HeadLockr has finally launched 🚀, click here to get HeadLockr for free!
The only Plug & Play Multi-Factor Authentication solution built exclusively for Strapi. Effortless to install. Seamless to scale. Unmatched protection.
Enable SMS verification to send a unique one-time code
Generate one-time backup codes for users, ensuring they can access their accounts.
Add an extra layer of security to your Strapi
instance with time-based one-time passwords.
Support multiple devices
Imac Peter
Ipad Anna
Iphone John
Macbook Jane
Quickly integrate MFA into your Strapi CMS without writing a single line of code. Privacy first design, no cloud involved.
Experience the future of Strapi security with our multi-factor authentication plugin. Designed for developers, built for simplicity—get started today with a seamless setup and cutting-edge protection for your CMS.
“
HeadLockr is the extra security layer your Strapi project needs to support Multi-Factor AuthenticationPierre Burgy
CEO, Strapi
From admin panel to content API (coming soon), every part of your Strapi project is protected. Multi-factor authentication that’s effortless to set up and powerful enough to keep your APIs secure. Whether you use SMS, TOTP, or email, our plugin adapts to your workflow.
With Multi-factor Authentication (MFA), your system is protected against brute-force, phishing, and man-in-the-middle attacks, ensuring that only authorized users can access your Strapi backend.
Multi-factor Authentication (MFA) enhances security by adding multiple layers of protection, making unauthorized access significantly more difficult. By requiring multiple forms of identity verification, such as a password, a one-time code, or biometrics, MFA protects your system from common security threats like brute-force attacks, phishing attempts, and man-in-the-middle attacks. This ensures that only users with valid credentials, in addition to a secondary authentication method, can access your Strapi backend, providing a highly secure environment for sensitive data and administrative functions.
MFA adds an extra layer of security to your Strapi backend, making it harder for attackers to gain unauthorized access by requiring multiple forms of verification.
In today’s digital environment, credential theft is a prevalent risk as attackers use stolen passwords to gain unauthorized access to systems. MFA significantly reduces this threat by requiring an additional verification step, beyond the traditional username and password, for each user. Even if an attacker obtains a user's login credentials, they won’t be able to gain access without passing the secondary authentication. This makes MFA an effective defense against a range of security threats, such as social engineering and spear-phishing attacks, by adding a strong layer of protection to your Strapi backend.
MFA is a recommended security best practice by industry standards such as NIST and GDPR, ensuring that your Strapi backend meets the highest security requirements.
Adhering to established security standards is crucial for organizations, especially when handling sensitive data. Many industry standards, including NIST, GDPR, and SOC 2, recommend or mandate MFA as part of their compliance frameworks to ensure the protection of user data and maintain trust. By implementing MFA within your Strapi backend, you align with these stringent guidelines, making your infrastructure more robust and compliant with industry regulations. This also demonstrates your commitment to upholding high-security standards, giving clients and stakeholders confidence in your system's integrity.
Our MFA plugin is designed for developers of all skill levels, with an easy, no-code setup that allows you to quickly integrate MFA into your Strapi project without any hassle.
Security doesn’t have to be complicated, and our MFA plugin is designed with that in mind. The no-code setup means that even developers with minimal experience can configure and deploy MFA in their Strapi projects without needing extensive knowledge of complex security protocols. With intuitive configuration options, our plugin provides a straightforward integration process, allowing you to add MFA with just a few clicks. This empowers teams to enhance their security posture without investing significant time or resources into setup, ensuring a hassle-free experience for developers at any skill level.
Our MFA plugin offers a range of security features, including SMS, TOTP, and email verification, to give you peace of mind knowing that your Strapi backend is secure.
Our MFA plugin is equipped with multiple authentication options, including SMS-based verification, Time-Based One-Time Passwords (TOTP), and email verification, giving you flexibility to choose the method that best suits your needs. These options enable stronger protection for your backend, ensuring that only authorized users can gain access. The plugin’s security features are designed to adapt to evolving security requirements, making it easy to scale as your user base grows. This robust suite of features provides peace of mind, knowing that your backend is well-protected against unauthorized access and data breaches.
MFA is designed to provide an effortless user experience, with seamless authentication that adapts to your workflow, making it easy for users to access your Strapi backend securely.
Security should not come at the cost of user experience. Our MFA plugin is designed to be as unobtrusive as possible, providing an authentication process that integrates seamlessly with your users’ workflow. The plugin offers an adaptable authentication experience, allowing users to access your Strapi backend without unnecessary friction, while still ensuring high security. Whether accessing the backend for administrative tasks or content management, users will experience a smooth, intuitive process that doesn’t compromise on security, making it easy and enjoyable to use your Strapi application.
Multi-factor Authentication (MFA) enhances security by adding multiple layers of protection, making unauthorized access significantly more difficult. By requiring multiple forms of identity verification, such as a password, a one-time code, or biometrics, MFA protects your system from common security threats like brute-force attacks, phishing attempts, and man-in-the-middle attacks. This ensures that only users with valid credentials, in addition to a secondary authentication method, can access your Strapi backend, providing a highly secure environment for sensitive data and administrative functions.
Choose a plan that’s right for you
Ideal for individuals with basic MFA needs
Best value for multi-project developers with early access to premium features
Ideal for businesses who need MFA security at large scale
Ideal for individuals with basic MFA needs
1 project
Secure Strapi admin panel with MFA
Full MFA access (SMS, Email, TOTP, Backup codes)
Email verification 2FA
Early access to new features
Multi project license
Best value for multi-project developers with early access to premium features
Everything from the individual plan
3 projects
Priority updates
Early access to new features (SDK, React components)
Multi-project support
Email support
Backup codes for device recovery
Ideal for businesses who need MFA security at large scale
Everything from the Developer plan
Supports up to 7-10 projects
Priority updates
Early access to new features (SDK, React components)
Multi-project support
Email support
Backup codes for device recovery
Premium support (response time < 4h)
14-day money back! 🤯
If your project requires more than what’s offered in our standard plans, we’ve got you covered. Whether you need custom solutions, enterprise-level support, or have specific security requirements, we’re here to help.
Contact UsNo need for complex configurations. Our plugin is designed for quick and easy integration with Strapi, allowing you to enhance security without disrupting your workflow.
Add this to your .npmrc file
Loading code block
Just run this command to start installing MFA for Strapi
yarn add @headlockr/headlockr @tanstack/react-query@^5.56.2
Add this to your .npmrc file
Loading code block
Just run this command to start installing MFA for Strapi
npm install @headlockr/headlockr
Add the license key that you received by email into the .env file
HEADLOCKR_LICENSE_KEY=enter-your-license-key-here
In order for Headlockr to function properly in your admin panel, you'll need to make a slight modification to /src/admin/webpack.config.js file
That’s it. Check out our documentation to ensure you have the latest instructions.
And dont worry we wont spam you till death cause in the end this is about developing and securing your Strapi.
© 2025 copyright Headlockr, all rights reserved