Two factor authentication adds a second verification step beyond a password, typically a one time code from an authenticator app or SMS. It dramatically improves account security against password theft.
The Two Factor Authentication contrib module adds this capability to Drupal. It supports multiple methods including TOTP codes from apps like Google Authenticator, Authy, and 1Password, plus backup recovery codes.
Enable the module, configure which roles need two factor authentication, and users are prompted to set it up on their next login. Administrators should always have two factor authentication enabled. For larger sites, consider making it mandatory for editors and other privileged roles too. The module integrates with Drupal’s user system cleanly and has minimal impact on the login experience once set up. It is one of the most effective security improvements you can make with minimal effort.