Would be awesome to have some form of multi-factor authentication in front of the /ghost admin login. Lack of MFA + rate limiting makes it highly susceptible to brute force. Anyone know of any workarounds?

In addition to existing brute-force protection, support for device verification and email-based MFA has been released: [image] Device verification & email 2FA Security improvements for staff user authentication

We will be hopeful. [image] Leveraging 3rd party sign-in Developer help Hello wave Ghost community, I’ve spent a bit of time clicking through this great community and I’m specifically searching for some thoughts/ideas/solutions to this one burning question. Can Ghost us…

I would really like to secure my newsletter login with 2FA. Many hacks nowadays are stopped by such mechanisms.

I would like to see Passkeys implemented.

Is there any update or official update from Ghost in regards to if 2FA/MFA feature is being worked on?

I know there is already a thread, but wanted to express that MFA should be without question the top priority for new features. No plugins – MFA built in to the product like any other app. I cannot even think of a single other app I use that doesn’t have MFA. I love Ghost but this really confuses …

We need this feature. Anti-bruteforce protection can only go to far and 2FA is designed to be a combination of something you know(which can be prone to phisihing and stuff) and something you have which tends to be less prone to phishing and increases security and is standard is most businesses.

Any updates here? …also voting 2FA up! This is an essential feature that’s missing.

It is honestly really bad to still have no MFA option at all. I know 3 companies (make millions of dollars) that will not use Ghost because no MFA. Basically trying to lose money by not having this. It would probably take 4-5 hours of work max to implement something basic like Email Only MFA and …

Just started using Ghost a couple of weeks ago and I am very impressed by it. The one thing I am curious about is how Multi-Factor authentication is not a feature/required on the /ghost admin page. I also understand that there is brute force protection, I believe the limit is 5 per hour by IP, but…

Commits related to this are starting to appear. [WIP] Staff 2-factor-auth TryGhost:main ← TryGhost:staff2fa opened 03:31PM - 07 Oct 24 UTC (UTC) [kevinansf…

Multi-factor authentication

Ideas

Topic		Replies	Views
Two factor authentication? Developer help	22	6287	April 23, 2024
[Let's do it] SSO for Ghost Developer help	28	3666	April 29, 2026
Best method to integrate 2FA for our members and staff? Using Ghost	1	1207	May 9, 2025
2FA auth slider is missing? Developer help	10	203	April 14, 2025
Cannot login to ghost admin. "There was a problem on the server." message appears Developer help	11	1741	June 29, 2025

Multi-factor authentication

Related topics