Two-factor authentication on public-sector websites
Two-factor authentication (2FA) is a way of securing logins where a password alone is not enough. The user must provide two different elements of identity verification: something they know (for example, a password), and something they have or confirm using another device (for example, a code generated on a phone, an authentication app, or a login confirmation). This solution significantly reduces the risk of unauthorised access to the administration environment, even if the password has leaked or been guessed.
In the Lithuanian public sector, this is especially relevant because websites of municipalities, schools, museums, libraries and other organisations often handle sensitive information: user accounts, registration form data, internal content management, documents or integrations with other systems. Even a small organisation website can become a target of attack if its administrator account is protected by a password only.
Why 2FA matters not only for large organisations
It is often assumed that enhanced login protection is needed only by ministries or large state institutions. In practice, however, the most vulnerable are often smaller organisations with limited IT resources and less frequent reviews of security settings. A school website administrator account, a library event management system or a museum content editing environment also needs to be protected in line with good practice.
2FA helps protect against the most common risks: password leaks, reuse of the same passwords, phishing emails and unauthorised logins from third parties. In the public sector, this matters not only for technical security, but also for trust in the organisation. If a resident uses a municipality services form or registers for a library event, they expect the system to be managed responsibly.
How two-factor authentication works
The login process usually takes place in two stages. First, the user enters their username and password. Then the system asks for additional confirmation – a one-time code, a number generated by an app, a login confirmation on the phone, or another secure action.
It is important to understand that not all second factors are equally convenient or equally suitable for every organisation. For example, authentication apps are often considered a more reliable and convenient choice than SMS codes, but the choice of a specific solution depends on the size of the organisation, employees’ digital skills and the infrastructure in use.
Where 2FA should be used
On public-sector websites, two-factor authentication should first be enabled for all accounts used with administrator and editor rights. This is especially important in content management systems where page content can be changed, news published, forms managed, data exported or plugins installed.
If the organisation uses WordPress, 2FA is usually implemented through trusted security plugins or centralised login solutions. It is important not only to install the feature, but also to configure it properly: define which users must use it, how backup login codes will be managed, and what to do if a phone is lost. A purely technical activation without a clear process often creates more inconvenience than benefit.
Relationship with GDPR and compliance
Although the GDPR does not directly require every system to use 2FA, the regulation clearly requires appropriate technical and organisational security measures. If personal data is processed in the website administration environment – for example, in registration forms, enquiries, education bookings or newsletter management – enhanced login protection becomes a logical and justified measure.
In addition, public-sector organisations must consider not only data protection, but also business continuity, reputation and compliance with internal security policies. An unauthorised login can mean not only a data breach, but also website content changes, the publication of misleading messages or service disruption. Therefore, 2FA should be seen as a basic security standard, not an optional extra.
Accessibility and user convenience
When deploying 2FA in the public sector, it is also important to consider accessibility. If the login process becomes too complicated, staff may look for unofficial workarounds, which reduces overall security. The solution therefore needs to be clear, understandable and adapted to different users.
Good practice is to provide clear instructions in English, offer alternative recovery methods and ensure that login windows are compatible with assistive technologies. This is especially relevant in local authority administrations and education organisations, where staff with different levels of readiness use the systems.
2FA and e-government solutions
In Lithuania, centralised e-government solutions are widely used to confirm residents’ identity, including VIISP integrations. In such systems, multi-factor authentication is already a natural part of the login process. However, it is important not to forget that even if residents’ login is properly protected, the organisation’s own staff administration accounts must be protected with no less responsibility.
In other words, security must be consistent throughout the system: from external user identification to internal content management. Only then can we speak of a mature and reliable digital solution for the public sector.
What is worth planning when implementing 2FA
- Making it mandatory for administrator accounts. It is not enough to recommend using 2FA – for the most important accounts it should be mandatory. This applies to website administrators, IT specialists, editors and everyone with extended rights.
- Backup login scenarios. It is necessary to plan in advance what happens if an employee changes their phone or loses access to the authentication app. A clear recovery process helps avoid operational disruptions and urgent, insecure solutions.
- User training. Even the best technical solution will not work smoothly if staff do not understand how to use it. A short guide, an internal procedure and a help contact are often just as important as the plugin or system itself.
- Compatibility with accessibility requirements. The login process must be clear, understandable and technically accessible. This is important not only for convenience, but also for overall digital maturity and compliance with public-sector standards.
In summary, two-factor authentication is one of the simplest and most effective ways to strengthen the security of public-sector websites. It is especially important where several employees work in the administration environment, and where plugins, forms or integrations with external systems are used. For municipalities, schools, museums, libraries and other organisations, this should not be the exception, but part of responsible digital maintenance.