Skip to content

Sign-in

Two-factor authentication

Every planAbout Two-Factor Authentication

Adds a second step to signing in: after the password, a code from a phone app or an email. A stolen password alone is no longer enough to get in.

What it does

Once a user has set it up, signing in takes two steps: the usual password, then a second proof that only they have.

Authenticator App (TOTP): an app such as Google Authenticator, Microsoft Authenticator or 1Password shows a 6-digit code that changes every 30 seconds.

Email Code: a code is emailed to the user each time they sign in.

Email Magic Link: a one-click sign-in link is emailed instead of a code.

Every user also gets 8 backup codes. Each works once, for when the phone is lost.

Why it matters

Passwords leak: reused on another site, typed into a fake page, or guessed. Two-factor sign-in stops all of these, because the attacker does not have the user's phone or inbox.

It matters most for administrators, who can change everything on the site.

Switch it on for the site

  1. Go to the Login tab, section Sign-in security, and switch on Two-Factor Authentication.
  2. Under Available Methods, tick the methods users may choose. The app method is the strongest; keep it on.
  3. Set Code/Link Expiration: how many minutes an emailed code or link stays valid. 10 is a good start.
  4. Choose who must use it in Require 2FA. Administrators is a good first step.
  5. Click Save Changes.

Set it up for yourself

  1. Open your WordPress profile (Users, then Profile) and find Two-Factor Authentication.
  2. Click Set Up Two-Factor Authentication and choose a method.
  3. For the app, scan the QR code with your phone and type the code it shows. For email, type the code that arrives.
  4. Confirm with your password, then save your backup codes somewhere safe, such as a password manager.

Good to know

Users who must use two-factor and have not set it up are taken to their profile until they do. They can still sign out.

Five wrong codes in a row pause that account's second step for 5 minutes, doubling with each pause up to an hour.

If a user loses their phone and backup codes, an administrator can click Reset Two-Factor on that user's profile. You cannot reset your own this way.

Apps that sign in with an application password skip the second step; switch application passwords off on the Hardening tab if nobody needs them.

Locked out by the second step? Add define( 'SMG_DISABLE_2FA', true ); to wp-config.php, sign in, fix it, and remove the line. See Recovery switches.

Which plan includes it

Two-factor with the app and email code, backup codes, and requiring it for administrators are in every plan. The email magic link method and requiring it for all users, chosen roles or chosen users are part of Pro.

How it works, for developers
  • App codes follow the TOTP standard: 6 digits, 30-second steps, SHA-1, one step of clock drift allowed either way. A code that was already used cannot be used again (user meta smg_2fa_last_step).
  • App secrets are encrypted with AES-256-GCM before they are stored (user meta smg_2fa_secret, prefix $smg_enc$). The key is derived from SMG_ENCRYPTION_KEY if defined, otherwise AUTH_KEY. The OpenSSL extension is required.
  • Backup codes are stored only as password hashes (user meta smg_2fa_backup_hashes). Emailed codes live in a short-lived transient; magic links are stored hashed in the smg_magic_links table and only work while that sign-in is waiting.
  • Flow: after the password is accepted, wp_login at priority 1 removes the new session and sends the browser to ?action=smg_2fa on your sign-in address. The session is only created once the second step passes.
  • Enforcement for required users runs on admin_init, blocks admin AJAX except the setup actions, and returns 403 on the REST API (rest_authentication_errors). XML-RPC sign-in is refused for users with two-factor on.
  • Settings: smg_2fa_enabled, smg_2fa_methods_enabled, smg_2fa_email_code_expiry, smg_require_2fa_mode, smg_require_2fa_roles, smg_require_2fa_users.

Quick answers about two-factor authentication

What does Two-factor authentication do in Stack Guard?

Once a user has set it up, signing in takes two steps: the usual password, then a second proof that only they have. Authenticator App (TOTP): an app such as Google Authenticator, Microsoft Authenticator or 1Password shows a 6-digit code that changes every 30 seconds. Email Code: a code is emailed to the user each time they sign in. Email Magic Link: a one-click sign-in link is emailed instead of a code. Every user also gets 8 backup codes. Each works once, for when the phone is lost.

Why use two-factor authentication on a WordPress site?

Passwords leak: reused on another site, typed into a fake page, or guessed. Two-factor sign-in stops all of these, because the attacker does not have the user's phone or inbox. It matters most for administrators, who can change everything on the site.

How do I set up two-factor authentication?

1. Go to the Login tab, section Sign-in security, and switch on Two-Factor Authentication. 2. Under Available Methods, tick the methods users may choose. The app method is the strongest; keep it on. 3. Set Code/Link Expiration: how many minutes an emailed code or link stays valid. 10 is a good start. 4. Choose who must use it in Require 2FA. Administrators is a good first step. 5. Click Save Changes.

Which Stack Guard plan includes two-factor authentication?

Two-factor with the app and email code, backup codes, and requiring it for administrators are in every plan. The email magic link method and requiring it for all users, chosen roles or chosen users are part of Pro.

More in Sign-in

Not running Stack Guard yet? It is free.

Download Free