Two-factor authentication (2FA) adds a one-time code on top of the root password when logging in to the admin panel.
Where
Admin panel → Security → Two-factor login (2FA).
Enable
- Open the module and scan the shown QR code with an authenticator app (Google Authenticator, Authy, 1Password, …), or enter the secret manually.
- Confirm with the current 6-digit code to activate.
After this, the admin login asks for the password and then the current 6-digit code.
If you lose the device
2FA can be disabled from the server over SSH (as root) by removing the stored 2FA secret for the admin, so a locked-out administrator can always recover with root shell access.
Webmail 2FA
Roundcube webmail has its own optional 2FA that each mailbox user turns on from webmail Settings; it is independent of the admin-panel 2FA.