How to Set Up Two-Factor Authentication by Code Authenticator in Joomla

How to Set Up Two-Factor Authentication by Code Authenticator

Before you start

This guide takes about 10 minutes and adds a second layer of security to your website login. Once it is set up, after entering your password you will also be asked for a 6-digit code from an authenticator app on your phone, so nobody can get into your site with your password alone.

You will need:

Your website login details
An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy (a password manager that can store two-factor codes will also work)
Your phone to hand, with the app open

In every screenshot below, the red arrow shows exactly where to click.

Step 1: Go to Users, then Manage

Log in to your website's admin area.
In the menu on the left-hand side of the screen, find Users and click on it to open its menu.
Then click Manage.

Step 2: Open your Administrator account

You will now see a list of all the user accounts on your website.
Find your Administrator account in the Name column and click on the blue underlined name.
Tip: click the name itself, not the "+ Add Note" button underneath it.

Step 3: Click the Multi-factor Authentication tab

You are now on your account page. Along the top there is a row of tabs.
Click the last one, Multi-factor Authentication.

Step 4: Click "Add a new Verification code"

You will see a message saying Multi-factor Authentication is not enabled. That is normal, it means it has not been set up yet.
Find the section called Verification code.
Click the blue + Add a new Verification code button.

Step 5: Add the website to your authenticator app

The page now shows a QR code and a text key.
On your phone, open your authenticator app and choose to add a new account (usually a + button).
Scan the QR code with your phone's camera. If you can't scan it, choose to enter a key manually and type in the text key shown on the page.
Your app will now show a 6-digit code for your website. The code changes every 30 seconds.
Important: do not refresh or leave this page. Reloading creates a new QR code and the one you just added will stop working.

Step 6: Enter the code

Scroll down to the box called Enter the six digit verification code.
Type in the 6-digit code currently showing in your authenticator app.
Type only the numbers, with no spaces or dashes.

Step 7: Click Save & Close

Scroll back up to the top of the page and click the Save & Close button (the one with the tick).
If the code is rejected, wait for the next code to appear in your app and try again.

Step 8: Check it worked

You will be taken back to the Multi-factor Authentication page.
It should now say Multi-factor Authentication is enabled, with Verification code listed as your default method.
You will also see a list of Backup Codes (see Step 9).

Step 9: Save your backup codes

Backup codes let you log in if you lose or replace your phone.
In the Backup Codes box, click Print these codes to open the list.
Copy the codes and store them somewhere safe and private, such as a password manager. Do not email them or save them on a shared drive.
Each backup code works once only, so cross them off as you use them.

If something goes wrong

The code was not accepted: check you typed all 6 digits with no spaces. The code changes every 30 seconds, so wait for the next one and try again.
It keeps failing: check your phone's date and time are set to automatic, as the codes depend on the correct time. If you reloaded the page, delete the old entry in your app and scan the new QR code.
I lost my phone: log in using one of your backup codes, then set up a new authenticator.
Still stuck: contact us and we will set it up with you.

Logging in from now on

Every time you log in to your website from now on, enter your username and password as normal.
You will then be asked for a verification code. Open your authenticator app and type in the current 6-digit code for your website.
You won't be able to log in without the code, so make sure you always have your phone or your backup codes to hand.