Two-Factor Authentication Setup

What is Two-Factor Authentication?

2FA adds an extra security layer by requiring:

1. Something you know: Your password
2. Something you have: Verification code

Enabling Two-Factor Authentication

Step 1: Access Security Settings

1. Navigate to User Access → Security
2. Click “Two-Factor Authentication” tab

Step 2: Configure Global Settings

Enable 2FA

• Toggle “Enable 2FA” to ON

Enforcement Policy

• Optional: Users choose to enable
• Required for Admins: Admins must use 2FA
• Required for All: Every user needs 2FA
• Role-Based: Specific roles only

Code Settings

• Code Length: 6 digits (recommended)
• Code Validity: 10 minutes
• Resend Limit: 3 attempts per session

Step 3: Configure Email Settings

1. Go to User Access → Email Settings
2. Configure SMTP (essential for reliability)
3. Test email delivery
4. Verify 2FA emails aren’t spam-filtered

Step 4: Role-Based Requirements

User Enrollment Process

For Users (Self-Enrollment)

1. Go to Profile → Security Settings
2. Click “Enable Two-Factor Authentication”
3. Verify email address
4. Save backup recovery codes
5. Complete enrollment

For Administrators

1. Go to Users → All Users
2. Edit user profile
3. Find “Security Settings”
4. Enable/disable 2FA
5. Reset if user locked out

Testing 2FA

Test Checklist

• ✅ Successful login with correct code
• ✅ Error handling for wrong code
• ✅ Code expiration works
• ✅ Code resend functions
• ✅ Email delivery is prompt
• ✅ Mobile view works properly
• ✅ Recovery codes function
• ✅ Account lockout after max attempts

User Login Flow with 2FA

1. User enters username/password
2. Credentials validated
3. 2FA triggered → code sent to email
4. User enters 6-digit code
5. Code validated
6. Access granted → redirect to dashboard

Email Template Customization

1. Go to User Access → Email Templates
2. Find “Two-Factor Authentication Code”
3. Customize subject and body
4. Use placeholders: {code}, {user_name}, {expiry_time}
5. Preview and test
6. Save changes

Recovery Options

Recovery Codes

• 10 single-use codes generated
• Each bypasses 2FA once
• Stored encrypted
• Can regenerate anytime

Administrator Reset

1. Go to Users → All Users
2. Edit locked-out user
3. Find “Two-Factor Authentication”
4. Click “Reset 2FA”
5. User can log in without 2FA
6. Must re-enroll

Troubleshooting

Best Practices

Security Best Practices

• Start with admins first
• Educate users on 2FA usage
• Monitor enrollment rates
• Regular security audits
• Test periodically

User Experience Best Practices

• Gradual rollout timeline
• Clear communication
• Provide support resources
• Allow trusted devices (Pro feature)
• Offer multiple methods when possible

Advanced Configuration

Developers can customize using hooks:

// Modify 2FA requirement
add_filter('attrua_require_2fa', function($required, $user) {
    if (get_user_meta($user->ID, 'high_security', true)) {
        return true;
    }
    return $required;
}, 10, 2);

// Customize code expiration
add_filter('attrua_2fa_code_expiry', function($expiry, $user) {
    if (in_array('administrator', $user->roles)) {
        return 15 * MINUTE_IN_SECONDS;
    }
    return $expiry;
}, 10, 2);