<blockquote>
  <p>Is there a 2-factor authentication plugin for Craft?</p>
</blockquote>

<p>I've heard of one in private testing, but I'm not aware if they plan to release it publicly or not.</p>

<p>Until the official Craft plugin store becomes a thing, the most comprehensive list of Craft plugins available I know of is over on the awesome <a href="https://straightupcraft.com/craft-plugins/" rel="nofollow">Straight Up Craft</a>.</p>

<blockquote>
  <p>I want to build a system that someone on a dynamic IP could access, so static IP's are a bit harder.</p>
</blockquote>

<p>O.K. What's the reasoning there, if you don't mind me asking?</p>

<blockquote>
  <p>I was also thinking if there was a way to add another field to the login page, which was a decryption key, then use one the twig decryption method. If you don't have it, you'd see the data, but it would be all garbled up.</p>
</blockquote>

<p>Not currently, but we've discussed giving plugins the ability to control the HTML of the login page.  Probably worth making an <a href="http://feedback.craftcms.com" rel="nofollow">official feature</a> request for that.</p>

<p>It is worth mentioning that there is an <a href="https://craftcms.com/docs/plugins/events-reference#userSession-onBeforeLogin" rel="nofollow">onBeforeLogin</a> event a plugin can already listen to and apply their own custom password business logic (i.e. must be 200 characters long, have 40 emojis, 20 Egyptian hieroglyphs, be purple and only work on Tuesday).</p>

CC BY-SA 3.0
2016-01-15T22:12:15.073Z
We'd like to make a project management system that's specific to our particular work flow. We've tried various products on the market, the closest one to our needs being TeamWork, but it still doesn't have some of the things we need in a PMS. We have an employee working out of salt lake who would need to log in to the system who logs in over static IP's. We may end up just setting up a local server, and find a solution which would add IP's to the server whitelist.
Dustin C
CC BY-SA 3.0
2016-01-16T05:55:23.907Z
An IP whitelist is definitely the way to go.  There is no inherent way to for PHP to determine if a request's IP address was statically assigned or dynamically assigned to the client.
Brad Bell
CC BY-SA 3.0
2017-05-17T14:18:10.923Z
For reference here is a plugin (currently in beta) for 2-facor authentication. https://github.com/born05/craft-twofactorauthentication
zizther
CC BY-SA 3.0
2016-01-15T05:08:47.057Z
2016-01-15T07:34:20.760Z
2016-01-15T07:34:20.760Z
Brad Bell
<p>Is there a 2-factor authentication plugin for Craft? Or is there a way to secure the login for Craft CMS beyond the common installation instructions? I want to build a system that someone on a dynamic IP could access, so static IP's are a bit harder.</p>

<p>I was also thinking if there was a way to add another field to the login page, which was a decryption key, then use one the twig decryption method. If you don't have it, you'd see the data, but it would be all garbled up.</p>

<plugins><login><security>
Is there a 2-factor auth plugin?
# Is there a 2-factor auth plugin?

(Asked by: username_0 on 2016-01-14)

Is there a 2-factor authentication plugin for Craft? Or is there a way to secure the login for Craft CMS beyond the common installation instructions? I want to build a system that someone on a dynamic IP could access, so static IP's are a bit harder.

I was also thinking if there was a way to add another field to the login page, which was a decryption key, then use one the twig decryption method. If you don't have it, you'd see the data, but it would be all garbled up.

**Tags:** plugins, login, security


---

## 1 answers

### Answer by username_1 on 2016-01-15. Score: 4 | Accepted answer

> Is there a 2-factor authentication plugin for Craft?

I've heard of one in private testing, but I'm not aware if they plan to release it publicly or not.

Until the official Craft plugin store becomes a thing, the most comprehensive list of Craft plugins available I know of is over on the awesome [Straight Up Craft](https://straightupcraft.com/craft-plugins/).

> I want to build a system that someone on a dynamic IP could access, so static IP's are a bit harder.

O.K. What's the reasoning there, if you don't mind me asking?

> I was also thinking if there was a way to add another field to the login page, which was a decryption key, then use one the twig decryption method. If you don't have it, you'd see the data, but it would be all garbled up.

Not currently, but we've discussed giving plugins the ability to control the HTML of the login page. Probably worth making an [official feature](http://feedback.craftcms.com) request for that.

It is worth mentioning that there is an [onBeforeLogin](https://craftcms.com/docs/plugins/events-reference#userSession-onBeforeLogin) event a plugin can already listen to and apply their own custom password business logic (i.e. must be 200 characters long, have 40 emojis, 20 Egyptian hieroglyphs, be purple and only work on Tuesday).

> **Comments:**
> **username_0**: We'd like to make a project management system that's specific to our particular work flow. We've tried various products on the market, the closest one to our needs being TeamWork, but it still doesn't have some of the things we need in a PMS. We have an employee working out of salt lake who would need to log in to the system who logs in over static IP's. We may end up just setting up a local server, and find a solution which would add IP's to the server whitelist.  
> **username_1**: An IP whitelist is definitely the way to go.  There is no inherent way to for PHP to determine if a request's IP address was statically assigned or dynamically assigned to the client.  
> **username_2**: For reference here is a plugin (currently in beta) for 2-facor authentication. https://github.com/born05/craft-twofactorauthentication  

---

