MFA
Multi-factor authentication (MFA) adds a second verification step to your Joomla logins and is one of the most effective protections against stolen or brute-forced passwords. SecurityCheck Pro shows an MFA chip in its navigation bar so you can see at a glance whether your account is protected.
The MFA chip
| Chip colour | Meaning | Where it takes you |
|---|---|---|
| Green | MFA is active for your account. | The Joomla MFA methods page, where you can manage your methods. |
| Red | Either no MFA plugin is enabled on the site, or your user has no MFA method configured. | This documentation page. |
How to enable MFA
- Go to System > Plugins and make sure at least one of Joomla's MFA plugins is enabled: Multi-factor Authentication - Verification code (TOTP apps such as Google Authenticator or FreeOTP) or Multi-factor Authentication - Web Authentication (security keys and passkeys).
- Open your user profile (Users > Manage > your user > Multi-factor Authentication, or the Edit Account option in the top-right user menu) and add a method.
- On your next login, Joomla will ask for the second factor. The SecurityCheck Pro chip will turn green.
We strongly recommend enabling MFA on every administrator account.
In versions prior to 5.2.0, SecurityCheck Pro included an OTP unlock feature that required a configured MFA method to recover access after an accidental firewall lockout. That feature is obsolete: it has been replaced by the email rescue link, which works independently of MFA. Enabling MFA is still strongly recommended — just no longer a requirement for lockout recovery.
