Turn on two-factor sign-in for administrators Two-factor protects the accounts that can refund money and read every client record. It takes ten minutes; plan how a lost phone is recovered first.
What the shipped .htaccess protects Since 1.11.0 WBAMS ships protective rules in the root .htaccess, outside the managed-rules markers so they survive when WBAMS rewrites its own rules.
Sign-in and password-reset limits Wrong client sign-ins are limited wherever they come from: the sign-in page, the cart and the client API.
Can my clients use two-factor sign-in? Yes. Client two-factor is its own setting; once you allow it, clients switch it on for their account in the portal.
