Email OTP

The module adds a second step to the site login. After the user enters the correct password, they receive a 6-digit code by email and enter it to log in.

What it does

- After the username and password are entered, it sends a code to the account's email address.
- The code is valid for a limited time (15 minutes by default) and is kept in the session only as a hash.
- It counts failed attempts separately per user and per IP address, using Drupal's flood service. Starting a new session or requesting a new code does not reset the counters.
- It limits resending of the code (a pause between requests and a cap on codes per user).
- The check can be turned off for a single account (the "TFA enabled" field) or for the whole site (a checkbox in the settings).
- The email is configured in the admin UI: subject and body, core tokens, plus [tfa:code] and [tfa:lifetime]. Translations use the standard configuration translation.

Configuration

/admin/config/people/email-otp: enable or disable the check, code lifetime, number of failed attempts (per user and per IP), lockout period, code limit and the pause between resends.