Force Multi-Factor Authentication For Super Users

What this check and mySites.guru tool looks at on your site

Since Joomla 4.2, you can require members of a specific user group to enrol in Multi-Factor Authentication (MFA) before they can use the site. This check reads the forceMFAUserGroups setting from your site’s Users configuration and looks for the Super Users group in that list.

Why optional MFA protects almost nobody

A Super User account is the most powerful account on a Joomla site. It can install extensions, edit the database through admin tools, add other administrators, and reach the server through the template and file editors. Joomla has offered MFA for years, but offering it is not the same as requiring it: when a second factor is available but optional, it gets set up by the people who were already careful, and skipped by everyone else, which in practice is most people. An account with MFA merely available and not enforced is protected by exactly one thing: a password.

Passwords fail in ordinary, unglamorous ways that have nothing to do with how strong the password itself is. A password reused from a forum, a SaaS tool, or an email provider that gets breached elsewhere turns up in a credential-stuffing list, and bots try it against every /administrator login form they can find, including yours, continuously, whether or not anyone is specifically targeting your site. A phishing email that looks like a Joomla update notice catches a tired admin on a Monday morning. Neither of those requires the attacker to be skilled, and neither depends on your password policy being weak. Both are stopped cold by MFA, because a stolen or correctly guessed password on its own is no longer enough to log in. That’s the entire value of forcing it: it removes the “available but skipped” failure mode for the one group of accounts where that failure is most expensive.

It also removes a decision from the admin’s hands, which is the point. Left optional, MFA enrolment competes with every other task on someone’s to-do list, and it reliably loses, not out of carelessness but because nothing forces the moment where it has to happen. Forcing it on the Super Users group turns “get round to it eventually” into “cannot use the site until it’s done”, which is the only version of this setting that reliably changes behaviour.

Walk through what actually happens without it. Automated tools continuously try lists of leaked email-and-password pairs, harvested from breaches at completely unrelated companies, against every /administrator login form they can reach, yours included, whether or not anyone has singled your site out specifically. Most attempts fail. All it takes is one Super User who reused a password that later turned up in one of those breaches, and the bot has a working login. With MFA merely available and not forced, that’s the entire attack: a match against a leaked list, a login, and full administrative control of the site, achieved without the attacker writing a line of code or finding a single bug in Joomla or any extension on it. With MFA forced, the same stolen password gets the bot to a second-factor prompt it cannot answer, and the attack stops there, at the one point that costs the attacker nothing to reach and everything to get past.

The friction this adds is real but small, and worth being honest about rather than pretending it’s free. A Super User now needs their phone or authenticator app to log in, not just a password, and that’s a genuine extra step every single time. Set against what that step buys, a hard stop against the single most common way administrator accounts actually get compromised, it’s a trade that comes out clearly in favour of forcing it, for the small number of accounts that hold the most power on the site.

Every Super User enrolled, no exceptions

Every account in the Super Users group is required to enrol in MFA before they can use the site, and there is no exemption quietly left off the list, including any account created after the setting was turned on. New Super User accounts inherit the requirement automatically, because it’s attached to the group rather than to the individual account.

How to fix it

1. Login to the Joomla administration, e.g. https://yoursite.com/administrator.
2. Go to Users, then Manage, then click Options (top right).
3. Open the Multi-factor Authentication tab.
4. Add your Super Users group to “Groups to force MFA on”.
5. Click the Save button.

Joomla supports several MFA methods out of the box, including a one-time-passcode authenticator app, a passkey, and email-based codes as a fallback, so this doesn’t force every administrator onto the same method. It forces the requirement, not the specific second factor, and each Super User can pick whichever method suits them from Users, then Manage, then editing their own account.

Nobody with an unenrolled Super User account gets locked out the instant you save this setting. Joomla prompts them to set up a method the next time they try to log in, and blocks further access to the administrator area until they’ve done it. That means the moment to fix this is right after you flip the setting, not weeks later when it quietly turns into an outage for someone who didn’t see the prompt.

This is also worth pairing with keeping the administrator area properly separated from the public site: see Shared Site And Administrator Sessions for why a shared session cookie widens what a front-end compromise can reach. MFA and session separation cover different stages of the same problem: MFA raises the bar on an attacker getting hold of a valid session in the first place, and keeping sessions separate limits what a session that does get stolen or hijacked can actually reach.

What mySites.guru does about it

mySites.guru checks every connected Joomla 4.2+ site for this setting and can force MFA on the Super Users group across every connected site with one click, rather than opening each site’s admin area individually.