Two-Factor Sign-In and the Audit Trail
On this page
Two features protect the accounts rather than the traffic. Time-based two-factor codes can be required for any role, and every change made in the Desk is written to an audit log that nobody can edit from the Desk.
Two-factor
Each user enables it from their profile: scan the QR code in an authenticator app, confirm one code, and save the recovery codes. An admin can make it mandatory per role under Settings, Security; a user in such a role is walked through setup at the next sign-in. The secret is stored encrypted; recovery codes are stored as hashes.
The audit trail
Desk, Audit lists who did what and when: posts published, settings saved with a before-and-after snapshot, users invited, comments deleted, backups restored, firewall rules changed, sign-ins and failed sign-ins. It is read-only; there is no delete or truncate control anywhere, by design.
Password reset and invitations
New people join by invitation from Users, never by open registration once the site has its first account. Password-reset links are single-use, expire, and are stored only as a hash, so a database read never yields a usable link. On this demo, try enabling two-factor on the Author account and then look at the Audit page to see the entries it wrote. The firewall covers the other side.
