wagtail-2fa

This Django app adds two factor authentication to Wagtail. Behind the scenes it use django-otp which supports Time-based One-Time Passwords (TOTP). This allows you to use various apps like Authy, Google Authenticator, or 1Password.

Installation

pip install wagtail-2fa

Then add the following lines to the INSTALLED_APPS list in your Django settings:

INSTALLED_APPS = [
    # ...
    'wagtail_2fa',
    'django_otp',
    'django_otp.plugins.otp_totp',
    # ...
]

Next add the required middleware to the MIDDLEWARE. It should come after the AuthenticationMiddleware:

MIDDLEWARE = [
    # .. other middleware
    # 'django.contrib.auth.middleware.AuthenticationMiddleware',

    'wagtail_2fa.middleware.VerifyUserMiddleware',

    # 'wagtail.core.middleware.SiteMiddleware',
    # .. other middleware
]

Migrate your database:

python manage.py migrate

Settings

The following settings are available (Set via your Django settings):

WAGTAIL_2FA_REQUIRED (default False): When set to True all staff, superuser and other users with access to the Wagtail Admin site are forced to login using two factor authentication.
WAGTAIL_2FA_OTP_TOTP_NAME (default: False): The issuer name to identify which site is which in your authenticator app. If not set and WAGTAIL_SITE_NAME is defined it uses this. sets OTP_TOTP_ISSUER under the hood.

Making 2FA optional

With the default VerifyUserMiddleware middleware, 2FA is enabled for every user. To make 2FA optional, use the VerifyUserPermissionsMiddleware middleware instead.

To do so, use the VerifyUserPermissionsMiddleware middleware instead of the VerifyUserMiddleware in your Django settings:

MIDDLEWARE = [
    # ...
    # 'wagtail_2fa.middleware.VerifyUserMiddleware',
    'wagtail_2fa.middleware.VerifyUserPermissionsMiddleware',
    # ...
]

When this middleware is used, a checkbox is added to the group permissions and 2FA can be enabled or disabled per group.

2FA is always enabled for superusers, regardless of the middleware used.

Sandbox

First create a new virtualenv with Python 3.8 and activate it. Then run the following commands:

make sandbox

You can then visit http://localhost:8000/admin/ and login with the following credentials:

E-mail: superuser@example.com
Password: testing

Metadata

Release files for wagtail-2fa 1.8.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for wagtail-2fa 1.8.0
File	Size	Uploaded
wagtail_2fa-1.8.0.tar.gz	25.3 kB	Mar 2, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for wagtail-2fa 1.8.0
File	Interpreter	ABI	Platform	Reset
wagtail_2fa-1.8.0-py3-none-any.whl 41.1 kB Mar 2, 2026	Python 3	none	any	Details

Total release size: 66.3 kB

Release files / wagtail_2fa-1.8.0.tar.gz

Download URL	wagtail_2fa-1.8.0.tar.gz
Size	25.3 kB
Tags	Source
SHA-256 checksum How to use checksums	`cd38f66a4d0ea6d63f3fa3d963ab24095f12f55c12340eab92df06a2339ce3a6`
BLAKE2b-256 checksum How to use checksums	`129ab7166a0f7cee7121f61d5c002203bc46a7e2a472bf563adf9a60ee32614c`
Upload date	Mar 2, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.1.0 CPython/3.13.7`

Release files / wagtail_2fa-1.8.0-py3-none-any.whl

Download URL	wagtail_2fa-1.8.0-py3-none-any.whl
Size	41.1 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`cfd3d2678c53f16f3af4b0f7587c1fd0508488cbf70bc0176151bcf2369a093f`
BLAKE2b-256 checksum How to use checksums	`c1bb6f14801cacee011c696b4f12de5ff28e11556ae996ab46d06dbc3f72d915`
Upload date	Mar 2, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.1.0 CPython/3.13.7`