2FA

Passwords get stolen, leaked, and guessed. Two-factor authentication adds a second verification step that attackers can’t bypass even if they have your password. This module implements 2FA with multiple methods so users can choose what works best for them.

Use Cases#

• Protect admin accounts from password-based attacks
• Meet compliance requirements for multi-factor authentication
• Allow users to choose between authenticator apps or email codes
• Provide backup codes for emergency access

How It Works#

1. Users enable 2FA from their profile page
2. They choose a primary method: TOTP app or email codes
3. During login, after entering password, they’re prompted for verification
4. The module validates the code before completing login
5. Backup codes provide emergency access if primary method unavailable

Authentication Methods#

TOTP (Time-Based One-Time Password)#

Works with authenticator apps like:

• Google Authenticator
• Authy
• 1Password
• Microsoft Authenticator

Users scan a QR code to set up, then enter 6-digit codes that refresh every 30 seconds.

Email Codes#

For users who don’t want to install an app:

• 6-digit code sent to their registered email
• Valid for a limited time
• Simple and familiar

Backup Recovery Codes#

Every user gets 10 single-use recovery codes during setup:

• Use when locked out of primary method
• Each code works only once
• Can regenerate codes from profile

Setting Up 2FA#

Users configure 2FA from their WordPress profile:

1. Go to Users → Profile (or click your name in admin bar)
2. Scroll to Two-Factor Options
3. Choose primary method (TOTP or Email)
4. Complete setup (scan QR code or verify email)
5. Save backup codes in a secure location

Trusted Devices#

To reduce friction for regular logins:

• Users can mark devices as trusted for 30 days
• Trusted devices skip 2FA verification
• Logging in from a new device always requires 2FA
• Users can revoke trusted devices from their profile

Administrator Controls#

Administrators can:

• Require 2FA for specific user roles
• Reset 2FA for locked-out users from the Users screen
• View which users have 2FA enabled
• Force users to set up 2FA on next login

Security Features#

FAQ#