Two-factor authentication

After the password, WordPress asks for a 6-digit code that changes every 30 seconds. No session is opened before that code.

Turn it on for your account

1. 1Install an authenticator app: Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden…
2. 2In WordPress, open Users > Two-factor authentication (or Profile > Two-factor authentication).
3. 3Scan the QR code with the app, or type the key shown.
4. 4Enter the 6-digit code to confirm.
5. 5Keep the 10 recovery codes somewhere safe: they will not be shown again.

Log in

Enter your password, then the code from the app. Without your phone, enter a recovery code: each one works once.

• 5 wrong codes in a row: the password is asked again.
• 10 wrong codes in 15 minutes: the account’s second step is locked for a while.
• A code already used is refused.

Require it for some roles

In the Firewall tab, Two-factor authentication card, tick the roles concerned, such as Administrator and Editor. These users are sent to the setup page until they have done it. The card also shows who has turned it on.

Apps and XML-RPC

For a protected account, password logins over XML-RPC and the REST API are refused. Apps that need them must use a WordPress application password.

Lost phone

• Log in with a recovery code, then set up 2FA again with your new phone.
• Or ask an administrator to click Reset next to your name.
• If no administrator can log in any more, add to wp-config.php:

define( 'SENTRIXWP_2FA_DISABLED', true );