--- title: "Feature Spotlight: Introducing multi-factor authentication in TYPO3 11.1" url: "https://b13.com/knowledge/introducing-multi-factor-authentication-in-typo3-11" description: The new multi-factor authentication feature is shipped with the latest version of TYPO3. Here’s an overview of what’s included. image: "https://b13.com/fileadmin/_processed_/7/a/csm_Multi-Factor_Authentication_191-1_d3698d93b8.png" date: 2021-03-01 modified: 2026-08-19 lastUpdated: 2026-08-19 --- # Feature Spotlight: Introducing multi-factor authentication in TYPO3 11.1 [ Security ](https://b13.com/knowledge/security) [ TYPO3 v11 ](https://b13.com/knowledge/typo3-v11) [ TYPO3 ](https://b13.com/knowledge/typo3) Feature Spotlight: Introducing multi-factor authentication in TYPO3 11.1 ========================================================================== ![](https://b13.com/fileadmin/_processed_/8/5/csm_oli_e138b22557.jpg)Oliver Bartsch 03 March 2021 [ RSS Feed ](https://b13.com/rss.xml) ![A smartphone displaying a locked screen with a password, a laptop showing a login form, and a key symbol, all set against a purple background with abstract shapes and icons representing security and verification.](https://b13.com/fileadmin/_processed_/b/9/csm_Multi-Factor_Authentication_7b552e5a2d.webp) Secure handling of login credentials has never been more important than it is today. Cybercrime has become increasingly focused on companies—not just private individuals. A company website’s content management system can become a target, too, especially since most CMS installations are now connected to an organization’s internal PIM or ERM system. As a result, TYPO3 is constantly improving its tools to secure user accounts. TYPO3 uses, among others, award-winning hash algorithms, a notification system to inform administrators about unusual behavior, and provides several security configuration options, like enforcing secure HTTPS protocol for authentication. These mechanisms can’t, however, protect you from the risks arising from weak or reused passwords. To address this concern, the IT world adopted multi-factor authentication (or MFA, for short) as a security standard. This method is currently considered the safest solution to increase user account protection. In multi-factor authentication, a user typically has to provide something he owns (this is where the “multi” factor comes in), in addition to the typical primary factor, something he knows, e.g. the username and password combination. ### You may be asking: How can a user provide something he owns? The simplest way is by entering a one-time password generated by a specific device or an application. Such code can only be used once and is only valid for a short time frame. To prove possession, users may also supply a real device, a so-called hardware token, which is quite similar to a USB-stick. Also providing an inherent factor, usually biometric data such as a fingerprint, is possible. The general rule of thumb is that anything that cannot be easily accessed by a third party could be considered something you own and therefore can be used as an additional factor. Do you have further questions about multi-factor authentication? ------------------------------------------------------------------ [ Get in touch ](https://b13.com/lets-connect) TYPO3 and MFA --------------- Since TYPO3 takes the security of its users really seriously, the recently released version 11.1 fully supports multi-factor authentication by default for every backend user. This is achieved through a completely new API allowing each TYPO3 installation to support as many MFA providers as needed. An MFA provider is one option that allows users to prove they possess an additional factor. ![MFA configuration module](https://b13.com/fileadmin/_processed_/e/d/csm_MFA_1_24b8198b65.webp) [ ](https://b13.com/fileadmin/Blog/Feature_Spotlight/MFA/MFA_1.png) MFA configuration module TYPO3 comes with two of these providers by default: The already mentioned **time-based one-time password** provider and the **recovery codes** provider. The **recovery codes** provider generates a set of codes the user must then store in a safe place. In the case he can not prove possession, e.g. because he lost his device that generates one-time passwords, these codes can be used as a fallback. It’s important to mention that the recovery codes, as well as any other provider-generated codes, can only be used after the first factor (something you know, like a username and password) has been successfully verified. You can’t try out different codes without fulfilling the first step. Furthermore, TYPO3 will automatically lock a provider if it was unsuccessful three times in a row. Therefore, it’s simply not possible to circumvent the second step just by guessing. How to set it up ------------------ To set up the **time-based one-time password** provider, you need an OTP-compatible device or application. Some examples are [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2), [Authy](https://authy.com/), or [1Password](https://1password.com/). If you have installed one of those applications or have your device at hand, navigate to your user settings. You will find a tab called “Account security”. This tab includes (next to the password change functionality) the “Multi-factor authentication providers” entry. The included button will get you to the new MFA configuration module, which displays all available MFA providers. To enter the setup view click on the Setup button. ![Time-based one-time password setup](https://b13.com/fileadmin/_processed_/7/8/csm_MFA_2_c2e66b77e3.webp) [ ](https://b13.com/fileadmin/Blog/Feature_Spotlight/MFA/MFA_2.png) Time-based one-time password setup Setup Steps: -------------- 1. Scan the displayed QR-code with your OTP application - Alternatively enter the displayed shared secret into your OTP application or device 2. Optionally define a custom name for this provider 3. Enter the six-digit code generated by your OTP application or device 4. Activate the provider by submitting the form (click on the save button) Congratulations, you have successfully activated your first MFA provider and thereby increased your account security tremendously. To make use of MFA’s full potential we also recommend activating the recovery codes provider. To do so, enter the setup view of the recovery codes provider, copy the displayed recovery codes in a safe place and submit the form. The activation will take some time since TYPO3 will encrypt your codes and store them securely. ![Active providers in the MFA configuration module](https://b13.com/fileadmin/_processed_/3/9/csm_MFA_3_917706cc53.webp) [ ](https://b13.com/fileadmin/Blog/Feature_Spotlight/MFA/MFA_3.png) Active providers in the MFA configuration module ![Authentication step](https://b13.com/fileadmin/_processed_/5/0/csm_MFA_4_3dc5e86829.webp) Authentication step How to authenticate --------------------- From now on, whenever you log into the TYPO3 backend, you’ll have to provide the additional factor after successfully passing the first one, e.g. your username and password. In the case of the one-time password provider, you have to enter the generated six-digit code from your OTP application or device and verify afterwards. If the one-time password can be verified, you will automatically be forwarded to the backend. In case you activated more than one provider, e.g. one-time password and recovery codes, you can freely select which MFA provider should be used for the additional authentication step on every authentication attempt. This comes in handy if you use different devices depending on your location or are temporarily unable to use your main provider, e.g., because you lost the corresponding device or just don’t have immediate access to it. To switch to an alternative provider, just click on the corresponding link below the current provider’s authentication mask. ![Provider locked notification](https://b13.com/fileadmin/_processed_/1/b/csm_MFA_5_ff95c42b0f.webp) Provider locked notification You’ll be notified if one of your providers gets locked by TYPO3. In that case, you won’t be able to use the locked provider anymore. If you nevertheless manage to log into the backend with another active provider, you may want to unlock the previously locked provider in the MFA configuration module. If you’ve lost your device irretrievably, just unlocking the provider won’t help and you have to completely deactivate the MFA provider. Afterwards, you can start over. Of course, this action can be performed at any time, in case you just don’t need a provider any longer or want to switch devices. ![Locked provider in the MFA configuration module](https://b13.com/fileadmin/_processed_/b/d/csm_MFA_6_a4f633dcce.webp) Locked provider in the MFA configuration module Administration of users‘ MFA ------------------------------ As an administrator, you may ask: How can I manage my users‘ MFA providers? Am I somehow able to enforce that users set up MFA at all? Good news. TYPO3 has also implemented various configuration and administration options. Your administered installation only fully benefits from MFA when every user has activated at least one provider. This can easily be enforced by setting the `$GLOBALS['TYPO3_CONF_VARS']['BE']['requireMfa']` variable. ![MFA is required information](https://b13.com/fileadmin/_processed_/f/b/csm_MFA_7_520990ce0a.webp) [ ](https://b13.com/fileadmin/Blog/Feature_Spotlight/MFA/MFA_7.png) MFA is required information It’s likely that not every provider is suitable for your users. This is why you are equipped with the ability to define the providers available for a user or user group straightforwardly in the corresponding records. You may also want to recommend a specific provider for your users. This is possible, using the `$GLOBALS['TYPO3_CONF_VARS']['BE']['recommendedProvider']` variable. Since this defines a provider globally for all users, you’ll also want to have a look at the related user TSconfig option “auth.mfa.recommendedProvider” which enables you to recommend a specific provider on a per user basis. Last but not least, there will probably be the moment when you receive an email from one of your users, notifying you that he has locked himself out. No worries, you can rest easy since TYPO3 allows you to deactivate MFA for every user in the corresponding user record. This allows the user to log in and set up MFA again. By the way, the “backend user module” gives you an overview of your users‘ current MFA status—whether MFA is enabled or currently locked—at any time. ![MFA administration in the user record](https://b13.com/fileadmin/_processed_/0/e/csm_MFA_8_1093a658f5.webp) [ ](https://b13.com/fileadmin/Blog/Feature_Spotlight/MFA/MFA_8.png) MFA administration in the user record ### Enable multi-factor authentication today Whether you’re an administrator or an editor, your account could be at risk on any given day. TYPO3 addresses these risks with a state-of-the-art security mechanism, and we’re already evaluating the next steps to improve your account’s security even more. So don’t hold back, activate your first MFA provider today—trust us, it’s easy. Have a question about multi-factor authentication? ---------------------------------------------------- [ Get in touch ](https://b13.com/lets-connect) ### Written by: ![Bild von Oliver Bartsch](https://b13.com/fileadmin/_processed_/8/5/csm_oli_91751adb73.webp) Oli is a TYPO3 Core developer who loves to collaborate with teammates on new TYPO3 features and bug fixes. His essential tool: PHPStorm. Oliver Bartsch Development [ more from Oliver Bartsch ](https://b13.com/team/oliver-bartsch) Related Articles ------------------ - ![Cartoon trophy character surrounded by hands giving thumbs up and a heart gesture, set against a gear-patterned background.](https://b13.com/fileadmin/_processed_/f/7/csm_T3ppy_Design_Kit_Headerbild_b51eb9dc31.webp) ### T3ppy Gives TYPO3 a Friendly Face 06 August 2026 | Florian “Flix” Keitgen TYPO3 is powerful—but it doesn’t have to feel impersonal. Meet T3ppy, our friendly companion for the backend. [ Read more: T3ppy Gives TYPO3 a Friendly Face ](https://b13.com/knowledge/t3ppy-design-kit) - ![Gavel labeled "AI" on a circuit-patterned background with yellow stars, symbolizing regulation or legislation related to artificial intelligence in the EU.](https://b13.com/fileadmin/_processed_/1/0/csm_EUAIAct_Headerbild_510724b3de.webp) ### AI Content in TYPO3: Labelling Needs Accountability 02 August 2026 | Benni Mack The EU AI Act brings the origins of AI-generated content into focus. AI Label marks AI-generated and AI-edited content in TYPO3 and records who signed off the published version—for… [ Read more: AI Content in TYPO3: Labelling Needs Accountability ](https://b13.com/knowledge/ai-content-in-typo3-labelling-needs-accountability) - ![A series of stylized figures in various poses, each with a distinctive orange hat, depict a progression from walking to standing still while looking at a phone, set against a purple grid background.](https://b13.com/fileadmin/_processed_/d/7/csm_QueuesDDEV_Headerbild_f640931350.webp) ### Better scalability with decoupled queues: How to set up RabbitMQ with TYPO3 10 April 2024 | Jochen Roth When built-in message transports hit their limits, RabbitMQ can provide TYPO3 with a scalable, robust message queue. [ Read more: Better scalability with decoupled queues: How to set up RabbitMQ with TYPO3 ](https://b13.com/knowledge/better-scalability-with-decoupled-queues-how-to-set-up-rabbitmq-with-typo3) - ![A cartoon character resembling a shield gives a thumbs up in front of a computer interface with various menu options.](https://b13.com/fileadmin/_processed_/e/6/csm_Header_cda1f80173.webp) ### Meet T3ppy: A New Era for Editorial Work in TYPO3 01 April 2026 | Florian “Flix” Keitgen T3ppy and the AiM extension bring AI directly into the TYPO3 backend—enhancing SEO, content quality, and workflows with centralized control. [ Read more: Meet T3ppy: A New Era for Editorial Work in TYPO3 ](https://b13.com/knowledge/meet-t3ppy-a-new-era-for-editorial-work-in-typo3) - ![Retro microphone illustration with a shopping cart icon in the background, symbolizing e-commerce or online shopping.](https://b13.com/fileadmin/_processed_/f/8/csm_Marketplace_Headerbild_ee1575614c.webp) ### Why TYPO3 Needs a Marketplace for Products 25 March 2026 | Florian “Flix” Keitgen A marketplace would make TYPO3 products more discoverable, easier to compare, and benefit both agencies and clients alike. [ Read more: Why TYPO3 Needs a Marketplace for Products ](https://b13.com/knowledge/why-typo3-needs-a-marketplace-for-products) - ![A hand holding a magnifying glass over a laptop screen displaying a webpage with an image and text elements.](https://b13.com/fileadmin/_processed_/e/5/csm_BackendUserSection_Headerbild_6093c842fd.webp) ### Unlocking TYPO3’s Hidden Gem: The Backend User Section (Doktype 6) 05 March 2026 | David Steeb Discover TYPO3’s underrated doktype 6 (Backend User Section) for secure internal previews, editor training, and prototyping. Learn real use cases, common pitfalls like 403 errors… [ Read more: Unlocking TYPO3’s Hidden Gem: The Backend User Section (Doktype 6) ](https://b13.com/knowledge/backend-user-section-in-typo3-uses-pitfalls-helper) - ![Two stylized web page designs featuring a user profile, image placeholders, and text sections, set against a light blue background.](https://b13.com/fileadmin/_processed_/2/0/csm_BackendPreview_Headerbild_b4c5799cfa.webp) ### Backend Previews With a System—Why We Built EXT:backendpreviews 09 February 2026 | David Steeb EXT:backendpreviews brings structure and consistency to content previews in the TYPO3 backend using Fluid templates, layouts, and partials. [ Read more: Backend Previews With a System—Why We Built EXT:backendpreviews ](https://b13.com/knowledge/backend-previews-with-a-system-why-we-built-extbackendpreviews) - ![A human hand shakes a robotic hand against a purple background with heart patterns, symbolizing collaboration between humans and technology.](https://b13.com/fileadmin/_processed_/6/2/csm_AIbotsLoveMarkdown_Headerbild_72fe5820d6.webp) ### The Internet Is No Longer Just for Humans—AI Bots Love Markdown 28 January 2026 | Benni Mack Discover why most web traffic is now automated and how TYPO3’s structured content model prepares websites for humans, editors, and AI systems. [ Read more: The Internet Is No Longer Just for Humans—AI Bots Love Markdown ](https://b13.com/knowledge/the-internet-is-no-longer-just-for-humans-ai-bots-love-markdown) - ![Several colorful web page mockups stacked together, showcasing different layouts and design elements against a purple background.](https://b13.com/fileadmin/_processed_/e/3/csm_CaminoTheme_Headerbild_d082598009.webp) ### Camino—The Need for a Default Theme in TYPO3 Is Real 27 January 2026 | Benni Mack With TYPO3 v14, Camino introduces a default theme that removes friction from first installs. Why this matters—and how TYPO3 laid the groundwork. [ Read more: Camino—The Need for a Default Theme in TYPO3 Is Real ](https://b13.com/core-insights/blog/camino-the-need-for-a-default-theme-in-typo3-is-real) - ![Graphic featuring stylized representations of a tower with the text "T3CON25 Düsseldorf" prominently displayed in the center.](https://b13.com/fileadmin/_processed_/7/b/csm_T3CON2025_Headerbild_fc9c5cc53e.webp) ### T3CON25—One Step Closer to the Future of Content Management 10 December 2025 | Franzi Töpler T3CON25 showcased the future of TYPO3 with insights on TYPO3 v14, AI, digital sovereignty, and open-source solutions driving secure, modern web experiences. [ Read more: T3CON25—One Step Closer to the Future of Content Management ](https://b13.com/knowledge/shaping-the-future-of-content-management-t3con25)