2FA Enforcement Layer SOP

2FA Enforcement Layer SOP
App-level 2FA plugin vs reverse-proxy auth (Authelia, oauth2-proxy) in front of admin. Pick by what you protect.

— Use an app-level 2FA plugin when: you only protect one app's login and want it tied to that app's user roles.
— Use proxy-level auth when: you guard multiple backends (admin, staging, phpMyAdmin, Grafana) behind one gate, before the app even loads.
— Prefer the proxy for tools with weak or no native 2FA: it adds a factor without patching each tool.
— Never expose phpMyAdmin or /wp-admin without one of these layers.
— Verify: hit the protected path unauthenticated, confirm the gate intercepts before the backend renders.

Run this for every admin surface you expose.