Find your store

Add-on

Two-Factor Sign-in

Asks for a code from an authenticator app (Google Authenticator, 1Password, Authy and others) after the password. Required for admins and staff by default, optional for customers, with backup codes, remembered devices and an owner reset from the server's command line.

  • Version 1.0.16

Add-on

Buy and install it from Add-ons in your admin panel.

Buy now · $29.00 Choose a platform

Changelog

  1. Version 1.0.16 12 Nov 2026

    - The two-factor key file is read as data and never run as code. Nothing changes for enrolled accounts.

  2. Version 1.0.15 8 Nov 2026

    - Visitor addresses in this add-on's limits and logs always come from the store's trusted-proxy setting (TRUSTED_PROXY_IPS): behind a listed proxy or CDN they are the visitor's own, never the proxy's; with none listed nothing changes.
    - Uses the store's shared rule for counting a visitor's address in the wrong-code limit; an IPv4 visitor reaching a dual-stack server is now counted by their own address rather than together with every other such visitor.

  3. Version 1.0.14 4 Nov 2026

    - For developers: this plugin now tells the coming Clear test data tool what to do with each of its tables (empty it, keep it, or remove it only with customer accounts). Nothing changes for store owners yet.
    - For developers: tells the coming Clear test data tool what to switch off or renew when it runs (keys made in test, hooks, signing secrets or customers' two-step rows). Nothing changes for store owners yet.

  4. Version 1.0.13 1 Nov 2026

    - Admins who use an authenticator app now confirm sensitive admin actions with a code from it, instead of their password.

  5. Version 1.0.12 30 Oct 2026

    - This add-on's admin pages show an 'Online docs' link next to the page name, opening the “Staff, roles and fraud” page of the online documentation in a new tab.

  6. Version 1.0.11 29 Oct 2026

    - The Upgrade converts its tables to the store's text collation where an older version left them in a different one, so a search or report that compares them with the store's own tables can't fail on it. Its tables also name their collation now, so they come out the same on every server.
    - Amharic (አማርኛ) translation, machine-translated (review welcome).
    - Oromo (Afaan Oromoo) translation, machine-translated (review welcome).
    - The command-line two-step reset compares text the same way as the store on MySQL 8 and newer MariaDB servers.

  7. Version 1.0.10 26 Oct 2026

    - Its sign-in screens, settings and the admin reminder banner now use the store's translations instead of always showing English.
    - Two-step sign-in in 11 languages: the admin menu item now has the same name the setup and lost-phone instructions tell admins to click; Polish, German, Spanish and Arabic recovery and reminder lines read correctly.
    - The customer two-factor page's browser title is now in the shopper's language.
    - Adds Thai (ไทย). Machine-translated; review welcome.
    - Japanese translation.

  8. Version 1.0.9 25 Oct 2026

    - Adds Polish (pl) text. Machine-translated.