~/admin
First login — set up 2FA
Scan with Google Authenticator / 1Password / Authy, then enter the code.
Recovery codes — save these now
Each works once if you lose your authenticator. Store them somewhere safe (password manager).
Contact forms
Chat messages
Projects
Add project
New users get a random temp password (shown once) — they set their own 2FA on first login. Editors can manage content; only admins manage users & security. Users with an email can self-reset via "Forgot password?" and get notified of resets.
Change password
Two-factor authentication
Resetting 2FA turns it off — your next login will walk you through setup again. Passkeys are kept.
Passkeys
Optional. A passkey lets you unlock with FaceID/TouchID instead of typing a 2FA code. Recommended — add one per device.