Protect member accounts from takeover. Two-step sign-in with an authenticator app or SMS, a list of active sessions users can manage themselves, and e-mail alerts when someone signs in from somewhere new.
Google Authenticator & SMSSession controlLogin alertsWorks with any TOTP app
What your users get
Two-step verificationA 6-digit code from Google Authenticator, Microsoft Authenticator, 1Password, Authy or any TOTP app. Optional for users, or mandatory for everyone.
SMS codes & phone checkRequire a mobile number at registration and confirm it by SMS before the account is activated.
Active sessionsUsers see every device signed in to their account and can terminate unwanted sessions with one click.
Unusual-country checkSign-ins from a country the user has not used before need an e-mail confirmation first.
How sign-in is protected
For your users
Everything lives under My account → Password & security: change the password, see the security status at a glance and switch on two-step verification in about a minute. Changing the password signs the user out on all other devices.
My account · Password & security
UserSecurity status, password change and two-step verification in My account.
For you, in the admin area
All options are in Admin → Settings → Mods → Security. Choose the method (SMS or Google Authenticator), decide whether two-step is disabled, optional or mandatory, and set how strict session handling should be.
Admin · Settings · Mods · Security
AdminTwo-factor method and mode, session list, single-IP sessions and login notifications.
Settings at a glance
Two-factor method — SMS or Google Authenticator (any TOTP app).
Two-factor mode — Disabled, Optional or Mandatory for all users.
Require phone number at registration.
Session list in My account, with an option to let users terminate sessions; idle sessions are removed after a set time (72 hours by default).
Restrict sessions to a single IP — a stolen cookie is useless from another address.
Login notifications by e-mail and confirmation of sign-ins from an unusual country.
SMS delivery is billed through your SibSoft client area — top up the balance before enabling SMS, otherwise users will not be able to sign in. Google Authenticator needs no balance.