Account Security Options

Account Security Options

Open Account Security while signed in to the account you want to protect. Start with an authenticator and recovery codes before adding other login methods.

Two-factor authentication

You need an authenticator app and access to your account's email.

1. In Two-factor authentication, select Set up authenticator app.
2. Scan the QR code in your authenticator app.
3. Enter the app's current 6-digit code and select Verify.
4. Save the recovery codes privately, outside WordPress.
5. Keep this session open and test a login in a private browser window.

The panel shows Two-factor authentication is active after enrollment. Cancel setup discards a pending setup; it does not turn off an active authenticator. If codes fail, check the phone's automatic time setting and use a fresh code. See Recovery if the device is unavailable.

For example, set up the store owner's account, confirm the second login works, then repeat for a shop manager.

Recovery codes

Each recovery code works once. Keep them in a password manager or another private place you can reach without signing in to WordPress. Never send them to support.

To replace them, choose Generate new recovery codes, enter a current authenticator code, and select Confirm regenerate. The old set stops working; save the new set before leaving the page.

Passkeys

Use the Passkeys panel to register a device or password-manager credential. Name it so you recognize it later, for example “Work laptop”. Keep another recovery method available before removing a credential. Follow the passkey guide.

Trusted devices

Trust only a private browser you control. Review remembered browsers and revoke ones you no longer use. A shared computer should always ask for the second factor. See Trusted devices.

Connected login providers

If your administrator enabled a provider, you can link that provider to your WordPress account. Keep password and recovery access available in case the provider is unavailable. See External identity providers.

Security activity

Review recent security changes for actions you recognize. If a login method changed unexpectedly, review Sessions, change your password, and contact the site administrator.

Role enforcement

Administrators can require selected roles to enroll. First confirm that one administrator can complete login and recovery, then preview the affected roles before saving a requirement. Start with administrators and shop managers. See Customer 2FA before including customers.

External provider configuration

Administrators configure and test provider applications in Awthy Settings. The redirect URI must match the provider's application. Enable only the audience that needs access. Keep client secrets out of tickets and screenshots. See provider setup.

Issuer

The issuer identifies your site in authenticator apps. Use a recognizable store name, for example “Example Store”. Changing the setting does not make an existing authenticator entry easier for a user to identify; tell users if the store name changes.

Drift window

Keep the default code window. If codes are rejected, correct device and server time before widening the accepted window.

XML-RPC and application passwords

Identify integrations that use these non-browser login methods before blocking them. A publishing app or automation can stop working when its authentication path is disabled.

Trusted proxies

Ask your hosting operator for the exact proxy addresses or ranges before changing this setting. Only a trusted proxy may supply the visitor address through forwarding headers; accepting arbitrary headers can make audit IPs misleading.

System diagnostics

For a support request, generate a configuration report. Share the redacted support report after checking it. Do not send the internal report, QR code, secret, or recovery codes.