Every password login on KMD Agency — staff and clients alike — requires a one-time email code as a second factor. There is no setting to disable this.
Session security
- A real, logged-in session only begins after your OTP code is verified — a correct password alone never creates one.
- Your session is regenerated at that moment, and again on logout, so a session identifier is never reused across the authentication boundary.
- Logging out fully invalidates your session — it cannot be reused by navigating back.
- A deactivated account cannot sign in, even with a correct password and a valid OTP code.
Password reset
Use “Forgot password” on the login screen. A reset link is emailed to the account — the same outgoing email configuration used for OTP codes and notifications must be working for this to arrive. See Email & SMTP Configuration.
reCAPTCHA
KMD Agency supports Google reCAPTCHA (v2 or v3), configured under Settings, applied to the public contact form. It is verified on the server — a visitor cannot bypass it by disabling JavaScript or editing the page.
reCAPTCHA is optional and scoped to the contact form specifically. Login and other authenticated actions rely on rate limiting instead — see Troubleshooting: reCAPTCHA Errors if verification fails.