Enable and Manage 2FA (email and TOTP) on WordPress / WooCommerce

Objective

This article explains how to enable two-factor authentication (2FA) by email and by TOTP application (Google Authenticator, Authy, etc.) for WordPress accounts (administrators, editors, shop managers) and, optionally, for WooCommerce customer accounts. You will also learn how to configure access recovery, apply prudent rules, and troubleshoot common situations.

Who this article is for

• Administrators and security officers of WordPress/WooCommerce sites.
• Support teams who manage user access and credential recovery.

Prerequisites

1. Securantis plugin installed and activated on the WordPress site. The 2FA component of the plugin must be loaded by the plugin (usual activation during plugin startup).
2. Administrator access to the WordPress dashboard to enable and configure 2FA.
3. For TOTP: a code-generation application (Google Authenticator, Authy, OAuth-compatible) installed on users' smartphones.
4. For sending 2FA emails: a working email delivery system on WordPress (wp_mail correctly configured, SMTP if necessary).

Purpose and expected behavior

• Email 2FA: after correct password entry, a unique code is sent by email to the account holder; they must enter this code to complete the login.
• TOTP: the user links their TOTP app to their account; at each login they enter the 6-digit code provided by the app.

Steps to enable 2FA (administrator)

1. Verify email configuration: send a test email from the Securantis notification tool or from an SMTP plugin to confirm emails are being sent correctly. If emails fail, configure a reliable SMTP transport.

2. Open the 2FA configuration area of the Securantis plugin in the WordPress admin (plugin security / authentication section). Note: labels may vary; look for settings related to two-factor authentication or 2FA.

3. Enable the desired methods: allow email 2FA, TOTP, or both. You may offer both for greater flexibility to users.

4. Define the scope: choose whether 2FA is

   • optional for users,
   • recommended (encouraging message to enable),
   • or mandatory for certain roles (administrators, editors, shop managers).

5. Configure code validity periods for email and the TOTP time window: favor short durations (e.g. 5 minutes for email, standard 30 s window for TOTP) to reduce the risk of fraudulent use.

6. Save the configuration and inform users of the changed login procedure.

User procedure — enable TOTP

1. From their WordPress profile (or from the activation screen offered after login), the user chooses "Enable TOTP".
2. The site displays a QR code and a backup key. The user scans the QR with their TOTP app.
3. After configuring the app, the user enters a TOTP code to verify the pairing.
4. Provide immediate recovery codes or invite the user to record the backup key offline.

User procedure — enable email 2FA

1. The user enables the email 2FA option from their profile.
2. On the next login, after the password, a code is sent to the account email address. The user enters this code to finalize the login.

Access recovery and fallback measures

1. Backup codes: after enabling TOTP, offer printable or downloadable single-use codes. Store them offline. Each code must be usable only once.

2. Recovery address / alternate email: advise users to have a validated alternate email for receiving codes.

3. Manual support procedure:

   • Verify the requester's identity according to your internal policy (never ask for a password by email/chat).
   • If you must disable 2FA for an account, do so from the WordPress admin (user profile or user management) and record the justification for the action.
   • Perform any chargeable interventions only via the secure client area for paid assistance.

Prudent practices and recommended settings

• Require 2FA for high-privilege accounts (administrators, shop managers) but maintain a secure recovery channel.
• Keep at least two recovery methods: backup codes and alternate email.
• Avoid forcing 2FA for customers (WooCommerce) if it disrupts the purchase experience; offer it as an option or enable it only for access to the customer dashboard.
• Limit the number of attempts on the 2FA code field and log failures to detect attacks.
• Keep activation/deactivation logs for 2FA and email notifications when changes are made on privileged accounts.

WooCommerce-specific integration

• Customer accounts: if you enable 2FA for customer accounts, test the checkout flow — ensure a customer is not blocked when finalizing an order due to an unexpected re-authentication requirement.
• Event monitoring: the plugin logs security events and can notify administrators by email when 2FA is enabled/disabled on sensitive accounts.

Common errors and troubleshooting

1. Email 2FA not received

   • Check deliverability (SPF, DKIM, DMARC) and the recipient's spam filters.
   • Use an SMTP transport if wp_mail fails. Test sending from the plugin's notification tool.

2. TOTP codes rejected

   • Check the smartphone time (TOTP relies on accurate time). Ask the user to enable automatic time synchronization.
   • Ensure the user scanned the displayed key correctly and did not enter a key for another account.

3. Lost backup codes

   • Follow the support procedure for identity verification and 2FA reset.
   • Consider creating a second trusted administrator if you fear losing global access.

4. Administrator access lockout (critical scenario)

   • Always keep at least one administrator account protected by a known and verified 2FA method outside the primary account.
   • If all administrators are locked out, contact Securantis support providing the required proof of identity and follow the secure client access process.

When to contact Securantis support

• If the plugin does not offer 2FA activation despite a recent version and an active plugin.
• If 2FA emails appear to be sent but the sending queue returns a persistent error.
• If you observe abnormal behaviors (codes accepted without authentication, multiple unexplained failures).

Support levels

• Basic diagnosis (included): check email configuration, manual TOTP tests, review event logs.
• Advanced intervention (paid): direct modification of user settings, 2FA reset after identity verification. Paid interventions are handled via the secure client area after acceptance of terms and payment.

Legal and security precautions

• Never ask a user to send their password by email or chat.
• Any manual 2FA deactivation must be documented and justified. Only perform it if the requester's identity is verified according to your internal procedures.

Key takeaways

• Offering both TOTP and email 2FA balances security and usability.
• Prepare fallback procedures: single-use codes, alternate email, and a strict support process.
• Test any configuration on a non-critical account before global deployment, and monitor the plugin's notifications and logs for anomalies.

Example tests to perform after activation

1. Administrator test: enable TOTP on a secondary account, log out and perform a full login.
2. Email test: request an email 2FA code and verify reception across different providers (Gmail, Exchange).
3. WooCommerce customer test (if enabled): login and checkout flow to ensure no step is broken.

If you need help defining a 2FA policy adapted to your shop or for a recovery intervention, contact Securantis support via the secure client area. We will guide you step by step and, if necessary, schedule an intervention according to your security policy.