Magento 2 Two-Factor Authentication extension

Cookie name	Description	Lifetime	Provider
_ce.clock_data	Store the difference in time from the server's time and the current browser.	1 day	Crazy Egg
_ce.clock_event	Prevent repeated requests to the Clock API.	1 day	Crazy Egg
_ce.irv	Store isReturning value during the session	Session	Crazy Egg
_ce.s	Track a recording visitor session unique ID, tracking host and start time	1 year	Crazy Egg
_hjSessionUser_2909345	Store a unique user identifier to track user sessions and interactions for analytics purposes.	1 year	HotJar
_hjSession_2909345	Store session data to identify and analyze individual user sessions.	1 day	HotJar
apt.uid	Store a unique user identifier for tracking and personalization.	1 year	Mageplaza
cebs	Store user preferences and settings.	Session	Mageplaza
cf_clearance	Store a token that indicates a user has passed a Cloudflare security challenge.	1 year	Cloudflare
crisp-client	The crisp-client/session cookie is used to identify and maintain a user session within the Crisp platform. It allows the live chat system to recognize returning users, maintain chat history, and ensure continuity in customer service interactions.	Session	Crisp
_ga	Store a unique client identifier (Client ID) for tracking user interactions on the	2 years	Google
_ga_7B0PZZW26Z	Store session state information for Google Analytics 4.	2 years	Google
_ga_JTRV42NV3L	Store session state information for Google Analytics 4.	2 years	Google
_ga_R3HWQ50MM4	Store a unique client identifier (Client ID) for tracking user interactions on the website.	2 years	Google
_gid	Store a unique client identifier (Client ID) for tracking user interactions on the website.	1 day	Google
_gat_UA-76130628-1	Throttle the request rate to Google Analytics servers.	1 day	Google

Cookie name	Description	Lifetime	Provider
_gcl_au	The cookie is used by Google to track and store conversions.	1 day	Google
__Secure-3PAPISID	This cookie is used for targeting purposes to build a profile of the website visitor's interests in order to show relevant and personalized Google advertising.	2 years	Google
HSID	This security cookie is used by Google to confirm visitor authenticity, prevent fraudulent use of login data and protect visitor data from unauthorized access.	2 years	Google
__Secure-1PSID	This cookie is used for targeting purposes to build a profile of the website visitor's interests in order to show relevant and personalized Google advertising.	2 years	Google
SID	This security cookie is used by Google to confirm visitor authenticity, prevent fraudulent use of login data and protect visitor data from unauthorized access.	2 years	Google
APISID	This cookie is used by Google to display personalized advertisements on Google sites, based on recent searches and previous interactions.	2 years	Google
__Secure-1PAPISID	This cookie is used for targeting purposes to build a profile of the website visitor's interests in order to show relevant and personalized Google advertising.	2 years	Google
__Secure-3PSID	This cookie is used for targeting purposes to build a profile of the website visitor's interests in order to show relevant and personalized Google advertising.	2 years	Google
SSID	This cookie is used by Google to display personalized advertisements on Google sites, based on recent searches and previous interactions.	2 years	Google
SAPISID	This cookie is used by Google to display personalized advertisements on Google sites, based on recent searches and previous interactions.	2 years	Google
__Secure-3PSIDTS	This cookie collects information about visitor's interactions with Google services and ads. It is used to measure advertising effectiveness and deliver personalised content based on interests. The cookie contains a unique identifier.	2 years	Google
__Secure-1PSIDTS	This cookie collects information about visitor's interactions with Google services and ads. It is used to measure advertising effectiveness and deliver personalised content based on interests. The cookie contains a unique identifier.	2 years	Google
SIDCC	This security cookie is used by Google to confirm visitor authenticity, prevent fraudulent use of login data, and protect visitor data from unauthorized access.	3 months	Google
__Secure-1PSIDCC	This cookie is used for targeting purposes to build a profile of the website visitor's interests in order to show relevant and personalized Google advertising.	1 year	Google
__Secure-3PSIDCC	This cookie is used for targeting purposes to build a profile of the website visitor's interests in order to show relevant and personalized Google advertising.	1 year	Google
1P_JAR	This cookie is a Google Analytics Cookie created by Google DoubleClick and used to show personalized advertisements (ads) based on previous visits to the website.	1 month	Google
NID	Show Google ads in Google services for signed-out users.	6 months	Google

Cookie name	Description	Lifetime	Provider
_dc_gtm	Manage and deploy marketing tags through Google Tag Manager.	1 year	Google
1P_JAR	Gather website statistics and track conversion rates for Google AdWords campaigns.	1 month	Google
AEC		1 month	Google
ar_debug	Debugging purposes related to augmented reality (AR) functionalities.	1 month	Doubleclick
IDE	The IDE cookie is used by Google DoubleClick to register and report the user's actions after viewing or clicking on one of the advertiser's ads with the purpose of measuring the effectiveness of an ad and to present targeted ads to the user.	1 year	Doubleclick
ad_storage	Enables storage, such as cookies (web) or device identifiers (apps), related to advertising.	1 year	Google
ad_user_data	Sets consent for sending user data to Google for online advertising purposes.	1 year	Google
ad_personalization	Sets consent for personalized advertising.	1 year	Google
analytics_storage	Enables storage, such as cookies (web) or device identifiers (apps), related to analytics, for example, visit duration.	1 year	Google

Problems

It has become easy to steal users credentials using key loggers, phishing attacks, viruses etc. Many stores are attacked due to the the low security of admin accounts. Meanwhile, in Magento 2 default, the process to sign in admin account is quite simple using username and password. Therefore, the account information is likely to be vulnerable to malicious stealing activities.

In some cases, store owners would like to set specific access right to different admins: less or more authentication.

Solutions

Magento 2 Two-Factor Authentication extension provides an extra layer using authentication code is required when there is any login attempt to admin panel. This second factor strengthens the defense wall of admin accounts and keep safe for store confidential data.

Employees taking up admin roles can use personal mobiles to verify access easily while keep ensuring security for their stores as well as sensitive business data. As a result, administration job becomes more professional and secured.

Moreover, store owners can save security cost on using any assistance software or resetting password thanks to the support of two authentication factor. This is the great beneficial feature of 2FA.

How to Configure Magento 2 Two-Factor Authentication

Two-Factor authentication to access admin account

Forcing to use Two-factor authentication
Support from mobile authentication apps

Magento 2 Two-Factor Authentication (2FA) requires admin users to pass two verification steps to access store data. The first step is simple with the password and username and the second step is much more secured with unique authentication code. Any steps fails to pass, the admin users will fail to access. As a result, the store data is protected safely.

Mobile authentication app integration is well supported in this extension. The apps such as Authy, Google Authentication will create a confirmation code to help admins account to register 2FA after scanning QR or using manual key. After successfully registering, a unique code which will be provided by the apps for 2FA verification every time an admin logs in.

No requirement if being trusted

Activate trusted device function, set trusted time
Quick login without authentication code in the next login

One of the most noticeable feature of this extension is setting trusted device function. In case the admin would like to avoid the verification being repeated every time signing in, it is easy to set the account as the trusted device within a specific time period (e.g.,30 days, 60 days).

It is very easy to enable trusted device and set the trusted time by days from the extension configuration section. Then after the first time confirming the account successfully, as long as within the trusted time, the second verification is not required for the next login times. With this feature, it is time-saving for key store admins whose accounts are believed to be reliable.

Trusted device list

It is easy to manage all trusted verified admin roles by the Trusted Device list. The information of logged users are recorded clearly with the following details:

Device Name

IP address

Address

Last login time

Besides, super admin or store owners can easily remove any admin accounts from the trusted device in case there is any account updates. Therefore, admin panel can be protected well from the ill-intentioned access.

AVADA Marketing Automation by Mageplaza (recommended)

All-in-one platform for email marketing that allows you to:

Follow up and convert customers by Automation Campaigns: Welcome series, Abandoned Cart emails, Order follow up, Cross-sell, Upsell emails

Promote your brand and quickly drive sales by sending mass Newsletter Emails

Send your messages to the right people and increase conversions with Advanced Segmentation

Collect leads and deliver promotions with stunning Signup Forms, and Spin to Win

Learn more

More features of Magento 2 Two-Factor Authentication

Force Using 2FA

Enable/ Disable requiring users to register 2FA.

Trusted Time

Set trusted time by days.

Reset by command line

Able to reset two factor authentication for an admin by using command line

Mobile friendly

Be well responsive with mobiles, desktop, tablets, and other screen sizes.

Pricing
Choose your suitable edition

Community

Crafted for a great webstore start FREE

Access to free lifetime updates
Technical support is NOT included - please buy support package if needed
Read our policies

Supports for Magento 2 Community Edition

Enterprise/ Magento Cloud

Great for an enterprise solution $ 200 first year

Free updates within subscription time
Free support within subscription time
Read our policies

Supports for Magento 2 Enterprise Edition
Highest priority support

Full features list

Frequently Asked Questions (FAQs)

Kindly follow this guide. Firstly, turn off Forcing to use 2FA function. Then the admin accounts which is not set as trusted device and turn on 2FA will have to use 2FA.

Yes, you can easily see from admin backend and click on remove button to do any removing accounts.

There are two steps. The first is simple with username and password, the second is authentication code provided by the mobile authentication app

We recommend you use Authy and Google Authentication for the best result.

You can do by enabling the trusted device function and set the trusted time by days. Then, in the first login, click on Trust this device for x days. It can be done properly.

Reviews (6)

21 December 2022

Thanks for the support service

It works exactly as described. The after sell support service is very fast. thanks

walter -Verified Purchase

06 May 2022

Recommended

This extension makes sense if you want to protect your site. Totally recommended!

Lizzy -Verified Purchase

20 April 2022

IMPRESSIVE

Great way to protect my store. Amazingly, it's free. I'll come back for more extensions from you.

Dave -Verified Purchase

03 February 2021

Secure

This helps us to set admins and trusted devices quickly so that we don't have to worry about security issues. It's a must-have for stores with many admins. Easy to configure as well.

Jim Burton -Verified Purchase

28 January 2021

First-time customer

I wanted to find a more secure way to protect my site. Luckily to find this. The design was beautiful and surprisingly it's free. I'm looking forward to using your other extensions.

Emily Howard -Verified Purchase

12 September 2019

Perfect as always

I want to say the extension is beautiful from the design, security function, but support is the most impressive. They offer their great help when I need it. Wish that I could purchase all my extensions from Mageplaza. It is surely beyond FIVE STAR support compared to other vendors in the Magento market.

Kathryn -Verified Purchase

Leave a Review

How do you rate this product?