• NamelessMC 2.2.5 only. 2.2.5 fixed a security problem in social sign-in, and 2FA is built on that fix. On any other release the installer changes nothing, and StaffCP explains why and asks you to update NamelessMC first. Revert still works on any release.
• All files or none: every file is checked and backed up before any is patched, and if a file cannot be written, the files already changed are put back.
• Native template skins: the Two-factor and recovery codes pages come in DefaultRevamp, Tailwind and Cobalt styling, picked automatically. Other templates use pages that style themselves.
• Restyle it your way: a copy of a page in your template's 2fa folder takes over, and updates never touch it.
• Sign in with a passkey also shows in login pop-ups, such as Cobalt's, with no template edits.
• New StaffCP text in all six languages.

Updating: extract over the old files. Nothing else to do on 2.2.5; your patches stay as they are.

• Works with any site template. Members manage 2FA on a new User CP → Two-factor page; the Settings page links to it. No template files are patched, and updating puts the four DefaultRevamp files earlier versions changed back to stock.
• Sign in with a passkey shows whenever passkeys are on, and its button matches your template.
• Adding a passkey happens in a dialog, and the passkey prompt opens straight away on iPhone and iPad.
• Fixed: Cancel on the authenticator setup page reported an invalid code. It now cancels, and a new app key is only saved once a code from it is confirmed.
• No browser pop-ups: questions and errors appear on the page, and StaffCP asks in its own dialog.
• Templates that place their own passkey button keep it.

Updating: extract over the old files, then click Apply patches in StaffCP → 2FA → Patches.

• Edit both emails in StaffCP → 2FA → Emails: the sign-in code and the new sign-in method email. Each has a subject, a message, placeholders, Send me a test and Restore default.
• Translated into English, German, Spanish, French, Dutch and Brazilian Portuguese. Emails go out in each member's own language.
• Adding a passkey now sends the new sign-in method email.
• Fixed: "Email me a code" on the sign-in step did nothing for members who use both the app and email codes.
• Security fix: cancelling an authenticator app setup switched email codes off, so those members could sign in with only a password.
• The sign-in step now says which codes the member can use.
• StaffCP 2FA is split into Methods, Emails and Patches pages.

Updating: extract the archive into your NamelessMC root folder (it replaces modules/2fa), then open StaffCP → 2FA → Configuration → Patches and click Apply patches.

• 2FA now works with social sign-in (Discord, Google and other providers), accepting an app code, an emailed code or a recovery code.
• Module updates install in place: changed patches show update ready and keep your original backups.
• Missing backups are downloaded from GitHub for the site's own NamelessMC version, and checked against the known stock file on 2.2.5. A stock file is never patched without a backup, and Revert reports any file it could not restore.
• StaffCP 2FA page: clearer status when 2FA is already active, backup status per file, and it fits on phones.
• User CP 2FA section and sign-in buttons: tidier on phones and readable in dark mode. Text contrast meets WCAG AA.
• StaffCP sidebar: the 2FA link has its own Security heading.

Updating: extract the archive into your NamelessMC root folder (it replaces modules/2fa), then open StaffCP → 2FA and click Apply patches.

Initial release.

• Email one-time codes, passkeys (WebAuthn) and recovery codes on top of NamelessMC's built-in authenticator app.
• Multiple methods at once: login accepts a code from any enabled method.
• One-click, backed-up core installer (StaffCP → 2FA) + per-method admin toggles.