Add an extra layer of login security to your WHMCS installation with email-based two-factor authentication.
Email 2FA for WHMCS sends a one-time passcode to the user’s registered email address after they enter their username and password. The user must enter the valid code before access is granted.
The module supports WHMCS clients, sub-account users, and administrators, making it a complete email authentication solution for your entire WHMCS platform.
After a user enters their correct WHMCS login credentials, the module generates a secure one-time passcode and sends it to the email address associated with their account.
The code can only be used once and expires automatically after the configured time. Codes are stored securely as hashes rather than plain text.
Administrators can control:
Email 2FA includes built-in protection against repeated code guessing.
When a user exceeds the configured number of failed attempts, verification is temporarily locked. Repeated offences can trigger progressively longer lockout periods, helping protect accounts from automated attacks.
Users can optionally select Trust this device during login to avoid entering a verification code every time.
Administrators can choose how trusted access is recognized:
The trusted period can be configured for a specific number of days, and administrators can view or revoke trusted devices when required.
When enabled, users receive one-time backup codes during 2FA activation.
These codes allow users to access their account if they temporarily lose access to their email inbox. Each backup code can only be used once.
Users can create a personal anti-phishing phrase that appears inside every legitimate verification email.
This helps users identify authentic authentication emails and recognize suspicious or fraudulent messages.
Create branded authentication emails directly from the WHMCS admin area.
You can customize:
Available merge fields include the recipient’s name, verification code, code validity, login IP, company name, date, logo, and anti-phishing phrase.
A built-in test-send option allows administrators to confirm email appearance and delivery before enabling the module for users.
Email 2FA can be enabled for:
Clients and administrators can activate Email 2FA through their existing WHMCS security settings.
WHMCS enforcement options can also be used to require users or administrators to configure two-factor authentication on their next login.
During login, users receive a clear and responsive verification screen where they can:
The challenge interface is responsive, theme-independent, and designed to work with both left-to-right and right-to-left languages.
The included addon dashboard gives administrators access to:
Administrators can also view a user’s Email 2FA status directly from the client summary page.
Authentication events can be recorded for security monitoring and troubleshooting.
Administrators can enable email masking to reduce exposure of personal information in logs and configure how long log entries should be retained.
Old logs, expired verification codes, and expired trusted-device records can be removed automatically through cron cleanup.
The module can suppress the WHMCS global BCC setting specifically for 2FA emails.
This helps prevent sensitive one-time passcodes from being copied to a shared BCC mailbox while leaving the global BCC behavior unchanged for other WHMCS emails.
Whether you manage a hosting business, domain reseller platform, SaaS service, or client portal, Email 2FA for WHMCS helps reduce unauthorized account access by adding a secure email verification step to every protected login.
Be the first to review Email 2FA for WHMCS.
The best place to start if you need help with a specific product is to contact the developer. All WHMCS Marketplace developers have both a website and support URL listed.
password_hash storage, single-use, time-boxed, constant-time verify.EmailPreSend hook).
A simplistic, free & open source hook allowing instant Discord notifications when an action is triggered.
Netgsm Sms addon provides you sending customized bulk sms and creating sms templates.
MSG91 WHMCS SMS plugin gives you the power and flexibility to stay connected with your customers by sending them an SMS and OTP's for 2FA at the crucial steps that matters the most.
