Magento 2FA: How to Enable & Enforce Two-Factor Authentication
A leaked or brute-forced admin password is the fastest route into a Magento store. Two-factor authentication (2FA) closes that door: even with the right password, an attacker can't sign in without the second factor. Magento 2.4+ ships the Magento_TwoFactorAuth module enabled by default — but many stores never finish the setup or leave it unenforced for some users.
This guide shows how to enable, configure and enforce 2FA for every admin, plus how to reset it when someone loses their device. Not sure whether your admin is exposed? Run a free MageArgus scan to check your admin surface first.
- Magento_TwoFactorAuth ships enabled by default in 2.4+ — Adobe Commerce security docs
- Credential stuffing & brute force are top admin-takeover vectors — Sansec / OWASP
Confirm 2FA is active
Check the module status from CLI:
bin/magento module:status Magento_TwoFactorAuthIf it's disabled, enable it and clear cache:
bin/magento module:enable Magento_TwoFactorAuth
bin/magento setup:upgrade
bin/magento cache:flushChoose and configure a provider
Under Stores → Configuration → Security → 2FA, pick the allowed providers. Google Authenticator (TOTP) is the simplest and works offline; Duo, Authy and U2F are also supported. Set Google Authenticator as a global provider so every admin uses the same flow.
Enforce it for every user
2FA is only useful if no admin can skip it. Leave the ‘Force providers’ setting on so each user must configure their second factor on next login. Audit your admin users and remove stale accounts — every extra account is another 2FA gap.
- Delete unused admin accounts
- Give each person their own login (no shared admins)
- Pair 2FA with an unguessable admin URL and IP allow-listing
Reset 2FA when a device is lost
If someone loses their phone, reset their configuration from CLI so they can re-enrol:
bin/magento security:tfa:reset <user> googleThe user sets up a fresh TOTP secret on next login. Never disable 2FA store-wide as a ‘fix’ — reset the individual instead.
Frequently asked questions
Does 2FA slow down my admins?
Only at login — a six-digit code takes seconds. The friction is trivial next to the cost of an admin takeover.
Is the default 2FA module enough?
Yes for most stores. Magento_TwoFactorAuth covers TOTP, Duo, Authy and U2F. The key is enforcing it, not adding a third-party plugin.
What if an attacker already has admin access?
Enabling 2FA now blocks future logins but not an existing session or planted backdoor. Rotate credentials and run a full malware scan as well.