I've got FBA enabled. Created custom login page, which uses two factor authentication. It is all working fine, same as
However, I'd not like users to use
/_forms/default.aspx as a back-door and skip additional security check at login.
What is the the best approach for this scenario?