2FA Enforcement Layer SOP
App-level 2FA plugin vs reverse-proxy auth (Authelia, oauth2-proxy) in front of admin. Pick by what you protect.
— Use an app-level 2FA plugin when: you only protect one app's login and want it tied to that app's user roles.
— Use proxy-level auth when: you guard multiple backends (admin, staging, phpMyAdmin, Grafana) behind one gate, before the app even loads.
— Prefer the proxy for tools with weak or no native 2FA: it adds a factor without patching each tool.
— Never expose phpMyAdmin or /wp-admin without one of these layers.
— Verify: hit the protected path unauthenticated, confirm the gate intercepts before the backend renders.
Run this for every admin surface you expose.
Lockdown Ledger
@LockdownLedger
2FA Enforcement Layer SOP
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.