Require email verification at sign-in
Turn company-wide email verification on and understand codes, remembered sessions and delivery safeguards.
What this guide helps you do
Email two-factor authentication adds a second sign-in step for every HR administrator, Assistant Admin, manager and employee in the company. Their password is checked first, then HRStuff sends a six-digit code to the login email address.
Open ADMINISTRATION, Settings, then find Email two-factor authentication. Only an HR administrator can change the company-wide setting. Platform-administrator security is controlled separately.
Prepare every login
Check that each active user has access to their HRStuff login email address. The code is sent there, not to a separate personal email field.
Correct obsolete or misspelled login emails before enabling the requirement.
Tell users that the password still matters. The email code is an additional check, not a replacement password.
Agree how users should contact HR when they lose access to their mailbox. Do not ask them to forward a login code to another person.
Switch on email verification
Check the current status
The card shows On or Off. If live email is unavailable, the Switch on button is disabled and the page explains why.
Choose Switch on email 2FA
Read the company-wide confirmation, then continue. The change is recorded in the Activity Log.
Keep the current session open
Existing sessions are not signed out. The new step applies the next time each person signs in, so use a separate browser or private window for the first test.
Complete a test login
Enter the password, open the email titled “Your HRStuff login code”, enter the six digits and confirm that the intended account opens.
Understand the verification code
A code expires after 10 minutes and works once.
After five incorrect codes, the user must enter their password again to start a new sign-in.
A new code can be requested after one minute. Only the newest code works, and the new code receives a fresh ten-minute expiry.
HRStuff stores a protected check of the code rather than a readable database copy of the six digits.
Understand remembered sessions
If a user selects Keep me signed in on this device for 30 days, that choice still applies after they enter the email code. It keeps the current session open longer but does not let them skip the code on a later sign-in.
Switching the requirement on or off does not destroy sessions that are already signed in. The setting is checked when a new login begins.
If a code does not arrive
Check that the partly hidden email address on the login page matches the address the user expects.
Check spam or junk mail and wait until the one-minute resend period ends before requesting a new code.
Use only the newest message after a resend.
If HRStuff cannot send the required email, it does not create a password-only session. Ask an HR administrator who is still signed in to check the login email or switch off the requirement while delivery is repaired.
Switch the requirement off
Choose Switch off email 2FA and confirm the company-wide change. Switching off is allowed even when email delivery is unavailable, which provides a controlled recovery route for an administrator who still has an open session.
The change affects later logins and is recorded in the Activity Log. It does not sign out current sessions or invalidate the user’s password.