I had enabled "two factor authentication" on a site with the Google Authentication Plugin, but discovered that an old administrator was still logging in to the admin.

It turns out that if you enable double authentication but don't activate it for a user, then it doesn't prompt that user.

That way if someone can hack your site somehow create an admin user or an old user they can log in without using double authentication.

My question is: Is there a way that double authentication is required for ALL admin users regardless of whether it has been enabled for each user?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.