2FA via App -> ERROR: Invalid Authentication Code.

Hi @dougjoseph, thanks for reaching out. We’re happy to help!

TOTP-based methods are time-sensitive, so I wonder if the backup restore shifted your server’s timezone, causing the error. Can you confirm that your device and server times are in sync? Please use this guide on how to sync the times: Troubleshooting issues with Authy or Google Authenticator

If you need help temporarily disabling Solid Security for you to access the site, please follow the instructions here: How Do I Disable All Features If I Can’t Access My Site? (remember to include the disable for 2FA). Once you’ve synced the times, remove the code snippets that disable the plugin and re-test the Mobile App 2FA method.

If the error persists, disable the plugin again, remove the registered 2FA key from your Google Authenticator app, and go to your WP -> Users -> Profile page. From there, please scroll down to the 2FA section, scan a new QR code, and register it on your device.

Hope this helps, and let us know how it goes!

Thanks. I will try to circle back after checking.

Is the included 2FA feature supposed to ignore subdomains and other domains in a multisite hub?

When I created logins in the Google authenticator app, I created one for each of our sites.

However, the 2FA feature of the plugin apparently wants to use the same secret for every single site in our multisite hub (both subdomains and domains).

I only figured that out by noticing it while I was going to each of the sites, clicking into my profile settings within each site, and resetting the secret. I noticed that the most recent secret was overwriting all the earlier secrets on the other sites. That meant, I think, that all the previously made logins in the authenticator app, were based on an earlier secret now deleted. Thus, presumably that would mean only the latest distinct login in the authenticator app works.

I seem to either not understand how this is supposed to work, or it’s not working right, and I’m not sure which.

OK, so armed with the knowledge that that the plugin seems to use the same secret for one user on all sites in a multisite hub, I tried, within the Google authenticator app, using only one login for all sites, and that seems to work for logging into all the sites. I guess I just did not understand how it was supposed to work.

• This reply was modified 11 months, 2 weeks ago by dougjoseph.