# Force Multi-Factor Authentication For Super Users 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Joomla configuration](https://mysites.guru/tools/joomla-configuration/) 4. Force Multi-Factor Authentication For Super Users # Force Multi-Factor Authentication For Super Users ![Force Multi-Factor Authentication For Super Users](https://mysites.guru/_astro/force-mfa-for-super-users.CBn_8ABR_2iMkNI.webp) Joomla 6.1 is the first version that lets you require MFA for Super Users, under Users > Manage > Options. How to enforce it and why earlier versions couldn't. ## Quick answer On Joomla 6.1 or newer, go to Users > Manage > Options, open the Multi-factor Authentication tab and add your Super Users group to "Enforce Multi-factor Authentication". Joomla 4.2 to 6.0 don't offer the Super Users group in that field. Article Contents - [How the Super User MFA check works](#how-the-super-user-mfa-check-works) - [Why optional MFA protects almost nobody](#why-optional-mfa-protects-almost-nobody) - [Every Super User enrolled, no exceptions](#every-super-user-enrolled-no-exceptions) - [Enforcing MFA for the Super Users group](#enforcing-mfa-for-the-super-users-group) - [Forcing MFA across Joomla 6.1+ sites](#forcing-mfa-across-joomla-61-sites) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) How common is this? - 98.4% of the Joomla sites we have this data for fail this check. Platform: Joomla. Measured across the sites we audit, on each site's most recent snapshot. ## How the Super User MFA check works Since Joomla 6.1 you can require the Super Users group to enrol in Multi-Factor Authentication (MFA) before they can use the site. This check reads the `forceMFAUserGroups` setting from your site’s Users configuration and looks for the Super Users group in that list. Per-group enforcement has existed since Joomla 4.2, but the Super Users group was filtered out of the field until 6.1, so on earlier versions there was nothing an administrator could select. See [Force MFA on Super Users Across Every Joomla Site You Manage](https://mysites.guru/blog/force-mfa-on-joomla-super-users-across-every-site/) for what changed and how to roll it out. ## Why optional MFA protects almost nobody A Super User account is the most powerful account on a Joomla site. It can install extensions, edit the database through admin tools, add other administrators, and reach the server through the template and file editors. Joomla has offered MFA for years, but offering it is not the same as requiring it: when a second factor is available but optional, it gets set up by the people who were already careful, and skipped by everyone else, which in practice is most people. An account with MFA only available and not enforced is protected by exactly one thing: a password. Passwords fail in ordinary, unglamorous ways that have nothing to do with how strong the password itself is. A password reused from a forum, a SaaS tool, or an email provider that gets breached elsewhere turns up in a credential-stuffing list, and bots try it against every `/administrator` login form they can find, including yours, continuously, whether or not anyone is specifically targeting your site. A phishing email that looks like a Joomla update notice catches a tired admin on a Monday morning. Neither of those requires the attacker to be skilled, and neither depends on your password policy being weak. Both are stopped cold by MFA, because a stolen or correctly guessed password on its own is no longer enough to log in. That’s the entire value of forcing it: it removes the “available but skipped” failure mode for the one group of accounts where that failure is most expensive. It also removes a decision from the admin’s hands, which is the point. Left optional, MFA enrolment competes with every other task on someone’s to-do list, and it reliably loses, not out of carelessness but because nothing forces the moment where it has to happen. Forcing it on the Super Users group turns “get round to it eventually” into “cannot use the site until it’s done”, which is the only version of this setting that reliably changes behaviour. Walk through what actually happens without it. Automated tools continuously try lists of leaked email-and-password pairs, harvested from breaches at completely unrelated companies, against every `/administrator` login form they can reach, yours included, whether or not anyone has singled your site out specifically. Most attempts fail. All it takes is one Super User who reused a password that later turned up in one of those breaches, and the bot has a working login. With MFA only available and not forced, that’s the entire attack: a match against a leaked list, a login, and full administrative control of the site, achieved without the attacker writing a line of code or finding a single bug in Joomla or any extension on it. With MFA forced, the same stolen password gets the bot to a second-factor prompt it cannot answer, and the attack stops there, at the one point that costs the attacker nothing to reach and everything to get past. The friction this adds is real but small, and worth being honest about rather than pretending it’s free. A Super User now needs their phone or authenticator app to log in, not just a password, and that’s a real extra step every single time. Set against what that step buys, a hard stop against the single most common way administrator accounts actually get compromised, it’s a trade that comes out clearly in favour of forcing it, for the small number of accounts that hold the most power on the site. ## Every Super User enrolled, no exceptions Every account in the Super Users group is required to enrol in MFA before they can use the site, and there is no exemption left off the list, including any account created after the setting was turned on. New Super User accounts inherit the requirement automatically, because it’s attached to the group rather than to the individual account. ## Enforcing MFA for the Super Users group 1. Confirm the site is on Joomla 6.1.0 or newer. On 4.2 through 6.0.x the Super Users group is not offered in the field at all. 2. Login to the Joomla administration, e.g. `https://yoursite.com/administrator`. 3. Go to Users, then Manage, then click Options (top right). 4. Open the Multi-factor Authentication tab. 5. Add your Super Users group to the field labelled “Enforce Multi-factor Authentication”. 6. Click the Save button. Joomla supports several MFA methods out of the box, including a one-time-passcode authenticator app, a passkey, and email-based codes as a fallback, so this doesn’t force every administrator onto the same method. It forces the requirement, not the specific second factor, and each Super User can pick whichever method suits them from Users, then Manage, then editing their own account. Nobody with an unenrolled Super User account gets locked out the instant you save this setting. Joomla prompts them to set up a method the next time they try to log in, and blocks further access to the administrator area until they’ve done it. That means the moment to fix this is right after you flip the setting, not weeks later when it turns into an outage for someone who didn’t see the prompt. This is also worth pairing with keeping the administrator area properly separated from the public site: see [Shared Site And Administrator Sessions](https://mysites.guru/tools/joomla-configuration/shared-site-and-admin-sessions/) for why a shared session cookie widens what a front-end compromise can reach. MFA and session separation cover different stages of the same problem: MFA raises the bar on an attacker getting hold of a valid session in the first place, and keeping sessions separate limits what a session that does get stolen or hijacked can actually reach. ## Forcing MFA across Joomla 6.1+ sites mySites.guru checks every connected Joomla 6.1+ site for this setting and can force MFA on the Super Users group across every connected site with one click, rather than opening each site’s admin area individually. Sites below 6.1 are not shown the check, because the setting is not reachable there. ## [Force Multi-Factor Authentication For Super Users](https://mysites.guru/free-audit/?check=joomla/joomlaconfiguration/mfanotforcedforsuperusers) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site. It can also fix this across every connected site with one click. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/joomlaconfiguration/mfanotforcedforsuperusers) ## Further Reading - [Joomla user manual: Multi-factor Authentication](https://guide.joomla.org/user-manual/users/users-multi-factor-authentication) - [PR #46248: Allow to force or never force MFA for superusers](https://github.com/joomla/joomla-cms/pull/46248) The manual covers the settings; the pull request is where the Super Users restriction was removed for 6.1. ## Frequently Asked Questions Show all Does forcing MFA lock out a Super User who hasn't set it up yet? No. Joomla prompts the account to enrol a second factor the next time they log in, rather than blocking access outright before they've had the chance to set one up. Does this affect anyone other than Super Users? Only if you add other groups to the same "Groups to force MFA on" list. Adding only Super Users leaves everyone else's login unchanged. Which Joomla versions support forcing MFA on Super Users? Joomla 6.1.0, released 14 April 2026, is the first. Per-group enforcement itself arrived in Joomla 4.2, but until 6.1 the field carried `checksuperusergroup="1"`, which filtered every group holding `core.admin` out of the list of options, so the Super Users group could not be selected by anyone. Pull request [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [How the Super User MFA check works](#how-the-super-user-mfa-check-works) - [Why optional MFA protects almost nobody](#why-optional-mfa-protects-almost-nobody) - [Every Super User enrolled, no exceptions](#every-super-user-enrolled-no-exceptions) - [Enforcing MFA for the Super Users group](#enforcing-mfa-for-the-super-users-group) - [Forcing MFA across Joomla 6.1+ sites](#forcing-mfa-across-joomla-61-sites) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Yes, in mySites.guru Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fjoomla-configuration%2Fforce-mfa-for-super-users%2F&text=Force%20Multi-Factor%20Authentication%20For%20Super%20Users)[](https://bsky.app/intent/compose?text=Force%20Multi-Factor%20Authentication%20For%20Super%20Users%20https%3A%2F%2Fmysites.guru%2Ftools%2Fjoomla-configuration%2Fforce-mfa-for-super-users%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fjoomla-configuration%2Fforce-mfa-for-super-users%2F) Topics [Joomla configuration](https://mysites.guru/tools/joomla-configuration/)Joomla ★★★★★ > "Brilliant tool with excellent support. It's one of those [tools you quickly realize you can't live without](https://mysites.guru/features/). Reliable, easy to use, and an essential part of my workflow." ![Robbert](https://mysites.guru/images/reviews/robbert.webp) RobbertStudio la Brame [](https://mysites.guru/reviews/) ## More checks in [Joomla configuration](https://mysites.guru/tools/joomla-configuration/) - [ ### Debug Mode Left On In Production Joomla's debug mode prints file paths, SQL and stack traces to anyone who loads the page. Why that is dangerous on a live site, and how to switch it off. ](https://mysites.guru/tools/joomla-configuration/debug-mode-enabled/) - [ ### FTP Credentials In Global Configuration Joomla's FTP Layer went in Joomla 4, but old configuration.php files still hold plain text FTP credentials. Why that is a legacy risk worth checking for. ](https://mysites.guru/tools/joomla-configuration/ftp-layer-credentials/) - [ ### Joomla 3 Is End Of Life Joomla 3 reached end of life in August 2023, no new security fixes are coming from the Joomla project. Here's what that means and what to do about it. ](https://mysites.guru/tools/joomla-configuration/joomla-3-end-of-life/) - [ ### Scheduled Tasks Stuck Locked A Joomla scheduled task stuck in a locked state won't run again until it's manually unlocked, silently stopping backups, update checks and cleanup jobs. ](https://mysites.guru/tools/joomla-configuration/locked-scheduled-tasks/) - [ ### Plain Text Passwords In Email Joomla can still email a user's actual password in plain text on account creation. Joomla itself recommends against it. Here's how to switch it off. ](https://mysites.guru/tools/joomla-configuration/plain-text-password-emails/) - [ ### Search Engine Friendly URLs Search Engine Friendly URLs turn Joomla's query-string links into readable, keyword-rich URLs. It's an SEO setting, not a security one, and it's easy to enable. ](https://mysites.guru/tools/joomla-configuration/sef-urls-disabled/) ## More from the blog [ ![How To Force MFA on Super Users Across Every Joomla Site You Manage](https://mysites.guru/_astro/force-mfa-on-joomla-super-users-across-every-site.Co51SfyZ_Z1VgpKt.webp) ### How To Force MFA on Super Users Across Every Joomla Site You Manage Joomla 6.1 is the first version that lets you require MFA for Super Users. On the 71% of sites still below it, the setting is not reachable at all. ](https://mysites.guru/blog/force-mfa-on-joomla-super-users-across-every-site/)[ ![Joomla 5.4.6 and 6.1.1 Patch TEN Security Issues](https://mysites.guru/_astro/joomla-5-4-6-and-6-1-1-patch-ten-security-issues.BPRhj1mo_1jH0z7.webp) ### Joomla 5.4.6 and 6.1.1 Patch TEN Security Issues Joomla 5.4.6 and 6.1.1 close ten security issues including an MFA bypass and a com\_users privilege escalation. The patch order for 30+ sites. ](https://mysites.guru/blog/joomla-5-4-6-and-6-1-1-patch-ten-security-issues/)[ ![What Site Audits Reveal About Joomla and WordPress Security](https://mysites.guru/_astro/what-site-audits-reveal-about-joomla-and-wordpress-security.9g2O73UH_jpfY.webp) ### What Site Audits Reveal About Joomla and WordPress Security 99% of Joomla sites don't force MFA and 91.8% of WordPress sites skip DISALLOW\_FILE\_MODS. Real audit data on which security features get used. ](https://mysites.guru/blog/what-site-audits-reveal-about-joomla-and-wordpress-security/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [How the Super User MFA check works](#how-the-super-user-mfa-check-works) [Why optional MFA protects almost nobody](#why-optional-mfa-protects-almost-nobody) [Every Super User enrolled, no exceptions](#every-super-user-enrolled-no-exceptions) [Enforcing MFA for the Super Users group](#enforcing-mfa-for-the-super-users-group) [Forcing MFA across Joomla 6.1+ sites](#forcing-mfa-across-joomla-61-sites) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)