How to Turn On Two-Factor Authentication in BuddyNext

How to turn on two-factor authentication in BuddyNext, step by step. A member opens Settings, then Account, then Two-factor authentication, scans a QR code with an authenticator app, confirms with a 6-digit code and saves ten one-time backup codes. From then on, sign-in asks for a code after the password; a backup code or an emailed code also works. The site owner can require it for administrators, administrators and editors, or everyone under BuddyNext, then Members, then Registration & Login.

Transcript

In this tutorial you will turn on two-factor authentication in BuddyNext. After your password, sign-in also asks for a one-time code from your phone. You need BuddyNext, the free plugin, and an authenticator app on your phone. It takes about four minutes. There are six steps. Start the setup. Scan the code and confirm. Save your backup codes. Sign in with a code. Manage or turn it off. Then require it for a role. Step one. Start the setup. Sign in as a member, open Settings, then the Account tab, and find Two-factor authentication. Click Manage. A panel opens. You need an authenticator app, such as Google Authenticator, Authy or 1Password. Then click Set up two-factor authentication. Step two. Scan the code and confirm. A QR code appears. Scan it with your authenticator app. The code and the setup key are hidden in this tutorial. If you cannot scan it, type the setup key into the app by hand instead. The app now shows a six digit code that changes every thirty seconds. Type the current one here, and click Verify and turn on. Nothing is switched on until that code is accepted. Step three. Save your backup codes. Once the code is accepted, ten backup codes are shown. They are shown only this once, and they are hidden in this tutorial. Each code works one time, when you cannot reach your app. Keep them somewhere safe, away from your phone. Then click I have saved my codes. Step four. Sign in with a code. From now on, after your email and password, the login page asks for the six digit code from your app. If you lose your phone, type one of your backup codes in the same field. Or click Email me a code instead. A code is sent to your account email, and it works for ten minutes. After five wrong codes, sign-in starts again from your password. Step five. Manage or turn it off. Back in Settings, Account, the same panel now says two-factor authentication is on. To change it, type your password first. Regenerate backup codes makes a new set of ten, and the old set stops working at once. Turn off removes the second step. To move to a new phone, turn it off, then set it up again. Step six. Require it for a role. In your WordPress admin, open BuddyNext, then Members, then Registration and Login. Under Spam and Abuse Protection, find Require two-factor authentication. It starts on Nobody, so each member decides for themselves. You can require it for Administrators, for Administrators and editors, or for Everyone. Anyone in a required role is sent to Settings, Account, and cannot use the rest of the community until they set it up. That is all six. The setup started, the code scanned and confirmed, the backup codes saved, a sign-in with a code, the panel to manage it, and the rule to require it. Your account now needs your password and your phone, so a stolen password is not enough. Next in this series: Set up new-member onboarding.