HF PanelTwo-step sign-in
Make two-step sign-in optional or required for administrators, team members, resellers and customers, with a grace period, and reset it.
Two-step sign-in adds a second step after the password: a 6-digit code from an authenticator app, or a passkey (fingerprint, face or device PIN). Recovery codes come with either, for a lost phone. On this screen you decide who must use it, how long people have to set it up, and you can reset a person's two-step sign-in when they lose their phone.
Where: Server Admin › Security › Two-step sign-in
Choose the policy
The Policy card has one line per role:
| Role | Who it covers |
|---|---|
| Administrators | every administrator login, read-only staff logins too |
| Team members | the team members customers invite to their account |
| Resellers | every reseller |
| Customers | every hosting account |
For each role pick Optional or Required, set the Grace period (days) and click Save. Required since shows when a role became required.
Note: the older switch "Require two-factor login for administrators and resellers" under Settings follows this screen: it is on when both roles are required.
What people see
When a role is Required and a person has neither an authenticator app nor a passkey:
- During the grace period they sign in as usual and a banner at the top of every screen says by which date they must set it up (Set it up now opens the setup screen). The grace period starts when the role became required, or when the login was made if that is later.
- After the grace period the password is followed by the Set up two-step sign-in screen. Nothing else opens until
they add an authenticator app (scan the QR code, type a code) or a passkey. They then see their recovery codes once.
A grace period of
0means this happens at the next sign-in.
People who already have a second step are asked for it after the password: the code from their app, or — when they only have a passkey — their passkey. A recovery code works in place of either. Signing in with a passkey alone counts as two-step.
HF Files and HF Studio sign in with the same accounts and follow the same policy: they ask for the authenticator code. Someone who only has a passkey is told to sign in to the Control Panel and open the app from there. Webmail (HF Mail) signs in with mailbox passwords, not panel logins, so the policy does not apply to it.
Team members set up their second step on their own login screen (My login). The account owner can also require it of their team on the Team screen; that requirement has no grace period.
Resellers
A reseller can require two-step sign-in for their own customers on the same screen in the Reseller Panel (Require two-step sign-in for my customers). It uses your grace period. See Two-step sign-in for resellers.
Who has set it up
The counters at the top show, per role, how many logins have a second step, how many are in the grace period and how many are overdue. The Logins list shows each login's Second step (Authenticator app, Passkey, App and passkey, Not set up yet with the last day, Must set up at sign-in or Off) and last sign-in. Search by name or email, or pick a role.
Reset a person's two-step sign-in
When someone loses their phone and has no recovery codes left, click Reset next to them and confirm. Their
authenticator app, recovery codes and passkeys are removed; they set two-step sign-in up again at their next sign-in
(at once if their grace period is over). The reset is written to the Activity log of
both sides and raises the twostep.reset hook. You can't reset your own login here.