This project is not covered by Drupal’s security advisory policy.
The module adds a second step to the site login. After the user enters the correct password, they receive a 6-digit code by email and enter it to log in.
What it does
- After the username and password are entered, it sends a code to the account's email address.
- The code is valid for a limited time (15 minutes by default) and is kept in the session only as a hash.
- It counts failed attempts separately per user and per IP address, using Drupal's flood service. Starting a new session or requesting a new code does not reset the counters.
- It limits resending of the code (a pause between requests and a cap on codes per user).
- The check can be turned off for a single account (the "TFA enabled" field) or for the whole site (a checkbox in the settings).
- The email is configured in the admin UI: subject and body, core tokens, plus [tfa:code] and [tfa:lifetime]. Translations use the standard configuration translation.
Configuration
/admin/config/people/email-otp: enable or disable the check, code lifetime, number of failed attempts (per user and per IP), lockout period, code limit and the pause between resends.
Project information
- Project categories: Access control, Security
- Created by losewn on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
Releases
Development version: 1.x-dev updated 1 Nov 2026 at 11:17 UTC
