Samuel Wood (Otto)

Also, generally speaking, that message means you enabled two factor, only set up some backup codes, and then logged out of the account. If you used all the backup codes, then you’re basically done. Once you use all the backup codes. That’s it. You can’t get back in the account. You’re locked out permanently. That’s the whole idea of it.

Backup codes are only intended as a backup mechanism. You log in using them one time only, when you do something like lose your phone, and then you can fix your 2FA to be correctly set up with a new phone or something.

Now, they can probably reset the codes for you and let you log in again, but they really shouldn’t. The entire point of using two factor is security, and simply resetting it that easily is kind of anti-security. And you need to actually set up a two factor app properly so that you don’t have to use all your one-time-only codes. I would recommend the Google Authenticator app.

 I have a ban on automatic updates of all plugins.

If you simply have automatic updates turned off in WordPress, then that is not actually the default setting.

The default setting in WordPress is to have WordPress following what the update system at ww.wp.xz.cn tells it to do, which is to install security updates automatically. This behavior only applies to security-only updates.

If you disable auto updates in some other way, by like setting the relevant defines in wp-config or anything like that, then your setting would be respected by WordPress and it will not auto update regardless.

However, note that some hosting systems, when warned about security updates, will update your plugins for you. Depending on the hosting system, this can bypass everything WordPress does and you can still receive an auto-update regardless.

This post and the review for the plugin you left are the literally the only things you have done on this site at all. You can use the data erasurer tool, if you like. However, there isn’t much point because you only created the account 24 hours ago.

We don’t track your data from other websites or anything else you do. We’re not that interested in you.

What instructions are you talking about?

Depending on your viewpoint, the various widgets can be dragged and dropped. Simply select the thing and drag it to the place you want it on the screen.

Usernames cannot be changed on ww.wp.xz.cn.

This conversation has gotten beyond the realm of helping the original poster, so let’s end it here.

Darius, if you want to contact me directly. I am otto at ww.wp.xz.cn. you can contact me about this topic. I am involved in both the plugins and the security teams.