Two-factor login adds a second step to the dashboard login. After the password, PureWiki asks for a 6-digit code from an authenticator app on your phone. It is optional, every user sets it up for their own account.
Supported Apps
Any app that supports TOTP works, for example Aegis (Android), Google Authenticator or Microsoft Authenticator. The codes follow RFC 6238, have 6 digits and change every 30 seconds.
Set Up
- Open the user menu in the top right corner of the dashboard and choose Set Up Two-Factor Login.
- Scan the QR code with the app. On a phone or tablet, tap Open in authenticator app instead. If neither works, enter the key below the QR code in the app.
- Enter the 6-digit code shown in the app and click Activate.
If the code is wrong, the dialog opens again with the same key, so the app does not need a new scan. Readers have no access to the dashboard, so they cannot set up two-factor login.
Log In
After the password, the login page asks for the code. Enter the current code from the app within 5 minutes. Cancel goes back to the normal login.
- Each code works once: After a login, the same code is rejected. If you log in again right away, wait for the next code in the app.
- Time on the phone: It has to be correct, a difference of up to 30 seconds is fine. If codes keep failing, set the phone to automatic time.
- Failed attempts: Wrong codes count like wrong passwords. After 5 failed attempts the account is locked for 15 minutes.
Turn Off
Choose Turn Off Two-Factor Login in the user menu and confirm with your password. After that, delete the entry in the app.
Lost Phone
An admin can turn off two-factor login for other users under Global Settings > User Management. Users with two-factor login have a 2FA badge, the shield button in the same row resets it. The user can then log in with the password only and set it up again.
config/users.json via FTP or the file manager of your host and delete the lines totp_secret and totp_last_step of the user. Also remove the comma at the end of the line before, so the file stays valid JSON."admin": {
"password_hash": "$2y$10$...",
"role": "admin",
"totp_secret": "ABCD...",
"totp_last_step": 59785887
}