Two-Factor Authentication Configuration (Pro)

Step 4: Configure Role-Based Requirements

Select Roles Requiring 2FA

Available checkboxes:

☐ Require for Administrators

☐ Require for Editors

☐ Require for Authors

☐ Require for Contributors

☐ Require for Subscribers

☐ Require for Customers

Recommended Configurations

Configuration 1: High Security (Recommended)

For: Corporate, healthcare, financial sites

☑ Require for Administrators

☑ Require for Editors

☑ Require for Authors

☐ Require for Contributors

☐ Require for Subscribers

☐ Require for Customers

Rationale: Protect all users who can publish content or access sensitive data.

Configuration 2: Admin Only (Conservative)

For: Initial rollout, testing phase

☑ Require for Administrators

☐ Require for Editors

☐ Require for Authors

☐ Require for Contributors

☐ Require for Subscribers

☐ Require for Customers

Rationale: Start small, test thoroughly, then expand.

Configuration 3: All Staff (Maximum Security)

For: High-security environments, compliance requirements

☑ Require for Administrators

☑ Require for Editors

☑ Require for Authors

☑ Require for Contributors

☐ Require for Subscribers

☑ Require for Customers (if handling financial data)

Rationale: Maximum protection for all users with elevated privileges.

Configuration 4: E-Commerce Focus

For: Online stores, WooCommerce sites

☑ Require for Administrators

☑ Require for Shop Managers

☐ Require for Customers (optional—see below)

Customer 2FA considerations:

• Pros: Protects order history, payment methods, personal data

• Cons: May reduce conversion rates, adds friction

• Recommendation: Optional or for high-value customers only

Step 5: Configure Excluded Roles (Optional)

When to Use Exclusions

Common scenarios:

• Support staff needing quick access

• Service accounts for integrations

• Emergency access accounts

• Testing accounts

Add Excluded Roles

Steps:

• In 2FA settings, find "Excluded Roles" section

• Check roles to exclude from 2FA

• Add notes explaining why (for documentation)

• Save changes

Example:

☑ Support Staff - Quick troubleshooting access

☑ API Service Account - Integration requirement

☐ Emergency Admin - Keep secured

Step 6: Configure Email Settings

Sender Information

From Name:

Default: WordPress site name

Recommended: Your company/site name

Example: "Acme Corp Security"

From Email:

Default: wordpress@yourdomain.com

Recommended: noreply@yourdomain.com or security@yourdomain.com

Email Template

Subject Line:

Default: "Your verification code for [Site Name]"

Customizable: Yes

Email Body:

Customize the verification email content

Include branding, helpful instructions

Keep code prominent and easy to find

Example template:

Hello [Username],

Your verification code is: [CODE]

This code will expire in 10 minutes.

If you didn't request this code, please contact support immediately.

Best regards,

[Site Name] Security Team

Step 7: Test with Real Account

Create Test User

Steps:

• Create new user account

• Assign role that requires 2FA (e.g., Editor)

• Use real email address you can access

• Note username and password

Test Login Flow

Complete login:

• Log out of admin account

• Go to login page

• Enter test user credentials

• Submit login form

• Verify: Redirected to 2FA verification screen

• Check email for verification code

• Enter code on verification screen

• Verify: Successfully logged in

Verify Email Receipt

• Email arrived: Within 1-2 minutes
• Code visible: Easy to read and copy
• Not in spam: Arrived in inbox
• Professional: Proper sender name and branding

Step 8: Configure Additional Security

Failed Attempt Limits

Prevent brute force attacks on verification codes:

Maximum Failed Attempts: 5

Lockout Duration: 30 minutes

How it works:

• User gets 5 attempts to enter correct code

• After 5 failures, account locked for 30 minutes

• User must wait or contact admin for reset

Resend Cooldown

Prevent code spam:

Resend Cooldown: 60 seconds

How it works:

• User can't request new code immediately

• Must wait 60 seconds between resend requests

• Prevents email flooding

Step 9: User Communication

Notify Users in Advance

Email announcement (1 week before):

Subject: Important: Two-Factor Authentication Coming Soon

Dear [User],

Starting [Date], we're implementing Two-Factor Authentication

to enhance security for your account.

What this means:

• When logging in, you'll receive a verification code via email

• Enter this code to complete login

• Adds an extra security layer to protect your account

What you need to do:

• Ensure your email address in your profile is current

• Add [sender-email] to your contacts

• Check spam/junk folder if you don't receive codes

This change affects: [List roles]

Questions? Contact [support-email]

Thank you,

[Site Name] Team

Login Page Notice

Add notice to login page:

"Two-Factor Authentication is now required for [roles].

You will receive a verification code via email."

Create Help Documentation

Provide to users:

• Step-by-step login guide with screenshots

• Troubleshooting common issues

• Support contact information

• FAQ about 2FA

Step 10: Monitor and Support

Check Audit Logs

Monitor 2FA activity:

Tools → Audit Log → Filter by "2FA"

Watch for:

• High failure rates (indicates user confusion)

• Repeated lockouts (may need training)

• Email delivery failures

• Unusual patterns

Prepare Support Team

Common support requests:

• "I didn't receive the code"

- Check spam, wait 2 minutes, resend code

• "Code expired before I could enter it"

- Request new code, enter immediately

• "I lost access to my email"

- Admin must reset 2FA or update email

• "It's taking too long"

- Balance security with user experience

- Consider feedback for improvements

Configuration Examples

Example 1: Small Business

2FA Enabled: Yes
Required Roles:
  - Administrators
  - Editors
Code Expiration: 10 minutes
Failed Attempts: 5
Exclusions: None
Email: SMTP plugin configured

Example 2: Healthcare (HIPAA)

2FA Enabled: Yes
Required Roles:
  - All roles with patient data access
Code Expiration: 10 minutes
Failed Attempts: 3 (stricter)
Exclusions: None (compliance requirement)
Email: Transactional service (SendGrid)
Audit Logging: Required, retained 7 years

Example 3: E-Commerce Store

2FA Enabled: Yes
Required Roles:
  - Administrators
  - Shop Managers
  - Editors
Code Expiration: 10 minutes
Failed Attempts: 5
Exclusions: Customer role (optional)
Email: WooCommerce SMTP

Troubleshooting Configuration

2FA Option Not Visible

Settings Not Saving

Emails Not Sending After Configuration