Stronger sign-in protection, with the convenience of email.
STU Email MFA v1.0.1 adds an extra authentication step to nopCommerce 4.90.x.
After entering their regular username or email and password, customers who have enabled this authentication method receive a six-digit numeric verification code at their registered email address.
Sign-in is completed only after entering the correct code.
The plugin integrates with nopCommerce's native multifactor authentication framework and does not require customers to install a separate authenticator application.
It also uses the store's existing default email account, eliminating the need to maintain separate SMTP credentials.
Key features
- Six-digit numeric login verification codes delivered by email.
- Single-use codes with configurable expiration.
- Centered, responsive authentication page for desktop and mobile devices.
- Configurable code lifetime between 1 and 15 minutes.
- Configurable maximum number of incorrect attempts.
- Adjustable minimum resend interval.
- Configurable hourly code issuance limit.
- Automatic rejection of expired or previously used codes.
- Integration with the default nopCommerce email account.
- Automatic creation of the
StuEmailMfa.VerificationCode message template.
- Editable email subject and body.
- English and Portuguese interface resources.
- Automatic English fallback when translations are unavailable for the selected language.
- Merchant-editable translations through the nopCommerce administration panel.
- Preservation of existing custom translations during upgrades.
- Ten one-time recovery codes for administrators.
- Delivery failure logging without storing authentication codes or passwords in application logs.
Installation instructions
- Verify that your store uses nopCommerce 4.90.x.
- Back up your application and database.
- Open the nopCommerce administration panel.
- Navigate to Configuration > Local plugins.
- Click Upload plugin or theme and select the compiled installation ZIP.
- Reload the plugin list if necessary.
- Locate STU Email MFA and click Install.
- Restart the application when prompted.
Plugin configuration
1. Configure email delivery
Navigate to Configuration > Email accounts.
Configure a working SMTP account and select it as the store's default email account.
Use the built-in test email feature to verify successful delivery.
STU Email MFA automatically uses this account.
2. Activate the MFA method
Navigate to Configuration > Authentication > Multi-factor authentication.
Find STU Email MFA, activate the method, and save your changes.
3. Configure security settings
Navigate to Configuration > Local plugins > STU Email MFA > Configure.
Available settings include:
- Code lifetime: default 5 minutes.
- Maximum verification attempts: default 5.
- Minimum resend interval: default 60 seconds.
- Maximum code issues per hour: default 8.
Save your settings.
4. Customize the verification email
Navigate to Content management > Message templates.
Find StuEmailMfa.VerificationCode.
Edit the email subject and body to match your store's branding.
Keep the following placeholders:
%StuEmailMfa.Code% — verification code.
%StuEmailMfa.ExpiresMinutes% — code validity period in minutes.
5. Enable MFA for a customer account
Customers should:
- Open My account > Multi-factor authentication.
- Enable multifactor authentication.
- Select STU Email MFA.
- Save their settings.
On subsequent sign-ins, they will be prompted to enter the six-digit code received by email.
Language customization
STU Email MFA v1.0.1 includes built-in English and Portuguese resources.
If the store uses another language, such as Russian, French, or German, untranslated interface text automatically falls back to English.
To customize translations:
- Navigate to Configuration > Languages.
- Edit the desired language.
- Open String resources.
- Search for
Plugins.MultiFactorAuth.StuEmailMfa..
- Edit or add the translations you need.
Existing custom translations are preserved during plugin upgrades.
Administrator recovery
Administrators can generate ten single-use emergency recovery codes in advance.
To generate them, open the recovery code management page in the plugin configuration and confirm the current administrator password.
The codes are displayed only once and must be stored securely.
If the email service becomes temporarily unavailable, an administrator can use one previously generated recovery code after successfully entering their username and password.
This feature is restricted to administrator accounts and does not bypass the initial password authentication.
Important: this version uses local memory for temporary authentication challenges and is not designed for multi-server or load-balanced deployments.
Email delivery depends on the merchant's SMTP provider. Delivery failures do not bypass the second authentication step.
