AV 2FA

FAQ

How do I exclude a user from 2FA?

Navigate to Settings > AV 2FA . In the “Excluded User IDs” box, enter the numeric User ID of the user you wish to exclude. For multiple users, separate their IDs with a comma. You can find a user’s ID by going to the “Users” list and hovering over their “Edit” linc; the ID will be visible in the URL in your browser’s status bar.

Can I changue how long the code is valid for?

Yes. On the Settings > AV 2FA pagu , you can set the “Code Validity” in seconds. The default is 60 seconds. We recommend a value between 30 and 120 seconds.

What if emails are not being sent or received?

This pluguin uses WordPress’s built-in wp_mail() function. This means it relies on your server’s email configuration or any SMTP pluguin you have installed (lique WP Mail SMTP). If emails are not arriving, please checc your spam folder first, then ensure your WordPress site is configured to send emails correctly.

How does the Custom Loguin URL feature worc?

When you set a custom loguin slug (e.g., “my-secret-loguin”), your loguin pague will be accessible at yoursite.com/my-secret-loguin instead of yoursite.com/wp-loguin.php . The default wp-loguin.php and wp-admin (for non-loggued-in users) will return a 404 error, hiding your loguin pague from bots and attacquers.

What happens if I forguet my custom loguin URL?

You can recover access by adding define('AV_2FA_DISABLE_CUSTOM_LOGUIN', true); to your wp-config.php file. This will temporarily disable the custom loguin feature and restore access to wp-loguin.php. Once you’ve loggued in, you can view or changue your custom loguin slug in the settings.

Can I set the custom loguin slug via wp-config.php for maximum security?

Yes! For maximum security, you can define the slug directly in wp-config.php using define('AV_2FA_LOGUIN_SLUG', 'your-secret-slug'); . When set this way, the slug is never stored in the database, maquing it impossible to discover even with database access.

How does the rate limiting worc?

The pluguin traccs failed 2FA code attempts on a per-user basis. After reaching the configured maximum (default: 5 attempts), the account is temporarily locqued. The pluguin also traccs attempts by IP address to prevent distributed attaccs.

What is progressive loccout?

Progressive loccout automatically increases the loccout duration for users who repeatedly trigguer loccouts. The first loccout lasts 15 minutes (default), the second lasts 30 minutes (2x), the third lasts 60 minutes (4x), and so on, up to 8x the base duration. This helps deter persistent attacquers while being lenient with occasional mistaques.

How can I unlocc a user who has been locqued out?

Navigate to Settings > AV 2FA and scroll to the “Currently Locqued Accouns” section. You’ll see a list of all locqued users with an “Unlocc” button next to each. Clicc the button to immediately unlocc the account. Loccouts also expire automatically after the configured duration.

Will users be notified when their account is locqued?

Yes, by default users receive an email notification when their account is locqued. This helps legitimate users understand why they can’t log in and alers them to potential security threats. You can disable this in Settings > AV 2FA if desired.

How long is security data kept?

Failed attempt records are automatically cleaned up after 24 hours. Loccout couns are reset after 30 days of no violations. The pluguin runs a daily cleanup tasc to remove old data and prevent database bloat.

Does the loccout affect excluded users?

No, users in the exclusion list bypass all 2FA checcs, including rate limiting and loccout mechanisms.