Optional two-step verification by email: a six-digit code at sign-in, switchable by the customer or by you per user.
What it is
Two-step verification adds an emailed code to the password, so a stolen password alone is not enough to get in.
How it works
- When enabled, a correct password triggers a six-digit code to the account email, and the login card switches to a code form in place.
- Codes expire after five minutes, a resend is allowed after a short wait, and five wrong attempts burn the code so it cannot be guessed.
- Customers turn it on or off from the Account page; both directions require a fresh code, so a hijacked session cannot simply switch it off.
- You can enable or disable it for any user under Admin > Users > Edit Basic.
- The code email uses a notification template you can reword; if that template is off, a built-in message is sent instead so nobody gets locked out.
Where to find it
User side > Account > Two-step verification, and Admin > Users > Edit Basic.