Laravel Fortify - making 2fa required

Tue, 01 Sep 2026 16:00:00 +0100

By default Fortify makes 2FA optional

This article details how to make it required - using email by default with TOTP optional.

This assumes the Breeze → Fortify migration is done: feature flag on, trait on User, two-factor columns migrated.

0 . Make sure domains match

I’m using a multisite setup and need to ensure the public and auth route handlers dont overlap

in routes/web.php I added

$adminDomain = preg_quote((string) config('app.admin_domain'), '/');
$publicSiteDomain = "(?!{$adminDomain}$)[a-z0-9.-]+";

Route::domain('{site:domain}')->where(['site' => $publicSiteDomain])->group(function () {

and in phpunit.xml I make sure the default domain is defined

Fortify on Tangible Bytes

Laravel Fortify - making 2fa required

0 . Make sure domains match