> ## Content Index
> Fetch the complete content index at: https://ghost.org/changelog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Device verification & email 2FA
- URL: https://ghost.org/changelog/2fa/
- Published: 2025-04-22T15:21:36.000Z
- Updated: 2025-04-22T15:21:36.000Z
- Description: Security improvements for staff user authentication
- Author: Team Ghost
- Tags: New

We've just introduced two simple security enhancements for staff user logins on Ghost: Device verification, and email-based two-factor authentication (2FA).

Now, when any staff user signs in to Ghost from a new/unrecognized device for the first time, they'll be required to enter a 6-digit 2FA code sent to their registered email address. This extra layer of protection is automatically enabled on all Ghost sites.

Optionally, site administrators can now also configure Ghost to send email 2FA codes as part of every staff user login, regardless of device.

This new option can be found under **Settings → Staff users → Security**.

![](https://storage.ghost.io/c/11/12/11129d96-48f2-4637-9c25-b077458f01e2/content/images/2025/04/CleanShot-2025-04-12-at-14.39.21@2x.png)

### Advanced security options

As always: Users with sophisticated security requirements can configure network-based authentication for the entire `/ghost` route, covering both the admin panel and API, using a system such as [CloudFlare Access](https://www.cloudflare.com/zero-trust/products/access/?ref=ghost.org) in combination with third-party SSO providers or enterprise IDP integrations.

More information about Ghost's security practices is available in our detailed developer documentation:

[Ghost Security & PrivacyGhost is committed to developing secure, reliable products utilising all modern security best practices. Find out more about Ghost security and privacy.![](https://storage.ghost.io/c/11/12/11129d96-48f2-4637-9c25-b077458f01e2/content/images/icon/favicon-4.ico)Ghost - The Professional Publishing Platform![](https://storage.ghost.io/c/11/12/11129d96-48f2-4637-9c25-b077458f01e2/content/images/thumbnail/ghost-docs.png)](https://ghost.org/docs/security?ref=ghost.org)

---

[**Ghost(Pro)**](https://ghost.org/pricing/?ref=ghost.org) users can log in and start enjoying all of this right away! If you're a developer, self-hosting Ghost, you'll need to [update](https://ghost.org/docs/update/?ref=ghost.org) to the latest version to get access to everything that's new.