a code
from your email when logging in.

What to expect:
- Extra verification step at login
- Code sent to your registered email
- Adds 30-60 seconds to login time

Benefits:
- Enhanced account security
- Protection against password theft
- Compliance with security standards

Questions? Contact support@example.com

2. Login Page Notice:

"Two-Factor Authentication will be required starting [Date].
Ensure your email address is up to date in your profile."

3. Support Resources:

Create FAQ page
Prepare support staff
Document common issues

---

Best Practices

---

Performance Impact

Server Resources

Minimal Impact:

Email generation: Negligible CPU
Database queries: +1 per login
Email sending: Handled by mail server
Storage: +1 record per verification code

No significant performance degradation expected.

---

User Experience

Time Addition:

Email check time: 10-60 seconds
Code entry time: 5-10 seconds
Total added time: 15-70 seconds per login

Trade-off: Slight inconvenience for significant security improvement.

---

articleRelated articles

• 2FA Configuration Guide
• 2FA User Experience
• 2FA Troubleshooting
• Password Policies (Pro)