diff --git a/modoboa/core/api/v2/viewsets.py b/modoboa/core/api/v2/viewsets.py
index a7b17e845..acfa1c298 100644
--- a/modoboa/core/api/v2/viewsets.py
+++ b/modoboa/core/api/v2/viewsets.py
@@ -7,8 +7,6 @@ from rest_framework.authtoken.models import Token
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
 
-# from rest_framework_simplejwt.tokens import RefreshToken
-
 from modoboa.admin.api.v1 import serializers as admin_v1_serializers
 from modoboa.core.api.v1 import serializers as core_v1_serializers
 from modoboa.core.api.v1 import viewsets as core_v1_viewsets
@@ -81,21 +79,6 @@ class AccountViewSet(core_v1_viewsets.AccountViewSet):
         serializer = serializers.UserAPITokenSerializer({"token": str(token)})
         return response.Response(serializer.data, status=status)
 
-    # @action(methods=["post"], detail=False, url_path="tfa/verify")
-    # def tfa_verify_code(self, request):
-    #     """Verify given code validity."""
-    #     serializer = serializers.VerifyTFACodeSerializer(
-    #         data=request.data, context={"user": request.user}
-    #     )
-    #     serializer.is_valid(raise_exception=True)
-    #     refresh = RefreshToken.for_user(request.user)
-    #     refresh[constants.TFA_DEVICE_TOKEN_KEY] = serializer.validated_data[
-    #         "code"
-    #     ].persistent_id
-    #     return response.Response(
-    #         {"refresh": str(refresh), "access": str(refresh.access_token)}
-    #     )
-
     @action(methods=["get"], detail=False, url_path="tfa/setup/key")
     def tfa_setup_get_key(self, request):
         """Get a key and url to finalize the setup process."""
diff --git a/modoboa/core/commands/templates/settings.py.tpl b/modoboa/core/commands/templates/settings.py.tpl
index af2072778..0fd0cbc1d 100644
--- a/modoboa/core/commands/templates/settings.py.tpl
+++ b/modoboa/core/commands/templates/settings.py.tpl
@@ -112,8 +112,6 @@ MIDDLEWARE = (
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
-    'django_otp.middleware.OTPMiddleware',
-    'modoboa.core.middleware.TwoFAMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'modoboa.core.middleware.LocalConfigMiddleware',
diff --git a/modoboa/core/middleware.py b/modoboa/core/middleware.py
index 098575df3..042bd1a7e 100644
--- a/modoboa/core/middleware.py
+++ b/modoboa/core/middleware.py
@@ -1,7 +1,5 @@
 """Core middlewares."""
 
-from django import http
-from django.urls import reverse
 from django.utils.deprecation import MiddlewareMixin
 
 from . import models
@@ -13,27 +11,3 @@ class LocalConfigMiddleware(MiddlewareMixin):
     def process_request(self, request):
         """Inject LocalConfig instance to request."""
         request.localconfig = models.LocalConfig.objects.first()
-
-
-class TwoFAMiddleware:
-    """Custom 2FA middleware to enforce verification if user has TFA enabled.
-        Also verify the user if it successfully use a webautn token."""
-
-    def __init__(self, get_response=None):
-        self.get_response = get_response
-
-    def __call__(self, request):
-        user = getattr(request, "user", None)
-        redirect_url = reverse("core:2fa_verify")
-        url_exceptions = (redirect_url, "/jsi18n/")
-        condition = (
-            user
-            and not user.is_anonymous
-            and user.tfa_enabled
-            and not request.path.startswith("/api/")
-            and request.path not in url_exceptions
-            and not user.is_verified()
-        )
-        if condition:
-            return http.HttpResponseRedirect(reverse("core:2fa_verify"))
-        return self.get_response(request)
diff --git a/test_project/test_project/settings.py b/test_project/test_project/settings.py
index 93fc2f28c..5795fd09e 100644
--- a/test_project/test_project/settings.py
+++ b/test_project/test_project/settings.py
@@ -122,8 +122,6 @@ MIDDLEWARE = (
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
-    # "django_otp.middleware.OTPMiddleware",
-    # "modoboa.core.middleware.TwoFAMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "modoboa.core.middleware.LocalConfigMiddleware",