Two-factor login for Joomla administrators, without an extension

A stolen administrator password is still the most common way into a Joomla site we get called about. Since Joomla 4.2 the fix is in the core: multi-factor authentication, with no extension to install.

Multi-factor login protects the account once someone reaches the form. You can go one step further and stop bots from getting the login form at all, by hand on the server or with our own Admin Protect. That is covered at the end.

Check which methods are switched on

Open System, Plugins and filter on the type multifactorauth. You will find a handful of methods: an authenticator app, a code sent by email, passkeys (WebAuthn), YubiKey and a fixed code. Enable the ones you want people to use and leave the rest off.

The authenticator app is the sensible default. It works offline, costs nothing and every phone can run one. Code by email is better than nothing, but anyone who gets into the mailbox gets into the site as well. The fixed code method is meant for testing, not for real accounts.

Set it up on your own account first

Click your name in the top right of the administrator, choose Edit Account and open the Multi-factor Authentication tab. Add a method, scan the QR code with your app and enter the code it shows.

Joomla then gives you ten backup codes. Store them in your password manager, not in a file on the desktop. Each one works once, and they are your way back in when the phone is lost.

Log out and log in again before you touch anyone else's account. You want to see the code prompt work for yourself.

Make it mandatory for the groups that matter

Go to Users, Manage, Options and open the Multi-factor Authentication tab. Here you can make MFA compulsory for chosen user groups. Start with Super Users and Administrators. Anyone in those groups who has not set it up yet is sent to the setup screen after their next login and cannot continue until it is done.

Whether you also force it on Registered users depends on the site. For a members area with paid content it is worth it. For a newsletter sign-up it mostly produces support mail.

When someone is locked out

A user who lost their phone and their backup codes cannot help themselves. As an administrator, open the user in Users, Manage, go to the Multi-factor Authentication tab and remove their method. They log in with just the password and set it up again.

If the locked-out account is the only Super User, you need the database. In phpMyAdmin, open the #__extensions table and set enabled to 0 for the rows where folder is multifactorauth. Log in, fix the account, and switch the plugins back on straight away.

UPDATE `jos_extensions`
SET `enabled` = 0
WHERE `type` = 'plugin' AND `folder` = 'multifactorauth';

Replace jos_ with your own table prefix, which you find in configuration.php.

Passkeys skip the second prompt

If you log in with a passkey, Joomla treats that as strong enough on its own and does not ask for a second code. That is the intended behaviour, not a hole. A passkey is tied to your device and your fingerprint or PIN, which is already two factors.

One step further: hide the login form

Even with a second factor, bots keep trying passwords on /administrator all day, and every attempt lands in your logs. You can restrict that folder to your own IP addresses in .htaccess or the server configuration. Or let a module do it from the administrator: