WordPress Two Factor Authentication (CMAUTH) - Use Case - How to Create 2FA Login to Your Site With Google Authenticator


Use Case - How to create 2FA login to your site with Google Authenticator

Back to User Guides

Note: This guide requires:


Video Use-Case

Introduction

WordPress Two Factor Authentication rebuilds the account security for your WordPress users by offering integration with four widely accredited two-factor authentication (2FA) methods: Google Authenticator, Mobile Phone SMS, Email verification and Email code. By not relying on the password alone, users feel confident that their credentials and data are stored safely. 

Use Case Front-End

Front-end example - WordPress Two Step Authentication
Front-end example

Use Case Assumptions

In this example use case guide we will consider how to create 2FA login to your site with Google Authenticator.

Google Authenticator is an application for smartphones that works with third party software. Users must insert a code that is dynamically generated in the application to access their account. The application is available for Android devices and iOS devices

During the first use, it's necessary to link the app and account either through a QR Code or a secret key. Google provides a step-by-step guide about this. 

It follows:

Installing the Plugin

The process is the same for all CM plugins and add-ons.

CreativeMinds Customer Account Dashboard - Downloads tab
CreativeMinds Customer Account Dashboard
  • Download the plugin from your customer dashboard.
  • Log in to WordPress and navigate to the WordPress Admin → Plugins settings.
  • Click on Add New.
  • Activate it and add the license.

Learn more: Getting Started - Plugin Overview


General Settings

Enabling Google Authenticator protection on your site is quite simple. To configure all base options you need to navigate to Admin Dashboard → CM Secure Login Pro → Settings → General tab.

Navigation to the general plugin settings - WordPress Enable 2FA
Navigation to the general plugin settings

There you can find a few sections with the options. Let's consider the ones that are important for configuring Google Authenticator protection. 

Login

Disable passwords

You can disable the password for every user or only for those with certain roles. Note that disabling the password does not mean the users will only need their username to sign in. Instead, they will login with their usernames and the chosen authentication method.

  • Disable passwords for all users - Choose Yes to disable passwords for all users. 
  • Disable passwords for chosen roles - Choose here roles that won't need to use password for login. Works if previous option is disabled (chosen No).
Disabling passwords - WP 2FA Plugin
Disabling passwords

Common

Here you can configure additional security options.

  • Sleep time when the entered code is incorrect [seconds] - Set a delay time to send to the browser if a user enters an invalid code from Google Authenticator or e-mail. This can slow down malicious bots which try to login using the brute-force method.

    Specifying sleep time when the entered code is incorrect - WordPress Login SMS Verification
    Specifying sleep time when the entered code is incorrect
  • Logout after activity/inactivity time [minutes] - Users will be logged out after this period of activity/inactivity (in minutes). Set to 0 to disable.

    Specifying logout time - 2 Factor Authentication for WordPress
    Specifying logout time
  • Logout mode - Here you can choose in which cases to logout the users: after some period of inactivity, or in both cases - activity and inactivity. Works if previous option is enabled.

    Choosing logout mode - WordPress Two Step Authentication
    Choosing logout mode

Google Authenticator

Next important tab is Google Authenticator.

In this tab, you can edit the template for two kinds of email: 

  • Created secret email template - Email for when the Google Authenticator is first set to the account.

    Created secret email template - WordPress Enable 2FA
    Created secret email template
  • Remind secret email template - Email for when users have misplaced their secret key. 

    Remind secret email template - How to Enable 2FA On WordPress
    Remind secret email template

You can use the following shortcodes to add dynamic content to subject and body of these emails:

  • Subject shortcodes:
    • [blogname] 
    • [siteurl] 
    • [userdisplayname] 
    • [userlogin] 
    • [useremail]
  • Body shortcodes:
    • [link] - link to the QR Code with secret. Note: this shortcode must be in the email.
    • [blogname] 
    • [siteurl] 
    • [userdisplayname] 
    • [userlogin] 
    • [useremail]

Result

Base configuration is done, so don't forget to click the button Save at the bottom of the page, and let's check how it works on the front-end.

When the user tries to login for the first time after 2FA is enabled, he needs to login as usual - by entering his username/email and password.

Login form - WordPress 2FA
Login form

He will be notified that GA secret was sent to his email.

Creating GA secret - WordPress Two Factor Authentication Plugin
Creating GA secret

In the email the user needs to click the provided link and then scan QR code using GA app on his phone.

Notifying the user about using GA - WP 2FA Plugin
Notifying the user about using GA

And then login using his username/email, password and one-time password from GA app.

Entering GA code - WordPress Login SMS Verification
Entering GA code

Individual User Settings

WordPress Two Factor Authentication allows you to apply the chosen secure method not only to all users or specific roles, but also allows you to change settings specifically to each user.

To do this, navigate to Admin Dashboard → Users → All Users.

Navigation to the list of all users - 2 Factor Authentication for WordPress
Navigation to the list of all users

Hover on the needed user and click Edit.

Editing the user - WordPress Two Step Authentication
Editing the user

You will see the following panel in the user's page:

Enabling or disabling 2FA protection for a specific user - WordPress Enable 2FA
Enabling or disabling 2FA protection for a specific user

On the screenshot above you can see an example of the panel for the user that belongs to the user role with enabled 2FA protection. It works the same for the user roles with disabled 2FA protection.

The options are:

  • Disable/enable protection - Either turns the 2FA on or off for this user.
  • Reset secret / Show secret / Send secret by email - Valid for Google Authenticator only.
  • Clear admin decision - Resets any individual changes in favor of global settings.

IPs and Devices Restrictions

There are a few more features for additional security of the accounts.

To configure them get back to  Admin Dashboard → CM Secure Login Pro → Settings.

IP

First tab we need - IP

You can choose how many IP addresses are allowed for each user role.

The options are: 

  • Restrict user IPs - Enables the feature.
    • User roles affected by IPs restriction - Mark which roles will be affected.
  • Maximum of IPs allowed to each user - Choose a number (1 or higher).
  • Accept only IPs chosen by the admin - Only allows logins from specific IPs defined by the admin per each user. This means that login attempts from other IPs will be blocked even if more IPs slots are available.
Specifying IP limits - How to Enable 2FA On WordPress
Specifying IP limits

In result, if someone tries to login to the account from new IP, and IPs limit is reached, or this IP is not allowed by the admin, there will be a following message:

IP protection - WordPress 2FA
IP protection

Learn more about IPs restrictions in this guide: WordPress Two Factor Authentication (CMAUTH) - How To - Restrict User Login By Number of IPs

Device

Another tab we need - Device.

You can restrict certain user roles from logging in from too many different devices.

  • Restrict user devices - Enables the feature.
    • Select user roles with devices restricting - Mark which roles will be affected.
  • Maximum number of devices allowed to user - Choose a number (1 or higher).
Specifying device limits - WordPress Two Factor Authentication Plugin
Specifying device limits

In result, if someone tries to login to the account from new device, and devices limit is reached, there will be a following message:

Device protection - WP 2FA Plugin
Device protection

Learn more about devices restrictions in this guide: WordPress Two Factor Authentication (CMAUTH) - How To - Restrict User Login By Number of Devices

Appearance

On the Appearance tab you can add and change instructions and modify the appearance of the login form with CSS.

Verification instruction - WordPress Login SMS Verification
Verification instruction
  • Enable login instructions - Enables this option.
Displaying login instructions - 2 Factor Authentication for WordPress
Displaying login instructions
  • Login instructions content - Enter the login instructions that will be displayed on the login form.
Editing login instructions content - WordPress Two Step Authentication
Editing login instructions content
  • Custom CSS - To further personalize your form, you can insert custom CSS. It will affect the following hooks: wp_head, admin_head, login_head.
Field for adding custom CSS - WordPress Enable 2FA
Field for adding custom CSS

Labels

On the Labels tab you can change the text of every label on the front-end. This feature is especially useful for localizing the form to different languages.

Google Authenticator labels:

GA labels - How to Enable 2FA On WordPress
GA labels

IPs and Devices restriction labels:

IPs and devices restrictions labels - WordPress 2FA
IPs and devices restrictions labels

End Result

Following instructions found in the plugin and guides, you should be able to create 2FA login to your site with Google Authenticator.

Use Case Front-End

Front-end example - WordPress Two Factor Authentication Plugin
Front-end example

More information about the WordPress Two Factor Authentication plugin

Other WordPress products can be found at CreativeMinds WordPress Store

Let us know how we can Improve this Product Documentation Page

To open a Support Ticket visit our support center
Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.