ndenlinger

Hi Adam,

Thank you for following up with me. I appreciate your time in helping me troubleshoot this.

Workaround:
I signed up for 7 day free-trial where I utilized WPMU DEV 24/7 support chat feature. I chatted with Jacobo Castillo who helped with a workaround. He disabled Defender by accessing our server using FileZilla, and modifying the defender plugin folder name.

This was able to get me back into our system.

Here is more context to the situation:
– There are two environments that we have setup.
1. example.com (productuion environment)
2. test.example.com (subdomain we use for staging environment)

– Each environment has same user information
– We setup Defender (free) in production (example.com) first, and enabled 2FA, scanned QR code.
– We then enabled Defender (free) in staging (test.example.com) with same setup.
– When scanning QR codes, it actually didn’t create two separate Defender accounts in Google Authenticator app. It used 1 account for both production (example.com) and staging environment (environment)

Troubleshooting 2FA before checking time discrepancies:
1. Used workaround to get back into production (example.com) and re-enable Defender
2. Removed/disabled 2FA for all users.
3. Logged into staging (test.example.com) and removed/disabled 2FA on all accounts.
4. Removed Defender account on Google Authenticator
5. Logged into production (example.com) and enabled 2FA by scanning QR code and checking that “Lost this device” option is on for my account.
6. Tested 2FA in production- 2FA works!
7. Logged into staging (test.example.com) and went through process of enabling 2FA.
8. Tested 2FA in staging- 2FA works!
9. Tested 2FA in production again – 2FA ERROR

Could it be that maybe scanning the QR code “replaced” the account with a new account in Google Authenticator?

Troubleshooting time discrepancies
1. Used https://check-host.net/ to view server timezone and descrepencies
2. Server Local Time: PDT
3. WP Local Time: UCT-0
4. Changed WP Local Time to PDT
5. No time discrepancies notes.
6. Issue still persists with 2FA using same steps 1-9 in previous troubleshooting.

Troubleshooting email
1. Checked inbox manually, “Lost phone” email were not moved to spam folders or target inboxes.
2. Our registered emails are tied to G Suite for business. Checked the email logs and tried looking to see if Google blocked “Lost phone” email. I searched for
– default subject: Your OTP code
– the recipient: my WP registered email
– time frame: within 7 days
3. Google email logs reported “No messages found. Please contact the sender for further investigation”

This leaves me to think that WP is having issues sending out emails.

4. Jacobo mentioned that I should try this plugin: https://ww.wp.xz.cn/plugins/wp-mail-smtp/
5. Used this plugin to run a test, and emails are not coming through to me. I repeated steps 1-3.
6. Plugin confirmed that default mailer uses standard PHP mail()

I hope this info helps!! Thanks, Adam!
– Nikki

I also wanted to add that we have Lost Device OTP setting enabled. And when our users click on the “Lost your device?” link, it says that email is sent, but it is not coming through.

I checked to see if our company email settings are blocking any incoming emails, but there is no log that an email was even sent to us.

I really need this resolved today. We can’t get into our website at all.