This article is part of the X-Cart Two-Factor Authentication (2FA) Guide.
To ensure maximum security for your store's backend, a Root Administrator can make Two-Factor Authentication (2FA) mandatory for all administrator accounts. When this global setting is enabled, all administrators who haven't configured 2FA yet will be forced to do so during their next login attempt.
How to enforce 2FA
To require 2FA for all admin users:
In your X-Cart Admin area, go to Store > Users.
Locate the Require 2FA for all admins toggle at the top of the user list.
Switch the toggle to ON.
Once enabled, a new 2FA Status column will appear in the users list. A green shield icon indicates that an administrator has 2FA enabled, while a red shield indicates it is not yet configured.
How enforcement affects administrators
Enabling this setting changes the login and profile management flow for your staff:
Forced Setup on Login: If a secondary administrator does not have 2FA configured, they will be greeted with a non-skippable Two-Factor Authentication Required screen after entering their password. They will not be able to access the admin area until they complete the 2FA setup and save their backup codes.
Inability to Remove 2FA: Administrators will no longer be able to disable 2FA for their own accounts. The Remove 2FA button in their profile settings will be disabled (greyed out) with a tooltip stating: "2FA is enforced by the administrator and cannot be removed."
Important: Before enforcing 2FA for all administrators, we highly recommend that you (the Root Administrator) configure 2FA for your own account and save your backup codes in a secure location to prevent accidental lockouts.
Can't find answers you're looking for?
Email us at support@x-cart.com. We will be happy to help!
Related articles