Brain 2FA

Users can open Brain 2FA > Login Security from the WordPress admin area and follow the setup instructions for the configured default method.

Any app that supports time-based one-time passwords (TOTP), including Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden.

TOTP users can use a recovery code. Site administrators can also manage setup grace periods from the user profile.

Yes. In Brain 2FA > Settings, select the roles that must use 2FA and set a grace period. Users in those roles get the configured number of days to complete setup. After that, or immediately with a grace period of 0, they can still sign in but are taken to the setup page and cannot use the rest of the site until 2FA is enabled.

Yes. The plugin supports the standard WooCommerce My Account login form. Customers can set up two-factor authentication from the link on their My Account dashboard.

Yes, with passkeys. Enable Passkeys under Brain 2FA > Settings, then each user adds a passkey on their Login Security page (after confirming their password). On the login form they can pick their passkey from the username field or use the Sign in with a passkey button. Because a passkey checks the user's fingerprint, face or device PIN, a passkey sign-in does not ask for a separate verification code.

Yes. Browsers only allow passkeys on secure (HTTPS) sites. On a site without HTTPS, the passkey options stay hidden.

Yes. After entering their password, users with a passkey can confirm with it instead of typing a code. A passkey also counts as two-factor authentication for roles that require it, so users can set up 2FA with a passkey alone.

Yes, if you allow it under Brain 2FA > Settings. Users with a passkey can then turn off password sign-in on their Login Security page, so their account can only be accessed with a passkey. If they lose all their passkeys, an administrator can turn password sign-in back on from the user's profile.

Unless they turned off password sign-in, they can still sign in with their password (and a two-factor code, if they have one) and remove the lost passkey on their Login Security page. Administrators can remove all of a user's passkeys from the user's profile, which also turns password sign-in back on.

Yes. Open Brain 2FA > Settings > Emails to edit the subject and text of the sign-in code email and of each security alert (for example "Two-factor authentication turned on" or "Passkey added"). Click a placeholder such as {user_first_name}, {site_name} or {login_security_url} to insert it; the preview shows the result with sample values. Use Send Test Email to see it in your inbox, and Reset to Default to undo your changes. Emails you have not edited keep following the plugin's translations. The sign-in code email cannot be turned off and must contain {code}, so users can always receive their code. The security alerts can be turned off one by one, but we recommend keeping them: they tell users when someone changes their sign-in settings. Emails are sent as plain text. Under Sender you can set the From name and address; leave them empty to use your site's normal mail settings.

Deactivating the plugin keeps all settings and every user's setup. Deleting it from the Plugins screen removes everything Brain 2FA stored: settings, email templates, authenticator secrets, recovery codes, trusted devices and passkeys. Users then need to set up two-factor authentication again if you reinstall it. To keep the data when deleting the plugin, add define( 'BRAIN2FA_KEEP_DATA_ON_UNINSTALL', true ); to wp-config.php.

No. Codes, QR codes and recovery codes are generated on your server, passkeys are verified on your server, and verification emails are sent through your site's normal WordPress mail setup.

Visit https://www.braintum.com/support/.