A Nextcloud exposed to the internet (which it is with us) needs active security. We do a lot on the server side — brute-force IP blocking, a reverse proxy with rate limiting, a secure SSL setup. But you as admin and your users are the last layer. Here are the most important levers.
2FA for your own account
Personal settings → Security → Two-factor authentication.
Several methods available:
- TOTP (time-based one-time password): the standard. An app on your smartphone (Aegis, 2FAS, Apple’s password manager).
- WebAuthn / FIDO2: a hardware key like a YubiKey. The most secure option.
- U2F: the older FIDO variant, similar to WebAuthn.
- Backup codes: single-use recovery codes.
Our recommendation: TOTP as the main method, plus backup codes printed out and kept in the safe. WebAuthn as an additional layer for very security-critical setups.
TOTP setup
- Enable it in your personal settings.
- Scan the QR code with your TOTP app.
- Type in the code to confirm.
- Generate backup codes and store them.
At every future login: username + password + the 6-digit TOTP code.
Backup-codes setup
In the 2FA section, click Backup codes → a list of 10 codes is generated; any one of them can be used at login (each code only once).
Important: print them or store them in your password manager. If you lose your smartphone, a backup code is the only way back in.
Enforcing 2FA for other users
As an admin, in Administration settings → Security:
- Enable 2FA enforcement for specific groups — typically the
admingroup.
Users in an enforced group have to set up 2FA at their next login. No access to files before that.
Our recommendation:
- admin group: 2FA mandatory
- standard user group: 2FA recommended, not enforced
- business users with sensitive data: 2FA mandatory
With a blanket mandate for all users, acceptance often gets harder — some users find 2FA annoying. Discuss it in the team and decide what’s appropriate.
App passwords
If you have 2FA enabled, mail clients (Outlook, Apple Mail) and sync clients (Nextcloud Desktop, mobile apps) can’t use 2FA codes. Instead, they use app passwords.
Creating an app password:
- Personal settings → Security → Devices & sessions.
- Give it an app name (e.g. “Apple Mail iPhone”, “Desktop Win 11”).
- Click Create.
- The app password is displayed — visible once, stored only as a hash afterwards.
In the app: use the app password as the login password, not your main password.
One app password per client
Our recommendation: a separate app password per client, with a descriptive name. Advantages:
- Lose a device → revoke exactly that app password, the others stay active.
- Overview in Devices & sessions: which devices are connected?
- Logging: per app password, the audit log shows who accessed from where.
More in App passwords.
Brute-force protection
Nextcloud has built-in brute-force protection: after several failed login attempts, the IP address is throttled.
In Administration settings → Security:
- Number of allowed login attempts: 5 (the default, fine)
- Lockout time: increases with every attempt
On top: we run Fail2ban-style protection on the server side that enforces hard IP blocks against persistent offenders.
Security warnings in the admin area
In Administration settings → Overview, Nextcloud regularly shows security notices. Examples:
- “HSTS header not set”
- “Default phone region not configured”
- “Maintenance mode active”
What you should do:
- Application-level items: you can fix these yourself (set the default phone region in the settings, etc.).
- Server-level items: open a ticket, we handle it on the server side. Examples: HSTS headers, OPcache tuning, database indexes.
What you should not do: poke around in admin options you don’t understand. Failure cases can mean users can’t log in anymore.
Managing devices and sessions
In Personal settings → Security → Devices & sessions you see all active logins:
- Browser sessions
- App-password-based connections
- Mobile-app logins
Per entry:
- Last activity: when was it?
- IP address: where did the access come from?
- Browser/app: what was it?
On suspicious activity: click Revoke. That login token becomes invalid immediately.
Recommendations for secure operation
1. Unique, strong passwords for every user. Generated by a password manager.
2. 2FA mandatory for admins. Optional for everyone else — recommend, don’t enforce.
3. App passwords per device. Descriptive names, clean up regularly.
4. Set sharing defaults conservatively. Password requirement, expiration date — see Sharing links with protection.
5. Enable the audit log for sensitive setups (the admin_audit app).
6. Don’t ignore security warnings. If something turns red or yellow: open a ticket with us, or reach Mike.
7. Apply updates promptly. We do this proactively. If you notice anything odd before we’ve acted — say so.
Frequently asked questions
What do I do if I’ve lost my TOTP device? If you have backup codes: use one, set 2FA up again. If not: open a ticket, we reset 2FA via OCC; you’ll have to identify yourself to us (e.g. by mail from your registered mail account).
What if a user forgets they have 2FA? As an admin, you can switch it off for them — user edit → 2FA status. Then have them log in again and set up 2FA fresh.
Does 2FA work with the desktop client? Yes, indirectly — via app passwords. When setting up the client, you enter the app password, not TOTP. The client doesn’t need 2FA because it uses a dedicated app password.
WebAuthn / hardware keys vs TOTP — which is better? WebAuthn is more secure (resistant to phishing), but hardware-dependent. TOTP is easier to start with, secure enough for most setups. If you’re under strict compliance requirements: WebAuthn as a second factor alongside TOTP.
Can I deactivate 2FA again? Yes, in your personal settings. If 2FA is enforced server-wide (admin configuration), you can’t — only the admin can loosen that.
How do I see whether my Nextcloud is getting login attempts from outside? Administration settings → Security → Brute-force protection shows blocked IPs. Plus the audit log.
What if someone knows our password and gets around 2FA? With correctly configured 2FA, that’s not possible — 2FA demands the second factor without exception. If someone managed to disable 2FA entirely (say with a stolen backup code): change the password, revoke all app passwords, close all active sessions.
What’s next
First login as a Nextcloud admin
What to do after your Nextcloud is provisioned — login, profile, the important first settings, what we handle and what you handle.
Admin GUI overview — what you'll find where
Nextcloud's administration settings are big. Here's a tour of the sections that matter and what they do.
Creating users and groups
Create users for family, club or team, organize groups, set quotas, control login behavior.
Sharing — files with others, internally and externally
Sharing files in Nextcloud — within your cloud with other users, with groups, or externally via sharing link.