Second factor

Overview

The second factor adds a 6-digit code from an authenticator app on your phone to the password confirmation. Even if someone gets your password, they cannot change the code of your site without your phone.

Each administrator turns on their own second factor. You choose when DooFiles asks for it, and you can require it for every administrator of your site.

You need an authenticator app on your phone. If you do not have one yet, start with Get an authenticator app.

Get an authenticator app

An authenticator app shows a new 6-digit code every 30 seconds, even without an internet connection. Most are free. Install one of these on your phone:

If you are not sure, choose Google Authenticator or Microsoft Authenticator. Any other app that shows 6-digit codes every 30 seconds also works.

Turn on your second factor

1. Go to DooFiles › Settings and open the Second factor card.
2. In Yours, click Turn on, and confirm your password.
3. On your phone, open the authenticator app and add a new account: tap + (or Add a code, Add account), then Scan a QR code, and point the camera at the QR code on your screen.

If you cannot scan it, choose Enter a setup key (or Enter key manually) in the app, and type the key that appears below the QR code. Use Copy to copy it.

1. The app now shows DooFiles, with your username and the address of your site, and a 6-digit code that changes every 30 seconds. Type that code in Enter the code the app shows now, and click Turn on.
2. Save your recovery codes, and click I saved them.

DooFiles shows The second factor is on. From now on, the actions you choose also ask for the code.

[SCREENSHOT_HERE: The Add DooFiles to your app dialog, with the QR code, the key with its Copy button and the 6-digit code field]

Your recovery codes

When you turn on your second factor, DooFiles gives you 10 recovery codes. If you lose your phone, each one works once instead of the code of the app.

They are shown only once. Copy them or download them, and keep them somewhere safe, outside your phone. The card shows how many you have left. Get new codes gives you 10 new ones, and the ones you had stop working.

Confirm with your second factor

When an action asks for it, DooFiles shows a dialog in two steps:

1. Type your WordPress password and click Continue.
2. DooFiles shows Password confirmed. Type the 6-digit code that your app shows now. The dialog sends it on its own when you type the sixth digit. You can also paste it.

To use a recovery code instead, click Use a recovery code. To go back, click Use the code from the app.

After you confirm, actions do not ask again for a while, the same time as the password confirmation: 10 minutes by default. A wrong code does not ask for your password again.

[SCREENSHOT_HERE: The second step of the confirmation dialog, with Password confirmed and the six boxes for the code]

When DooFiles asks for it

In When DooFiles asks for it, choose the actions that ask for the code together with the password:

Site settings and private folders always ask for it: changing the settings of this page, managing private folders, and resetting the second factor of other administrators.

To change these options, you need your own second factor turned on.

Require it for every administrator

In When DooFiles asks for it, turn on Ask every administrator for a second factor, and click Save changes.

Administrators without a second factor can still browse, view and download files, but cannot change anything until they turn theirs on. The file manager tells them: This site asks every administrator for a second factor. Until you turn yours on, you can browse, view and download files, but not change them., with a Turn on your second factor button.

The Administrators section also lists every administrator who can use DooFiles, and whether their second factor is on.

[SCREENSHOT_HERE: The Administrators section of the Second factor card, with the list of administrators, their state and the Reset button]

Turn off your second factor

In Yours, click Turn off and confirm. DooFiles asks only for your password again. Your authenticator app keeps the account: you can delete it there.

If your site asks every administrator for a second factor, turn off Ask every administrator for a second factor first, and save.

If you lose your phone

1. Use a recovery code. In the confirmation dialog, click Use a recovery code and type one of yours. Then turn your second factor off and on again with your new phone, or get new codes.
2. Ask another administrator to reset it. An administrator with their own second factor can click Reset next to your name, in the Administrators section. You get an email about it, it is recorded in the Activity log, and you set it up again from the start.
3. Turn it off for the whole site, in an emergency. If you are the only administrator and have no recovery codes, add this line to your wp-config.php file, by FTP or from the file manager of your hosting:

define( 'DOOFILES_DISABLE_2FA', true );

DooFiles then asks only for passwords, for everyone. Remove the line when you have access again, and turn your second factor on with your new phone.

Troubleshooting

Need more help? Open a support ticket.