WordPress Invitation Code - Use Case - How To Require 2FA Verification When Using Invitation Codes
Use Case - How To Require 2FA Verification When Using Invitation Codes
Note: This guide requires:
- WordPress Invitation Code plugin - This document uses version 1.7.2.
Introduction
This WordPress Invitation Code plugin allows you to create and sell a series of personalized temporary access codes. Each code grants limited access to a selected page only. When creating codes, you assign them to a post, a page, a URL or a file. It will automatically be locked and, when accessing it, visitors will be prompted to input the code.
Use Case Front-End
Entering the invitation code and email address, and requesting one-time password for passing 2FA verification:
![Accessing the content with invitation code and 2FA verification - Invitation Code Registration for WordPress](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/6696830a5908935e848188d8/file-50jcvXWcUi.gif)
Example of the email notification with one-time password:
![Receiving OTP by email - WordPress Content Restriction](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669684fedd0f8c60bb3fe7e9/file-ANwe4DpRDc.png)
Entering one-time password and accessing the content:
![Passing 2FA verification - Private Content WordPress Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66968324dd0f8c60bb3fe7e6/file-onvbw0Y6nl.gif)
Use Case Assumptions
In this example use case guide we will consider how to increase the security of restricted content by requiring 2FA verification when using invitation codes.
We consider that you have already bought the WordPress Invitation Code plugin, but not installed it yet.
It follows:
- Installing the plugin
- General plugin settings
- Using 2FA verification
- Disabling 2FA for specific codes
- End result
Installing the Plugin
The process is the same for all CM plugins and add-ons.
![CreativeMinds Customer Account Dashboard - Downloads tab](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/5ea2abc604286364bc98ef13/file-FEHseeA7Qu.png)
- Download the plugin from your customer dashboard.
- Log in to WordPress and navigate to the WordPress Admin → Plugins settings.
- Click on Add New.
- Activate it and add the license.
Learn more: Getting Started - Plugin Overview
General Plugin Settings
First of all, let's go to the general plugin settings and configure the relevant settings. Navigate to Admin Dashboard → Invitation Code Content Access → Settings → General tab.
![Navigation to the plugin settings - Restrict Content Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/6696295ddd0f8c60bb3fe77d/file-z6bO1BqYUI.png)
Scroll down and find the section Email validation and 2FA verification. It has the following settings:
![Email validation and 2FA verification settings - WordPress Register with Invitation Code](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/6695461cdb62267f9903e089/file-qLzL9vAuZN.png)
- Email required while code entered - Enable this option to require the email address when using the invitation code. The user will not be able to access the content without providing his email address. If only this option is enabled without enabling further options, then you will be able to track emails of users who used the invitation code.
Example
This is how the form with the field for email looks like in front-end:
![Requiring to enter an email with the invitation code - Portal WordPress Plugin Private Content Per User](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/602a7a3e8502d1120e907786/file-6M3bsxw0H5.png)
On the back-end when viewing and editing the invitation code you can see the list of emails, who used that code:
![The list of provided emails - Members Plugin Restrict Content](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669661b5dd0f8c60bb3fe7b9/file-TiU4zF34Z0.png)
- Validate email with code - If enabled, when entering the code the user must use the email which is assigned to the invitation code, otherwise he can't access the content. Requires the option Email required while code entered to be enabled.
Example
When creating an invitation code, the admin should specify the email address that the code should be assigned to. It can be done using the option Notification email. When the code is created, the user will be notified by the email about his invitation code.
![Assigning an email address to the invitation code - Invitation Code Registration for WordPress](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66966400dd0f8c60bb3fe7bf/file-p0fnWeX6tC.png)
This code should be used only with specified email. Using any other email will not allow to access the content even though the invitation code is correct:
![Attempt to use any other email for accessing the locked content - WordPress Content Restriction](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669664a25940934e140f615e/file-Pvp0guJxi3.png)
- Enable Email 2FA - If enabled, when entering the invitation code, the user must enter his email. There will be sent a temporary one-time code which the user should also enter to the access box. Works only when options Validate email with code and Email required while code entered are enabled.
- E-mail Code Expiration (in minutes) - Define the expiration time of the one-time email code.
- E-mail Subject - The subject of the email that notifies users about one-time codes.
- E-mail Content - The content of the email that notifies users about one-time codes. You can use the following placeholders:
[code]
- code that the user has to enter to approve the access. The email template MUST contain this shortcode.[expiration]
- shows in how many minutes the code expires.
Don't forget to click the button Save Changes after configuring the settings:
![Saving the changes - Private Content WordPress Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66962af25940934e140f612a/file-EGJ2nLfI1w.png)
TIP
Learn more about other plugin settings in this user guide:
Using 2FA Verification
Let's create a code, where we specify only code title, the code itself, define the restricted content and assign the code to a specific email:
![Creating an invitation code with assigned email address - Restrict Content Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669671a05940934e140f6171/file-6QJEEhE696.png)
An email notification with the invitation code will be sent to the email address owner:
![Sending email notification with the invitation code to the user - WordPress Register with Invitation Code](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669682fd5940934e140f618e/file-9sdGd9grTf.png)
Now let's access the content using the relevant email address - the user enters the invitation code, his email, and there appears a button Send Authentication Code which the user has to click:
![Accessing the content with 2FA verification - Portal WordPress Plugin Private Content Per User](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/6696830a5908935e848188d8/file-50jcvXWcUi.gif)
The code is sent, and there appears a field 2FA Code for entering a one-time password, and there are 2 buttons: Resend Code (which allows to get the code again, for example, if the previous one was expired) and Apply Code (which allows to use the received one-time password).
![2FA verification options - Members Plugin Restrict Content](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669679cadd0f8c60bb3fe7d9/file-H7KWd00SVL.png)
The user receives a one-time password and the email says when this code will expire:
![Sending OTP to the user - Invitation Code Registration for WordPress](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669684fedd0f8c60bb3fe7e9/file-ANwe4DpRDc.png)
After the user enters this code and clicks Apply Code, he accesses the content:
![Passing 2FA verification - WordPress Content Restriction](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66968324dd0f8c60bb3fe7e6/file-onvbw0Y6nl.gif)
Now let's try to access the content using some another email, which is not assigned to the invitation code - when entering the wrong email, the plugin will inform about that. And attempt to request a one-time password will also inform that the user needs to enter the correct email address:
![Attempt to access the content with wrong email - Private Content WordPress Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66968497db62267f9903e1e5/file-5yT4Oi9afA.gif)
What If I Don't Assign an Email to Code?
In case, if you don't assign any email to the invitation code while creating it, any user can use this code. He will be required to enter his email address with the invitation code, but there will not be used a 2FA feature. Rigth after using the code, his email will be recorder to the field Notification email, so his email will be assigned to the code.
![Notification email field - Restrict Content Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669686175940934e140f6191/file-x7arbKja6Q.png)
Next time when using the code, this code can be used only with this email and only with 2FA verification.
Disabling 2FA for Specific Codes
When you enable the 2FA feature in the general plugin settings, by default these settings are applied to all invitation codes. But it is also possible to disable the 2FA feature for specific invitation codes.
It can be done when editing the needed invitation code. To do this, navigate to Admin Dashboard → Invitation Code Content Access → Invitation codes. Hover on the needed code and click Edit.
![Editing the invitation code - WordPress Register with Invitation Code](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66968a7cdb62267f9903e1f7/file-QSxW6CVtRt.png)
Scroll down and find the section Email validation and 2FA verification. It has 2 options:
![Overriding Email validation and 2FA verification settings - Portal WordPress Plugin Private Content Per User](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669792f7e1989867dceff714/file-Pf73AZEXAX.png)
- Exclude validation email - Enable this option if you want to disable email validation. It means that the user can use any email, not the one that is assigned to the code. But if next option is disabled, the user still will have to go through the 2FA verification process. So, in result it helps to confirm that the user uses his real email address and not just a random one.
- Exclude 2FA email verification - This option can be enabled only if the previous one is enabled. If this option is enabled, the user will still have to enter the email address, but will not have to go through the process of 2FA verification process.
Let's check how both options work on the front-end.
1) First case - only the option Exclude validation email is enabled:
![Disabling email validation - Members Plugin Restrict Content](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66979a1a5940934e140f62dc/file-WExhNl2FUk.png)
As a result, the user enters the invitation code, his email, and then he needs to enter one-time password that he receives on his email:
![Front-end result - WordPress Invitation Code](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/6697a679dd0f8c60bb3fe950/file-zHDw3VAnIy.gif)
2) Second case - both options are enabled - Exclude validation email and Exclude 2FA email verification:
![Disabling 2FA verification - Invitation Code Registration for WordPress](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66979aa25940934e140f62de/file-Kmo1Q0b2ha.png)
As a result, the user enters the invitation code and any email, without need to go through the 2FA verification process:
![Front-end result - WordPress Content Restriction](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/6697a67e5940934e140f62f5/file-iE57WKKJej.gif)
End Result
Following instructions found in the plugin and guides, you should be able to increase the security of restricted content by requiring 2FA verification when using invitation codes.
Use Case Front-End
Entering the invitation code and email address, and requesting one-time password for passing 2FA verification:
![Accessing the content with invitation code and 2FA verification - Private Content WordPress Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/6696830a5908935e848188d8/file-50jcvXWcUi.gif)
Example of the email notification with one-time password:
![Receiving OTP by email - Restrict Content Plugin](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/669684fedd0f8c60bb3fe7e9/file-ANwe4DpRDc.png)
Entering one-time password and accessing the content:
![Passing 2FA verification - WordPress Register with Invitation Code](http://d33v4339jhl8k0.cloudfront.net/docs/assets/558f9e89e4b01a224b42f278/images/66968324dd0f8c60bb3fe7e6/file-onvbw0Y6nl.gif)
![]() |
More information about the WordPress Invitation Code Plugin Other WordPress products can be found at CreativeMinds WordPress Store |
![]() |
Let us know how we can Improve this Product Documentation Page To open a Support Ticket visit our support center |