Set sign-in policy and recover two-factor access
Where: Admin → System → Security → Security & 2FA
Before you start
The staff 2FA policy is a reminder in this build, not forced sign-in enforcement. Existing enrolled users retain their setup even if new enrolment is hidden. Reset clears the secret, switch and unused recovery codes and is staff-logged. Verify account ownership before reducing its authentication protection.
Step by step
- Choose Allow members to use two-factor and the staff enrolment reminder; Save policy.
- Set password minimum, login-failure/lockout/session controls shown below and save.
- Have staff enrol through their own Settings and retain recovery codes.
- For a verified owner who lost both authenticator and recovery codes, search the member under Reset a member’s two-factor and use Reset.
Settings and behaviour
The staff 2FA policy is a reminder in this build, not forced sign-in enforcement. Existing enrolled users retain their setup even if new enrolment is hidden. Reset clears the secret, switch and unused recovery codes and is staff-logged. Verify account ownership before reducing its authentication protection.
Sign-in
| What the board does about the password half of an account. Each of these is applied by the sign-in path itself, not merely stored. | Control | What to enter / effect |
|---|---|---|
| Allow new registrations | Switch off to close the board to new accounts. The registration form says so and the endpoint refuses the write. Existing members are unaffected. Initial default: 1. |
|
| Failed sign-ins before a lockout | Counted per account. 0 turns the lockout off entirely. Initial default: 5. |
|
| Lockout (minutes) | How long the account waits. The lockout expires on its own — nothing has to run — and a successful sign-in clears it. Initial default: 15. |
|
| Sign a member out after (minutes idle) | 0 keeps them signed in until they sign out. Initial default: 0. |
Check the result
Test a password sign-in, an enrolled TOTP sign-in and one recovery-code use on a test account.
Common questions and troubleshooting
Staff not forcibly blocked: reminder-only is expected. Lost authenticator: use a recovery code first, then verified administrator recovery. Account locked: check the failed-login window and policy before resetting a password unnecessarily.