Key Features
Login Activity Log
- Every login attempt recorded: user, timestamp, IP, and outcome
- Failed attempts visually highlighted in red, successes in green
- Per-user smart buttons: total logins and failed attempts in the last 24 hours
- Admin-configurable retention so the log never grows unbounded
2FA Adoption Dashboard
- Reads native auth_totp state directly — nothing duplicated
- Adoption percentage at a glance
- Drill straight into the list of users who haven't enabled it
- Follow up individually with holdouts
Dismissible 2FA Reminder
- Small, native banner shown on login to users without 2FA
- Resurfaces on an admin-configurable cadence (default 30 days)
- Never blocks login — nudges, never enforces
- Zero changes to the authentication mechanism itself
Description
What's included
Login Activity list under Settings > Technical > Security
Per-user Logins and Failed (24h) smart buttons
2FA Adoption dashboard with live percentage
Dismissible reminder banner with configurable cadence
Automatic log retention/cleanup, admin-configurable window
API/XML-RPC logins tagged distinctly, not mixed into the human-facing log
Graceful null-IP fallback behind proxies, never a guessed address
Zero external dependencies — built entirely on native res.users and auth_totp
Screenshots
Login Activity Log (live)
2FA Reminder Banner (live)
Login Activity in the Settings top bar (live)
Users without 2FA list (live)
Bulk "Send Reminder to All" (live)
Per-user due date and frequency (live)
2FA reminder notification (live)
Good to know
This module only ever observes login attempts — it can never change whether a login succeeds or fails. The reminder is scoped to internal staff; portal/external users are logged for visibility but never sent the 2FA nudge, since the reminder mechanism assumes a backend session.
No enforcement, no mandatory 2FA, no IP allowlisting, and no active email/SMS alerting — this is a passive log and a gentle nudge, not an access-control system.
| Versions | 19.0 |