Agent WranglersAccess and accounts Required
Offer two-factor login
Offer a second factor to every user, and require it for staff and admin accounts. Prefer passkeys, which phishing cannot steal.
How to do it
Support passkeys (WebAuthn) or an authenticator app. Avoid text messages where you can, because numbers can be hijacked. Rate limit code entry, give one-time recovery codes, and ask again for the second factor before changing it.
How to check
Log in as a test admin with only the password. Access is refused until the second factor is given. Ten wrong codes in a row are slowed or blocked.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login.