{"id":3515,"date":"2024-11-25T00:00:00","date_gmt":"2024-11-25T00:00:00","guid":{"rendered":"https:\/\/attributesuseraccess.com\/?post_type=docs&p=1019"},"modified":"2024-11-25T00:00:00","modified_gmt":"2024-11-25T00:00:00","slug":"two-factor-authentication-overview","status":"publish","type":"docs","link":"https:\/\/attributeswp.com\/docs\/two-factor-authentication-overview\/","title":{"rendered":"Two-Factor Authentication Overview (Pro)"},"content":{"rendered":"
\n
Version: 1.2.1 Pro<\/span>\nLast Updated: November 2025<\/span>\nDifficulty: Intermediate<\/span>\nTime Required: 20 minutes<\/span><\/div>\n\n
\n\n

Overview<\/h2>\n\n

Two-Factor Authentication (2FA) adds an extra layer of security by requiring users to verify their identity with a second factor after entering their password. This Pro feature protects against stolen passwords and unauthorized access.\n<\/p>\n\n

What is Two-Factor Authentication?<\/h2>\n\n

The Two Factors<\/h3>\n\nFactor 1: Something You Know<\/strong>\n\n
\nYour password or passphrase\n<\/code><\/pre>\n\nFactor 2: Something You Have<\/strong>\n\n
Access to your email (verification code)\n<\/p>\n\n
How It Works:<\/strong>
\n
Even if someone steals your password, they cannot access your account without also having access to your email to receive the verification code.\n<\/p>\n<\/div>\n\n
Benefits of 2FA<\/h2>\n\n
Enhanced Security<\/h3>\n\n
\u2713 Protects Against Stolen Passwords<\/strong>
\n
Compromised passwords alone cannot grant access\u2014the attacker also needs your verification code.\n<\/p>\n<\/div>\n\n
\u2713 Prevents Unauthorized Access<\/strong>
\n
Even if someone knows your password, they cannot log in without the second factor.\n<\/p>\n<\/div>\n\n
\u2713 Blocks Automated Attacks<\/strong>
\n
Bots and automated brute force attacks are rendered useless against 2FA-protected accounts.\n<\/p>\n<\/div>\n\n
\u2713 Compliance Ready<\/strong>
\n
Meets security requirements for HIPAA, SOC 2, PCI-DSS, and other compliance standards.\n<\/p>\n<\/div>\n\n
\u2713 Peace of Mind<\/strong>
\n
Users feel more secure knowing their accounts have an extra layer of protection.\n<\/p>\n<\/div>\n\n
Available 2FA Methods<\/h2>\n\n
Email-Based Verification (Available Now)<\/h3>\n\nHow it works:<\/strong>\n
    \n
  • User enters username and password<\/li><\/ul>\n\n
      \n
    • System sends 6-digit code to user’s email<\/li><\/ul>\n\n
        \n
      • User retrieves code from email<\/li><\/ul>\n\n
          \n
        • User enters code on verification screen<\/li><\/ul>\n\n
            \n
          • Access granted upon successful verification<\/li><\/ul>\n\nSpecifications:<\/strong>\n\n
            Code Length: 6 digits\n<\/p>\n
            Code Expiration: 10 minutes\n<\/p>\n
            Delivery Method: Email\n<\/p>\n\nBest for:<\/strong>\n
              \n
            • General websites<\/li><\/ul>\n\n
                \n
              • Business applications<\/li><\/ul>\n\n
                  \n
                • Membership sites<\/li><\/ul>\n\n
                    \n
                  • E-commerce platforms<\/li><\/ul>\n\n
                    Future Methods (Coming Soon)<\/h3>\n\nTOTP Authenticator Apps<\/strong> (Planned v1.1)\n\n
                    Google Authenticator\n<\/p>\n
                    Microsoft Authenticator\n<\/p>\n
                    Authy\n<\/p>\n\nSMS Verification<\/strong> (Planned v1.2)\n\n
                    Requires Twilio or similar service\n<\/p>\n
                    Text message delivery\n<\/p>\n
                    International support\n<\/p>\n\n
                    Who Should Use 2FA?<\/h2>\n\n
                    Recommended User Roles<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n
                    User Role<\/th>\nRequire 2FA?<\/th>\nRationale<\/th>\n<\/tr>\n<\/thead>\n
                    Administrator<\/strong><\/td>\n\u2705 Yes<\/td>\nHighest security risk\u2014full site control<\/td>\n<\/tr>\n
                    Editor<\/strong><\/td>\n\u2705 Yes<\/td>\nAccess to all content and publishing<\/td>\n<\/tr>\n
                    Author<\/strong><\/td>\n\u26a0\ufe0f Optional<\/td>\nModerate risk\u2014can publish content<\/td>\n<\/tr>\n
                    Contributor<\/strong><\/td>\n\u26a0\ufe0f Optional<\/td>\nLimited access\u2014cannot publish<\/td>\n<\/tr>\n
                    Subscriber<\/strong><\/td>\n\u274c No<\/td>\nRead-only access\u2014minimal risk<\/td>\n<\/tr>\n
                    Customer<\/strong><\/td>\n\u26a0\ufe0f Optional<\/td>\nConsider for financial data access<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n
                    Use Cases by Industry<\/h2>\n\n
                    Healthcare & Medical<\/h3>\n\nHIPAA Compliance:<\/strong>\n\n
                    \u2713 Protect patient data\n<\/p>\n
                    \u2713 Secure medical records\n<\/p>\n
                    \u2713 Meet compliance requirements\n<\/p>\n
                    \u2713 Required for: All staff with PHI access\n<\/p>\n\n
                    Financial Services<\/h3>\n\nPCI-DSS Compliance:<\/strong>\n\n
                    \u2713 Secure payment information\n<\/p>\n
                    \u2713 Protect financial data\n<\/p>\n
                    \u2713 Prevent fraud\n<\/p>\n
                    \u2713 Required for: All staff with payment access\n<\/p>\n\n
                    E-Commerce<\/h3>\n\nCustomer Protection:<\/strong>\n\n
                    \u2713 Secure customer accounts\n<\/p>\n
                    \u2713 Protect order history\n<\/p>\n
                    \u2713 Prevent fraudulent purchases\n<\/p>\n
                    \u2713 Recommended for: High-value customer accounts\n<\/p>\n\n
                    Corporate Intranet<\/h3>\n\nBusiness Security:<\/strong>\n\n
                    \u2713 Protect company data\n<\/p>\n
                    \u2713 Secure employee information\n<\/p>\n
                    \u2713 Prevent unauthorized access\n<\/p>\n
                    \u2713 Required for: All employees\n<\/p>\n\n
                    Educational Platforms<\/h3>\n\nStudent Data Protection:<\/strong>\n\n
                    \u2713 Protect student records\n<\/p>\n
                    \u2713 Secure grades and assignments\n<\/p>\n
                    \u2713 Meet FERPA requirements\n<\/p>\n
                    \u2713 Required for: Faculty and staff\n<\/p>\n\n
                    User Experience Flow<\/h2>\n\n
                    Login Process Without 2FA<\/h3>\n\nTraditional Login (3 steps):<\/strong>\n\n
                      \n
                    • Enter username<\/li><\/ul>\n\n
                        \n
                      • Enter password<\/li><\/ul>\n\n
                          \n
                        • Click “Log In” \u2192 Access granted<\/li><\/ul>\n\n
                          Login Process With 2FA<\/h3>\n\nEnhanced Login (5 steps):<\/strong>\n\n
                            \n
                          • Enter username<\/li><\/ul>\n\n
                              \n
                            • Enter password<\/li><\/ul>\n\n
                                \n
                              • Receive email with verification code<\/li><\/ul>\n\n
                                  \n
                                • Enter 6-digit code<\/li><\/ul>\n\n
                                    \n
                                  • Click “Verify” \u2192 Access granted<\/li><\/ul>\n\n
                                    Time Impact:<\/strong>
                                    \n
                                    Adds approximately 30-60 seconds to login time (time to check email and enter code).\n<\/p>\n<\/div>\n\n
                                    What Users See<\/h2>\n\n
                                    Step 1: Normal Login Screen<\/h3>\n\n
                                    Email or Username: john@example.com\n<\/p>\n
                                    Password: \u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\n<\/p>\n
                                    \u2610 Remember Me\n<\/p>\n\n
                                    [Log In Button]\n<\/p>\n\n
                                    Step 2: Verification Code Screen<\/h3>\n\n
                                    \u2709\ufe0f Email Verification Required\n<\/p>\n\n
                                    We’ve sent a 6-digit verification code to:\n<\/p>\n
                                    john@example.com\n<\/p>\n\n
                                    This code will expire in 10 minutes.\n<\/p>\n\n
                                    Enter Verification Code:\n<\/p>\n
                                    [___] [___] [___] [___] [___] [___]\n<\/p>\n\n
                                    [Verify Button]\n<\/p>\n\n
                                    Didn’t receive it? [Resend Code]\n<\/p>\n\n
                                    Step 3: Success Message<\/h3>\n\n
                                    \u2713 Verification Successful\n<\/p>\n
                                    Redirecting to your dashboard…\n<\/p>\n\n
                                    Configuration Options<\/h2>\n\n
                                    Global Settings<\/h3>\n\nEnable\/Disable 2FA:<\/strong>\n\n
                                    Settings \u2192 Attributes User Access \u2192 Security\n<\/p>\n
                                    Toggle: “Enable Two-Factor Authentication”\n<\/p>\n\n
                                    Role-Based Requirements<\/h3>\n\nSelect which roles require 2FA:<\/strong>\n\n
                                    \u2611 Require for Administrators\n<\/p>\n
                                    \u2611 Require for Editors\n<\/p>\n
                                    \u2610 Require for Authors\n<\/p>\n
                                    \u2610 Require for Contributors\n<\/p>\n
                                    \u2610 Require for Subscribers\n<\/p>\n
                                    \u2610 Require for Customers\n<\/p>\n\n
                                    Excluded Roles<\/h3>\n\nExempt specific roles from 2FA:<\/strong>\n\n
                                    \u2610 Support Staff\n<\/p>\n
                                    \u2610 Service Accounts\n<\/p>\n
                                    \u2610 Emergency Access\n<\/p>\n\n
                                    Security Note:<\/strong>
                                    \n
                                    Only exclude roles when absolutely necessary. Each exclusion reduces overall security.\n<\/p>\n<\/div>\n\n
                                    Code Settings<\/h3>\n\nVerification Code Configuration:<\/strong>\n\n
                                    Code Length: 6 digits (fixed)\n<\/p>\n
                                    Expiration Time: 10 minutes (fixed)\n<\/p>\n
                                    Delivery Method: Email\n<\/p>\n
                                    Resend Cooldown: 1 minute\n<\/p>\n\n
                                    Security Considerations<\/h2>\n\n
                                    Strengths<\/h3>\n\n
                                      \n
                                        \n
                                      • Password breach protection:<\/strong> Stolen passwords are useless without code<\/li><\/ul>\n\n
                                          \n
                                        • Phishing resistance:<\/strong> Codes expire quickly, limiting phishing effectiveness<\/li><\/ul>\n\n
                                            \n
                                          • Brute force immunity:<\/strong> Cannot guess codes\u2014too many combinations<\/li><\/ul>\n\n
                                              \n
                                            • Audit trail:<\/strong> All 2FA attempts logged for review<\/li><\/ul>\n\n<\/ul>\n\n
                                              Limitations<\/h3>\n\n
                                              Email Dependency:<\/strong>
                                              \n
                                              Users must have access to their email to log in. Lost email access = locked account (see recovery procedures).\n<\/p>\n<\/div>\n\n
                                              Delivery Time:<\/strong>
                                              \n
                                              Email delivery can take 1-5 minutes depending on mail server. Users must be patient.\n<\/p>\n<\/div>\n\n
                                              Spam Filters:<\/strong>
                                              \n
                                              Verification emails may be caught by spam filters. Users should check junk folders.\n<\/p>\n<\/div>\n\n
                                              Email Requirements<\/h2>\n\n
                                              Email Server Configuration<\/h3>\n\nRequirements for 2FA emails:<\/strong>\n\n
                                                \n
                                                  \n
                                                • Working SMTP:<\/strong> Reliable email delivery configured<\/li><\/ul>\n\n
                                                    \n
                                                  • SPF\/DKIM records:<\/strong> Proper authentication to avoid spam<\/li><\/ul>\n\n
                                                      \n
                                                    • Fast delivery:<\/strong> Emails arrive within 1-2 minutes<\/li><\/ul>\n\n
                                                        \n
                                                      • Whitelist domain:<\/strong> Ensure emails not blocked by spam filters<\/li><\/ul>\n\n<\/ul>\n\n
                                                        Testing Email Delivery<\/h3>\n\nBefore enabling 2FA:<\/strong>\n\n
                                                          \n
                                                        • Go to Settings \u2192 Attributes User Access \u2192 Email<\/code><\/li><\/ul>\n\n
                                                            \n
                                                          • Click “Send Test Email”<\/li><\/ul>\n\n
                                                              \n
                                                            • Check inbox for test email<\/li><\/ul>\n\n
                                                                \n
                                                              • Verify email arrives within 2 minutes<\/li><\/ul>\n\n
                                                                  \n
                                                                • Check spam\/junk folder if not in inbox<\/li><\/ul>\n\n
                                                                  Important:<\/strong> Do not enable 2FA site-wide until you’ve confirmed reliable email delivery!\n<\/div>\n\n
                                                                  Rollout Strategy<\/h2>\n\n
                                                                  Phased Deployment (Recommended)<\/h3>\n\nPhase 1: Administrators Only<\/strong>\n\n
                                                                  Week 1: Enable 2FA for admin accounts\n<\/p>\n
                                                                  Test thoroughly, resolve any email issues\n<\/p>\n\nPhase 2: Editors and Staff<\/strong>\n\n
                                                                  Week 2-3: Add editors and key staff\n<\/p>\n
                                                                  Monitor for issues, provide support\n<\/p>\n\nPhase 3: All Users<\/strong>\n\n
                                                                  Week 4+: Enable for all applicable roles\n<\/p>\n
                                                                  Communicate changes to users in advance\n<\/p>\n\n
                                                                  Communication Plan<\/h3>\n\nBefore Enabling 2FA:<\/strong>\n\n1. Email Announcement (1 week before):<\/strong>\n\n
                                                                  Subject: Important: Two-Factor Authentication Coming Soon\n<\/p>\n\n
                                                                  Dear [User],\n<\/p>\n\n
                                                                  Starting [Date], we’re implementing Two-Factor Authentication \n<\/p>\n
                                                                  for enhanced security. This will require you to enter a code \n<\/p>\n
                                                                  from your email when logging in.\n<\/p>\n\n
                                                                  What to expect:\n<\/p>\n
                                                                    \n
                                                                  • Extra verification step at login<\/li><\/ul>\n\n
                                                                      \n
                                                                    • Code sent to your registered email<\/li><\/ul>\n\n
                                                                        \n
                                                                      • Adds 30-60 seconds to login time<\/li><\/ul>\n\n
                                                                        Benefits:\n<\/p>\n
                                                                          \n
                                                                        • Enhanced account security<\/li><\/ul>\n\n
                                                                            \n
                                                                          • Protection against password theft<\/li><\/ul>\n\n
                                                                              \n
                                                                            • Compliance with security standards<\/li><\/ul>\n\n
                                                                              Questions? Contact support@example.com\n<\/p>\n\n2. Login Page Notice:<\/strong>\n\n
                                                                              “Two-Factor Authentication will be required starting [Date]. \n<\/p>\n
                                                                              Ensure your email address is up to date in your profile.”\n<\/p>\n\n3. Support Resources:<\/strong>\n\n
                                                                              Create FAQ page\n<\/p>\n
                                                                              Prepare support staff\n<\/p>\n
                                                                              Document common issues\n<\/p>\n\n
                                                                              Best Practices<\/h2>\n\n
                                                                              Test Thoroughly First<\/strong>
                                                                              \n
                                                                              Enable 2FA on test accounts before deploying to all users. Verify email delivery works reliably.\n<\/p>\n<\/div>\n\n
                                                                              Start Small<\/strong>
                                                                              \n
                                                                              Begin with administrators only, then gradually expand to other roles as you build confidence.\n<\/p>\n<\/div>\n\n
                                                                              Communicate Early<\/strong>
                                                                              \n
                                                                              Notify users at least one week in advance. Explain what’s changing and why it benefits them.\n<\/p>\n<\/div>\n\n
                                                                              Provide Support<\/strong>
                                                                              \n
                                                                              Have support staff ready to help users during initial rollout. Most issues are email-related.\n<\/p>\n<\/div>\n\n
                                                                              Monitor Logs<\/strong>
                                                                              \n
                                                                              Check audit logs for failed 2FA attempts. High failure rates indicate user confusion or email issues.\n<\/p>\n<\/div>\n\n
                                                                              Performance Impact<\/h2>\n\n
                                                                              Server Resources<\/h3>\n\nMinimal Impact:<\/strong>\n\n
                                                                              Email generation: Negligible CPU\n<\/p>\n
                                                                              Database queries: +1 per login\n<\/p>\n
                                                                              Email sending: Handled by mail server\n<\/p>\n
                                                                              Storage: +1 record per verification code\n<\/p>\n\nNo significant performance degradation expected.<\/strong>\n\n
                                                                              User Experience<\/h3>\n\nTime Addition:<\/strong>\n\n
                                                                              Email check time: 10-60 seconds\n<\/p>\n
                                                                              Code entry time: 5-10 seconds\n<\/p>\n
                                                                              Total added time: 15-70 seconds per login\n<\/p>\n\nTrade-off:<\/strong>\n
                                                                              Slight inconvenience for significant security improvement.\n<\/p>\n\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"
                                                                              Complete guide to Two-Factor Authentication in Attributes User Access Pro.<\/p>","protected":false},"featured_media":0,"parent":0,"template":"","meta":{"_acf_changed":false,"_surecart_dashboard_logo_width":"180px","_surecart_dashboard_show_logo":true,"_surecart_dashboard_navigation_orders":true,"_surecart_dashboard_navigation_invoices":true,"_surecart_dashboard_navigation_subscriptions":true,"_surecart_dashboard_navigation_downloads":true,"_surecart_dashboard_navigation_billing":true,"_surecart_dashboard_navigation_account":true,"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"footnotes":""},"chapter":[373],"class_list":["post-3515","docs","type-docs","status-publish","hentry","chapter-pro-features"],"acf":{"reading_time":"","difficulty":"beginner","plugin_version":"1.2.2","last_updated":null},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/attributeswp.com\/wp-json\/wp\/v2\/docs\/3515","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/attributeswp.com\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/attributeswp.com\/wp-json\/wp\/v2\/types\/docs"}],"version-history":[{"count":0,"href":"https:\/\/attributeswp.com\/wp-json\/wp\/v2\/docs\/3515\/revisions"}],"wp:attachment":[{"href":"https:\/\/attributeswp.com\/wp-json\/wp\/v2\/media?parent=3515"}],"wp:term":[{"taxonomy":"chapter","embeddable":true,"href":"https:\/\/attributeswp.com\/wp-json\/wp\/v2\/chapter?post=3515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}