Skip links

Enable Two-Factor Authentication (2FA) for Magento 2 Backend

Published on: Published in: For Web Developers

In today’s digital landscape, securing your online store is more critical than ever. For Magento 2 users, one of the most effective ways to enhance security is by enabling Two-Factor Authentication (2FA) for the admin area. While 2FA is part of the core Magento installation, many developers disable it for convenience during development. However, it is highly recommended to keep 2FA enabled in production environments to protect your store from unauthorised access.

Why You Should Enable 2FA in Magento 2

Enabling 2FA in Magento 2 offers several important benefits:

  1. Enhanced Security: 2FA adds an extra layer of security by requiring not only a password but also a second form of authentication, such as a code generated by an app. This makes it significantly harder for attackers to gain access to your admin panel, even if they have your password.
  2. Protection Against Brute Force Attacks: With 2FA enabled, even if someone attempts a brute force attack to guess your password, they would still need the second factor, which is nearly impossible to guess or intercept.
  3. Compliance with Security Standards: Many industry security standards, such as PCI-DSS, recommend or require 2FA for accessing sensitive areas like the admin panel of an e-commerce platform. Enabling 2FA helps you stay compliant with these standards.
  4. Peace of Mind: Knowing that your store’s backend has an extra layer of protection allows you to focus more on your business rather than worrying about potential security breaches.

How to Use 2FA with Google Authenticator or Other Apps

Using 2FA with Magento 2 is straightforward. Once enabled, you can use popular authentication apps like Google Authenticator, Authy, or even browser-based extensions to generate the required codes. Here’s how it works:

  1. Install the App: Download and install a 2FA app like Google Authenticator on your mobile device. This app will generate the one-time codes needed to log in.
  2. Scan the QR Code: During the setup in Magento 2, you will be presented with a QR code. Simply scan this code with your 2FA app to link it to your Magento 2 account.
  3. Enter the Code: Each time you log in to the Magento backend, you’ll need to enter the code generated by your app. The code refreshes every 30 seconds, making it highly secure.

For those who prefer a browser-based solution, several extensions can integrate with your web browser to generate the 2FA codes, eliminating the need to use your mobile device.

Technical Steps to Enable 2FA in Magento 2

If 2FA was previously disabled, you might need to re-enable it manually. Here’s how:

  1. Check composer.json: First, you’ll need to remove the line "magento/module-two-factor-auth": "*", if it exists, from the replace section of your composer.json file. This line might have been added to disable the module during development.
  2. Ensure Dependency Modules Are Enabled: You might also need to remove or adjust the following modules in the replace section or enable them in the require section of composer.json:
    • Magento_AdminAdobeIms
    • Magento_AdobeIms
    • Magento_AdobeImsApi
    To make sure all dependencies are installed correctly, use the -W option with Composer.
  3. Run Composer Command: Execute the following command to install the 2FA module and its dependencies:
    • composer require magento/module-two-factor-auth -W
    • depending on your installation of Magento you may also require:
      composer require magento/module-admin-adobe-ims-two-factor-auth -W
  4. Enable the Module: After installing the module, enable it with the following command:
    • bin/magento module:enable Magento_TwoFactorAuth
  5. Apply the Setup: Run the setup upgrade command to apply changes:
    • bin/magento setup:upgrade
  6. Clear Cache: Finally, clear the Magento cache to ensure the changes take effect:
    • bin/magento cache:clean bin/magento cache:flush

By following these steps, you can re-enable 2FA for your Magento 2 backend, significantly enhancing your store’s security.

Two-Factor Authentication is a vital security feature for any Magento 2 store. While it might be tempting to disable it for ease of use during development, keeping 2FA enabled in a live environment is essential for protecting your store from unauthorised access. It’s simple to use with apps like Google Authenticator and can be easily managed with browser extensions. Following the technical steps outlined above, you can ensure that your Magento 2 backend is secured with 2FA, providing peace of mind and compliance with security best practices.

You may also like