# Authentication Security https://docs.wisecp.com/fr/authentication-security This tab adds extra identity checks after a password: two-factor codes, location checks, IP checks, country rules, JetPass and passkeys. It applies to clients and staff. ## Opening the Screen In the left menu, click **Settings**, then **Security**. Click **Authentication** in the tab row. Address: `{admin}/settings/security?general=authentication` ## What Is on the Screen - **Two-Factor Authentication**: A card for each verification method, each with its own switch. - **Location Verification**: Separate blocks for clients and staff. - **IP Verification**: Proxy and VPN detection. - **Country Rules**: Access restriction and proxy block scope. - **JetPass**: A passwordless sign-in option, switched on separately for clients and for staff. - **Passkeys**: Biometric passwordless sign-in with a fingerprint, face or device PIN. ## Fields ### Two-Factor Authentication - **Verification Methods**: An authenticator app (TOTP), an email code and an SMS code, plus any Authentication module you install. Email and SMS need an active module; without one the card shows disabled. - **Force Enable for Clients**: Off by default. Needs at least one method switched on above; forces clients to activate one at their next sign-in. - **Force Enable for Staff**: Off by default. Needs at least one method switched on above; forces staff to activate one at their next sign-in. Full Administrator accounts are exempt. - **Show Popup**: On by default. Shows a reminder for two-factor authentication in the client dashboard. - **Trusted Device Duration (Clients)**: Default: 0. When a client ticks "trust this device" while verifying, the browser skips the code for this many days. 0 hides the checkbox and asks on every sign-in. 365 days at most. - **Trusted Device Duration (Staff)**: Default: 0. The same window for staff signing in to the admin area. - **Bind Trust to IP Address**: Off by default. When on, a trusted device is only recognized from the IP address it was trusted on. Mobile users changing networks get asked for a code more often. ### Location Verification Asks for extra verification when the visitor's city or country changed since their last sign-in. - **Enable for Clients**: Off by default. Turning it on reveals a verification method (SMS by default) and a sensitivity level (Country by default). - **Enable for Admin/Staff**: Off by default. The same choices, kept separate from the client settings above. ### IP Verification Checks whether the visitor is using a proxy, VPN or anonymizer service. - **Enable for Clients**: On by default. Turning it on reveals a whitelist for trusted IP addresses, IP ranges or provider ASNs. - **Enable for Admin/Staff**: Off by default. Has its own whitelist. ### Country Rules Each card has a mode and a country list. The visitor's country comes from their IP address, and at sign-up the country on the form is checked too. - **Mode**: Required. Each card names its own modes and starts unrestricted; the others scope the rule to, or away from, the countries you pick. - **Countries**: Appears once you pick a mode other than the first. Saving with an empty list is refused. - **Access Restriction**: Limits which countries can open an account, sign in and place an order. Staff logins are not affected. - **Proxy Block Scope**: Narrows which countries the proxy and VPN block applies to. The block itself is switched on under IP Verification. ### JetPass Lets someone sign in with a one-time code emailed to them instead of typing a password. It sits beside the password form on the login page. Clients and staff are switched on separately. - **Enable for Clients**: Off by default. Shows the JetPass option on the client login page. - **Enable for Staff**: Off by default. Shows the JetPass option on the staff login screen. An emailed code is one factor, so two-factor verification still runs after it. - **Code lifetime**: Required. Default: 15 minutes. Accepts 1 to 60 minutes. - **Failed attempt limit**: Required. Default: 5 tries. Accepts 1 to 20 tries. ### Passkeys Lets someone sign in with a fingerprint, face scan or device PIN instead of a password. A passkey works only on your domain and cannot be phished. Clients and staff are switched on separately. - **Enable for Clients**: Off by default. Adds a passkey option to the client login page and a Passkeys section to their account security settings. A client with no passkey gets a one-time offer on the dashboard after signing in. - **Enable for Staff**: Off by default. Adds a passkey option to the staff login screen and a Passkeys section to Account Settings. A passkey already carries two factors, so no further code is asked after it. ## Tasks ### Requiring Two-Factor Authentication for Clients 1. Open **Two-Factor Authentication** and switch on at least one method card, for example the authenticator app. 2. Turn on **Force Enable for Clients**. 3. Click **Save Changes**. ### Restricting Access to Certain Countries 1. Open **Country Rules** and set the **Access Restriction** mode to **Allow Only the Selected Countries**. 2. Pick the countries you serve in the **Countries** list that appears. 3. Click **Save Changes**. Visitors from other countries can no longer open an account, sign in or place an order. ### Signing In as Staff Without a Password 1. Open **Passkeys**, turn on **Enable for Staff** and click **Save Changes**. 2. Open your own **Account Settings** from the profile menu, go to the **Security** tab and expand **Passkeys**. 3. Click **Add Passkey** and finish the prompt your device shows. The key is listed with the date it was added. From the next visit the staff login screen offers **Sign In with a Passkey**; it opens the panel without a password and without a code. ## Things to Watch > **Access Restriction also blocks existing clients** > > The rule is checked at every sign-in, not only at sign-up. A client travelling outside your list cannot sign in or pay an invoice until they are back. Staff logins are exempt. > **Each sub-tab saves on its own** > > Every sub-tab has its own Save Changes button. Switching to another sub-tab without saving loses your changes there. > **IP Verification is not an address allowlist** > > It looks for proxy and VPN usage. To restrict the admin panel to specific IP addresses, use Admin Area IP Restriction on the Settings tab instead. > **Device trust clears itself** > > A password reset, switching two-factor authentication on or off, or the client ending all sessions deletes that account's trusted devices. Clients can also remove single devices from the Trusted Devices list on the Security tab of their account settings. > **JetPass needs a mail module** > > JetPass delivers its code by email only. Without an active mail module the option still appears, but no code arrives. > **Passkeys need an HTTPS address** > > Browsers refuse to create or use a passkey on a non-secure address. If your installation address does not start with https, the tab warns you and the feature cannot be used. ## Required Privileges Viewing and saving any sub-tab on this screen needs the **SECURITY_SETTINGS** privilege. ## Related Articles - [Security Settings Overview](https://docs.wisecp.com/en/security-settings-overview) - [General Security Options](https://docs.wisecp.com/en/general-security-options) - [BotShield](https://docs.wisecp.com/en/botshield)