I was stilled logged in with another device on another IP I looked into the dashboard for any blockes, but there were none – even in the database itself I could find any entries within the related tables.

After some time the timeout from my site resolves, but I have to deactivate the plugin via FTP, so I can surpass the MFA-setup…

Has anyone else had similar problems and could resolve them or has any idea what could trigger this phenomenon?

I realized that it was likely because BigCommerce was hijacking the login and probably trying to redirect me, as BigCommerce forces you to select a custom login page (I can’t find a way to use the default /wp-admin/). I edited the page template for this custom BigCommerce login and simply used the wp_login_form() function. I can see that this new login form is definitely in use, but it isn’t having an effect. I’m still just being redirected back to the login page without errors or comment.

I tested this all on a staging site, and found that yes, removing BigCommerce resolves the issue. I have been unable to find a way to disable the BigCommerce login redirect, and I’m not able to change the BigCommerce login page to the standard WordPress login screen.

Does anyone have any ideas on how to resolve this? I can edit the custom login page in any way, I just can’t change how BigCommerce hijacks the login.

Since the original bug report post from February 2023 is locked, I had to create a new topic. Please note this is a follow up to the original topic.

Please consider adding a filter to the private function generate_otp_url in /modules/login-security/classes/model/2fainitializationdata.php, passing the base32 encoded secret as an argument. That way, we can use the email address as the user parameter and site name as the issuer parameter (instead of username and site URL).

Otherwise, please consider changing the default parameters so they follow the common OTPAuth standard.

I’m interested in using your Solid Security plugin for my company’s WordPress website.

I would like to know if the plugin includes an option of changing the default wp-admin address on our website. and what versions include this feature if so.

I need 2FA and change of default address on our website and i’m looking for the right plugin for us.

thank’s in advance.

I wonder if you have any news regarding support for WordPress’ native login block?

I totally understand that you cannot support third-party login forms, but it would be great if the native login block was supported (just like Woocommerce’s login form and the form on wp-login.php). The current issue is that users who’ve activated Wordfence 2FA aren’t prompted for their one-time password when signing in through the login block’s form.

We are using office 365 mail in WP site to for emails. Now we are planning to enable MFA. Is there something special with the SMTP connection settings for Word Press to facilitate MFA?

Kindly guide.

Thanks.

https://www.ads-software.com/support/topic/filter-for-qr-code/

I wonder if you have any ETA for when the plugin will be updated with the right issuer (i.e., the website name, not Wordfence)? Implementing a filter like the one suggested would also be very welcome since many sites only use email addresses for logging in, not usernames.

Eventually, I figured out how to whitelist each of their IPs to have them log in without 2FA, then instructed them to reconfigure their 2FA (/wp-admin/network/admin.php?page=WFLS). This is temporarily working.

However, I’m worried that it’s not a permanent fix for those users and ones in the future. One user says when she goes to the link above, it still says she need to configure 2FA even after she reset it. And why does it say on my end that these accounts are “active”? Finally, I now see some users listed as “not allowed” who have been “active” for a long time. I just waiting for them to tell me they can’t log in.

Please let me know of any paths forward to ensure my user have easy access to properly-working 2FA. Thanks for your assistance.

<strong>CODE REQUIRED</strong>: Please provide your 2FA code when prompted.

The strange thing is that I wasn’t prompted for a 2FA code. Fortunately, I just need to try to sign in again, and everything works as a charm the second time. I’ve successfully replicated the issue with multiple users on the same site.

I’m currently trying to replicate the issue on a new WordPress install with no other plugins running, something I haven’t succeeded with yet. I therefore don’t know if it’s a bug or just a plugin conflict.