2FA error on all users

Hello @ndenlinger

I’m sorry to hear that you’re experiencing such issues and I’m sorry for the delay.

We’re trying to assist everyone as fast as we can but I’d appreciate some patience as sometimes there’s more questions to follow-up than usually and it takes a bit more time.

Getting back to issues though:

The “Whoops, the passcode you entered was incorrect or expired.” issue is usually caused by timecode/time setting discrepancies. Please make sure with your host that server time is correct and also check if the time used by WordPress is not delayed/advanced in comparison to server time (I’m not referring to time zone settings but rather to small differences such as a minute or a few minutes; sometimes such differences are happening due to some “non-standard” code in a theme or one of the plugins).

If that’s all correct, then in Google Authenticator app there’s an option in “Settings” named “Time correction for codes”. Use that option in app of every user that cannot login due to the issue that you reported and it should fix the problem.

As for e-mails. The “Lost phone” option is meant to send an email (upon request) to the registered e-mail address of a user. I understand that such e-mails are not delivered but Defender is using whatever method your WordPress is currently using to send messages and it sends them “from the site”.

By this I mean that by default it’s using wp_mail() function which, in fact, uses standard PHP mail() function and that sometimes might be an issue because hosts often put limits on number of the e-mails that can be sent or block sending e-mails to or from outside of certain/defined domains or put some super-strict spam filters that could possibly catch such messages.

Can you confirm that those “lost phone” messages weren’t moved to spam folders in target inboxes and also that all other e-mails from the site (such as e.g. user registration activation e-mails or lost password e-mails) are properly delivered?

Kind regards,
Adam

Hello @ndenlinger,

I am glad to know you were able to fix it with the help of Jacobo. You can also try to use the WP Mail SMTP plugin and try to configure your email SMTP with the help of the plugin as mentioned by Jacobo and check if it works for you.

Should you have any doubts or need any help, feel free to reply in the thread below and we would be happy to help!

Regards
Prathamesh Palve

Hi @ndenlinger

Thanks for all the information and I apologize for the confusing – with us assuming it’s resolved.

The “workaround” that Jacobo helped you with would work, indeed, but just to let you regain access to 2FA-protected site. I think the “core” issue here would be what you described in your previous post about “production vs staging” testing.

I agree that it seem that for some reason whichever of these sties had 2FA enabled as second/later, seems to “overwrite” account in Google Authenticator. That’s actually strange because it’s perfectly fine for two sites to run that way – one under top-level domain and one under sub-domain – and they should both be able to use its own authorization.

But this case looks different and results of your test (especially that no additional account shows up in the app) seems to confirm that. I must admit that I’ve never came across that before! So, wondering what might be causing it, I checked what information is passed through the 2FA activation QR code and apart form some “constant” strings, it’s always

– site name (e.g. “My super site”, just like you got that set in “Site Title” option on “Settings -> General” page)

– user’s e-mail address

– issuer name (which is the same as a site name actually)

– and some “secret” (a “secret key”).

Theoretically speaking if all that is the same on two sites, it would override “account” in Google Authenticator because app would assume you’re using the same site. But taking that into account, I’d say that it’s more of a “weakness” of the protocol rather than Defender’s issue then – as we didn’t “invent” the process 🙂

I’m not exactly sure how the entire 2FA protocol works “algorithm-wise” and how the “secret” is used but I’d like you to ask you if you could, please, test one more thing:

– could you change (on one of the sites, live or staging) the site title (via “Settings -> General” page) before enabling 2FA on it? After that, clear all caches – if there are any – and try enabling it again to see if it works.

– make also sure that on “Settings -> General” page both “WordPress Address (URL)” and “Site Address (URL)” options are reflecting actual URL of a given site (sometimes moving between production and staging might result in one of them not being updated properly; depending on the tool used).

Would you give it a try and let me know of results?

And I’m not sure how to configure the WP Mail SMTP plugin.

If you’re using GSuite (if I understand correctly) that might be a bit “tricky” as it require creatin of Google app (project) in Google Developers Console. First, you should select “Google/Gmail” in “Mailer” option on “WP Mail SMPT -> Settings” page in your site’s back-end. Then you’ll create an app and oauth crednetials so it’d be best if you’d follow this documentation straight from WP Mail SMTP plugin creators as it walks through the process “step by step”:

https://wpmailsmtp.com/docs/how-to-set-up-the-gmail-mailer-in-wp-mail-smtp/

Best regards,
Adam