Enable two-factor authentication in WHMCS with a tested enrolment and recovery process. This reduces reliance on a password while preserving a controlled route for authorised users who lose their device.
IN THIS ARTICLE
01 Enable and test the service
- Confirm that the chosen 2FA service is available for your deployment and has the required provider configuration.
- Open System Settings and Two Factor Authentication. Activate and configure the intended service.
- Enrol an administrator through My Account and test a fresh login.
- Save the supplied recovery information in an approved private location separate from the routine login device.
- Test customer enrolment through Security Settings using a controlled client user.
- Only after validating enrolment and recovery, apply the intended global requirement for administrators or users.
02 Plan support and recovery
Document how staff verify identity before resetting a factor. A request from an unfamiliar email address should not be enough to remove protection from a billing or domain account. Record the authorised recovery action and require the user to enrol a replacement factor afterwards.
Keep server time synchronised. Time-based tokens depend on compatible clocks, so investigate time drift before assuming a user's password or account is broken.
03 Example: enrol an authenticator with Time Based Tokens
After the installation has enabled the Time Based Tokens service, each person completes enrolment for their own login.
| Account | Start here |
|---|---|
| Administrator | Open Account > My Account and toggle Two-Factor Authentication to On. |
| Client user | Open the account-name menu, choose Security Settings and select Click here to Enable. |
- Select Time Based Tokens and choose Get Started.
- Scan the displayed QR code with the user's authenticator app.
- Enter the current six-digit code generated by that app and choose Submit.
- Store the displayed Backup Code privately, then choose Close.
- Confirm that a fresh login accepts the password and the new authenticator code before requiring enrolment across the organisation.
Do not place the enrolment QR code or backup code in a support ticket or shared screenshot. This example covers Time Based Tokens; use the selected provider's own flow for Duo or another supported method.
Common questions
Can an administrator enrol a client's authenticator for them?
The client user should complete their own enrolment. WHMCS administrators can disable a user's factor through the documented recovery route, but that is different from setting up the user's private device.
Why did a correct-looking code fail?
Check that it belongs to the intended account, has not expired and that the device and server clocks agree. Do not repeatedly remove 2FA to hide a time issue.
Does an old Duo configuration remain suitable?
Use the current supported Duo Universal Prompt configuration where that provider is selected, and test it after updating the integration.
Review enrolment and recovery instructions during staff onboarding and periodically after provider or WHMCS upgrades.