Skip to main content

Setup

Setup​

Start with one administrator account before enforcing login requirements for a wider team.

  1. Install the Awthy ZIP supplied to you through Plugins → Add New Plugin → Upload Plugin, then activate it.
  2. Open Awthy → Account Security for your own administrator account.
  3. Test email recovery with a non-critical account and confirm the message arrives.
  4. In Two-factor authentication, choose Set up authenticator app. Scan the QR code with your authenticator, enter its current 6-digit code, and choose Verify.
  5. Store recovery material somewhere private and durable.
  6. Test a login challenge in a private browser session.
  7. Only then consider enforcement for administrators or staff.

Recovery before enforcement​

Awthy setup is recovery-first. Do not turn on stricter role enforcement until a real recovery path has been proven:

  • Email recovery has delivered to a mailbox the account owner controls.
  • Recovery codes have been generated, saved, and kept outside the WordPress dashboard.
  • The last administrator has a way back in that does not depend on an already-authenticated browser session.
  • Customer-facing WooCommerce flows have been tested before any customer enforcement claim is published.

Check the result​

The account page should show Two-factor authentication is active. Keep that browser signed in while you test a second login in a private window. Enter your password, then a current authenticator code. You should reach WordPress only after completing the second step.

For example, protect the store owner's account first, then repeat these steps for a shop manager. Do not test your only recovery path by deleting your authenticator. If a code fails, correct the phone's time and try a fresh code; see Troubleshooting if you still cannot sign in.

Last updated on