Two Factor Authentication (2FA) Plugin for nopCommerce

The Two Factor Authentication for nopCommerce delivers robust, multi-layered identity verification for nopCommerce online stores. It protects store accounts against unauthorized access, credential stuffing, and account takeover attacks while keeping native customer accounts, checkout flows, and payment processing entirely seamless.

With a single plugin, merchants can deploy multiple verification channels—including Email OTP, SMS OTP (via NopStation SMS plugins), Authenticator Apps (Google Authenticator, Microsoft Authenticator TOTP with QR code scanning), and Single-use Backup Security Codes. Each authentication channel can be enabled independently, and 2FA eligibility can be restricted to specific customer roles (such as Administrators, Vendors, or B2B Customer Groups).

The plugin features an advanced, two-tier account recovery system available at, supporting instant self-service OTP recovery as well as manual, admin-reviewed recovery backed by security questions. Every login attempt, recovery step, and admin approval action is logged in a complete audit history, while sensitive tokens, OTPs, security answers, and TOTP secrets are protected with cryptographic hashing and ASP.NET Data Protection encryption.

• 1. Multi-Channel Verification Methods
  Support Email OTP, SMS OTP (through NopStation SMS plugins), Google Authenticator & Microsoft Authenticator (TOTP standard with QR code setup), and downloadable single-use backup security codes.
• 2. Customer Self-Service Security Hub
  Customers manage their authentication security directly from their account area (via an automated link added to account navigation). Customers can enable or disable 2FA, link or remove authenticator apps, generate and download backup codes, and set up security questions for account recovery.
• 3. Role-Based 2FA Eligibility & Enforcement
  Enforce multi-factor authentication strictly for high-privilege roles (e.g. Administrators, Vendors, B2B wholesale customer groups) or leave 2FA open for all customer roles.
• 4. Two-Tier Account Recovery Flow
  Self-Service Recovery: Identify account via email and optional last name, receive a one-time code via email or phone, and set a new password.
  Manual (Admin-Reviewed) Recovery: Answer saved security questions to submit a recovery request with IP logging. Admins review, approve/reject with notes, and trigger time-limited verification links.
• 5. Full Audit Trail & Status Tracking
  Every recovery event is recorded with requester IP address and step history. Requests move through clear status states: Pending, Under Review, Approved, Verification Email Sent, Email Verified, Password Reset Required, Completed, Rejected, and Expired.
• 6. Admin Security Question Management
  Create, edit, search, reorder, and activate custom security questions that customers can choose from during security setup.
• 7. Granular Admin Controls & Settings
  Configure OTP code length (default: 6 digits), OTP expiration (default: 10 mins), resend interval (default: 60s), maximum failed attempts (default: 5), generated backup codes count (default: 10), required answers for manual recovery (default: 2), and verification link lifetime (default: 24h).
• 8. Enterprise-Grade Security Architecture
  OTPs, backup security codes, security answers, and recovery tokens are stored as secure cryptographic hashes. Authenticator secret keys are encrypted with ASP.NET Data Protection. Anti-forgery protection is built into customer forms, and email identification steps prevent account enumeration.
• 9. Role-Based Admin Access Permissions
  Three granular permissions allow delegation of staff responsibilities: Manage Settings, Manage Security Questions, and Manage Recovery Requests.
• 10. Custom Email Templates & Localization
  Installs three editable nopCommerce message templates: 2FA Email OTP, Account Recovery OTP, and Recovery Email Verification. All admin and storefront strings support standard nopCommerce localization resources.
• 11. One-Click Installation & Clean Uninstall
  Default settings and message templates install automatically. Uninstallation cleanly removes settings, permissions, and system registrations without leaving orphaned database artifacts.

• What verification methods does the 2FA Security Plugin support? +
  The plugin supports Email OTP, SMS OTP (via NopStation SMS plugins), Authenticator Apps (Google Authenticator, Microsoft Authenticator, Authy TOTP with QR code scanning), and downloadable single-use Backup Security Codes.
• Can I enforce 2FA strictly for Administrators or specific customer roles? +
  Yes! Merchants can configure eligible customer roles. You can mandate 2FA for Administrators, Vendors, or B2B buyers while keeping 2FA optional or disabled for standard retail shoppers.
• How does account recovery work if a customer loses their mobile device? +
  Customers can visit /account-recovery. They can recover via self-service OTP verification or submit a manual recovery request by answering pre-set security questions. Manual requests are held for admin review with IP logging and audit tracking.
• Are authentication secrets and OTP codes stored securely? +
  Yes. All OTPs, backup security codes, recovery tokens, and security answers are stored as cryptographic hashes. Authenticator secret keys are encrypted using ASP.NET Data Protection.
• Does the plugin support multi-store and multi-vendor nopCommerce installations? +
  Yes. Multi-store isolation, vendor scoping, ACL permissions, and customer-ownership checks are fully supported across all nopCommerce multi-store and multi-vendor setups.

The Two Factor Authentication Plugin for nopCommerce offers a comprehensive, enterprise-grade multi-factor authentication and account recovery solution. From multi-channel OTPs and TOTP authenticator app support to role-based enforcement, security question management, admin audit history, and anti-forgery safeguards, this plugin empowers merchants to secure customer and administrative access while protecting store reputation and sensitive data.