Passkey, Authenticator App or Email Code: Picking 2FA for WHMCS Staff
Every WHMCS staff login should ask for something after the password. The harder question is what that something should be, because the three common options don't protect you equally. Email codes are the easiest to roll
Every WHMCS staff login should ask for something after the password. The harder question is what that something should be, because the three common options don't protect you equally.
Email codes are the easiest to roll out and the weakest for admins. Whoever gets into the staff mailbox can usually reset the WHMCS password and read the login code too, and NIST SP 800-63B says email shall not be used for out-of-band authentication.
Authenticator apps (TOTP) are what WHMCS ships with as Time-Based Tokens, and they're a big step up from a password alone. Their weak spot is phishing: a look-alike login page can collect the 6-digit code and replay it to your real login before it expires.
Passkeys close that gap. The browser only offers a passkey on the domain it was created for, so a fake page gets nothing to relay. WHMCS doesn't include passkey sign-in in its built-in two-factor list, which is why this needs an add-on.
The full guide covers how each method behaves at a WHMCS login, where email codes still make sense (clients and backup), what to do about lost phones and clock drift, and a simple policy you can copy for your team. Read our full passkeys vs TOTP vs email codes comparison for WHMCS staff on the ShoHost blog.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.