Can I protect my admin login with two-factor authentication?

Yes, with the Two-Factor Authentication plugin.

1. Activate the plugin. On its page, turn on Admin panel. You can also turn on Storefront (customers) so shoppers can protect their accounts.
2. Go to Settings → Account → Security and choose a method:

• Authenticator app: click Set up, scan the QR code with Google Authenticator, Authy or a similar app, then enter the 6-digit code and click Confirm.
• Email verification: click Set up and enter the code we email you.

1. Save the backup codes shown next. Each one works once, and they are only shown this one time.

From then on, your login asks for a code. Each admin and staff member sets it up on their own account. Turning Admin panel off stops asking for codes, even for people who had set it up.