Introduction

Overview

The Magento 2 Two Factor Authentication (Webkul_TwoFactorAuth) extension adds a critical second layer of protection to storefront customer accounts. By demanding a second authentication factor upon sign-in and registration, the module protects online shoppers and merchants against credential stuffing, phishing, brute-force intrusions, and unauthorized session hijackings.

Two-factor authentication can be enforced across two vital storefront entry points:

1. New Customer Registration: Verifies identity before or immediately upon creating a new account.
2. Existing Customer Sign-In: Enforces real-time verification during standard login, modal AJAX popups, and the checkout customer sign-in step.

Core Capabilities

• 5 Distinct Multi-Channel Verification Methods:
  • Mobile (SMS): Instant OTP sent to customer mobile numbers via Twilio SMS.
  • Email ID: OTP sent directly to the registered customer email address.
  • Email Verification Link: Fast, one-click login/registration link sent via email.
  • Browser Web Push Notifications: Real-time push notification OTP sent to the customer's desktop or mobile browser via Firebase Cloud Messaging (FCM).
  • TOTP / Authenticator Apps: Time-based one-time passcodes generated by Google Authenticator, Microsoft Authenticator, Authy, or standard RFC 6238 TOTP apps.
• Fail-Safe Account Recovery (12 Backup Codes): Customers receive 12 single-use recovery codes upon registration and can use them if their primary OTP device is lost or inaccessible.
• Admin Customer Management: Store administrators can generate new backup codes and email them to customers directly from the customer edit screen.
• Brute-Force & Lockout Protection: Configure maximum permitted incorrect 2FA attempts and lockout time. Administrators can review failure metrics and unlock accounts on demand.
• Trusted IP Whitelisting (Bypass): Whitelist specific IP addresses or CIDR ranges to allow corporate, testing, or trusted networks to bypass 2FA checks.
• Configurable Code Expiry: Define OTP validity between 60 to 300 seconds.
• TOTP Device Reconfiguration: Customers can update or re-link their Authenticator App QR code directly from their account dashboard after verifying their existing code.
• Seamless Copy-Paste Input: Customers can paste authentication codes directly into the split or standard input fields.
• Multi-Lingual Ready: Full translation support for multi-store and localized Magento setups.

Key Benefits