# Second factor

> How to add a 6-digit code from an authenticator app to the password confirmation of DooFiles: turning it on, recovery codes, when DooFiles asks for it, requiring it for every administrator, and what to do if you lose your phone.

Source: https://doothemes.com/docs/doofiles/security/second-factor

---

## Overview

The second factor adds a 6-digit code from an authenticator app on your phone to the [password confirmation](https://doothemes.com/docs/doofiles/security/password-confirmation). Even if someone gets your password, they cannot change the code of your site without your phone.

Each administrator turns on their own second factor. You choose when DooFiles asks for it, and you can require it for every administrator of your site.

You need an authenticator app on your phone. If you do not have one yet, start with [Get an authenticator app](#get-an-authenticator-app).

## Get an authenticator app

An authenticator app shows a new 6-digit code every 30 seconds, even without an internet connection. Most are free. Install one of these on your phone:

| App | Android | iPhone and iPad | Cost |
|---|---|---|---|
| **Google Authenticator** | [Google Play](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) | [App Store](https://apps.apple.com/app/google-authenticator/id388497605) | Free |
| **Microsoft Authenticator** | [Google Play](https://play.google.com/store/apps/details?id=com.azure.authenticator) | [App Store](https://apps.apple.com/app/microsoft-authenticator/id983156458) | Free |
| **2FAS** | [2fas.com](https://2fas.com/) | [2fas.com](https://2fas.com/) | Free |
| **Authy** | [authy.com](https://www.authy.com/download/) | [authy.com](https://www.authy.com/download/) | Free |
| **1Password** | [1password.com](https://1password.com/downloads/android) | [1password.com](https://1password.com/downloads/ios) | Paid, part of the 1Password password manager |

If you are not sure, choose **Google Authenticator** or **Microsoft Authenticator**. Any other app that shows 6-digit codes every 30 seconds also works.

:::info
Turn on the backup of your codes in the app, if it offers one (Google Authenticator calls it syncing to your Google Account). If you change or lose your phone, your codes come back when you sign in on the new one.
:::

## Turn on your second factor

1. Go to **DooFiles › Settings** and open the **Second factor** card.
2. In **Yours**, click **Turn on**, and confirm your password.
3. On your phone, open the authenticator app and add a new account: tap **+** (or **Add a code**, **Add account**), then **Scan a QR code**, and point the camera at the QR code on your screen.
   If you cannot scan it, choose **Enter a setup key** (or **Enter key manually**) in the app, and type the key that appears below the QR code. Use **Copy** to copy it.
4. The app now shows **DooFiles**, with your username and the address of your site, and a 6-digit code that changes every 30 seconds. Type that code in **Enter the code the app shows now**, and click **Turn on**.
5. Save your recovery codes, and click **I saved them**.

DooFiles shows *The second factor is on.* From now on, the actions you choose also ask for the code.

[SCREENSHOT_HERE: The Add DooFiles to your app dialog, with the QR code, the key with its Copy button and the 6-digit code field]

### Your recovery codes

When you turn on your second factor, DooFiles gives you 10 recovery codes. If you lose your phone, each one works once instead of the code of the app.

They are shown only once. Copy them or download them, and keep them somewhere safe, outside your phone. The card shows how many you have left. **Get new codes** gives you 10 new ones, and the ones you had stop working.

## Confirm with your second factor

When an action asks for it, DooFiles shows a dialog in two steps:

1. Type your WordPress password and click **Continue**.
2. DooFiles shows *Password confirmed.* Type the 6-digit code that your app shows now. The dialog sends it on its own when you type the sixth digit. You can also paste it.

To use a recovery code instead, click **Use a recovery code**. To go back, click **Use the code from the app**.

After you confirm, actions do not ask again for a while, the same time as the password confirmation: 10 minutes by default. A wrong code does not ask for your password again.

[SCREENSHOT_HERE: The second step of the confirmation dialog, with Password confirmed and the six boxes for the code]

## When DooFiles asks for it

In **When DooFiles asks for it**, choose the actions that ask for the code together with the password:

| Action | What it covers | Default |
|---|---|---|
| **Opening private folders** | Listing, viewing, downloading or changing anything inside them | On |
| **Changing code** | PHP files, server settings files, folders and zip files with code | On |
| **Deleting permanently** | From the DooFiles Trash | On |
| **Any change to files** | Also uploads, new files and folders, and the other changes that do not ask for the password today | Off |

**Site settings and private folders** always ask for it: changing the settings of this page, managing private folders, and resetting the second factor of other administrators.

To change these options, you need your own second factor turned on.

## Require it for every administrator

In **When DooFiles asks for it**, turn on **Ask every administrator for a second factor**, and click **Save changes**.

Administrators without a second factor can still browse, view and download files, but cannot change anything until they turn theirs on. The file manager tells them: *This site asks every administrator for a second factor. Until you turn yours on, you can browse, view and download files, but not change them.*, with a **Turn on your second factor** button.

The **Administrators** section also lists every administrator who can use DooFiles, and whether their second factor is on.

[SCREENSHOT_HERE: The Administrators section of the Second factor card, with the list of administrators, their state and the Reset button]

## Turn off your second factor

In **Yours**, click **Turn off** and confirm. DooFiles asks only for your password again. Your authenticator app keeps the account: you can delete it there.

If your site asks every administrator for a second factor, turn off **Ask every administrator for a second factor** first, and save.

## If you lose your phone

1. **Use a recovery code.** In the confirmation dialog, click **Use a recovery code** and type one of yours. Then turn your second factor off and on again with your new phone, or get new codes.
2. **Ask another administrator to reset it.** An administrator with their own second factor can click **Reset** next to your name, in the **Administrators** section. You get an email about it, it is recorded in the [Activity](https://doothemes.com/docs/doofiles/views/activity) log, and you set it up again from the start.
3. **Turn it off for the whole site, in an emergency.** If you are the only administrator and have no recovery codes, add this line to your `wp-config.php` file, by FTP or from the file manager of your hosting:

```php
define( 'DOOFILES_DISABLE_2FA', true );
```

DooFiles then asks only for passwords, for everyone. Remove the line when you have access again, and turn your second factor on with your new phone.

## Troubleshooting

| Problem | What to do |
|---|---|
| I do not have an authenticator app | Install one of the apps in [Get an authenticator app](#get-an-authenticator-app). They are free |
| The app does not scan the QR code | Choose **Enter a setup key** in the app, and type the key that appears below the QR code |
| *The code is not correct. Use the one your authenticator app shows now.* | Type the code that the app shows right now. If it keeps failing, check that the date and time of your phone are set automatically |
| *That code was already used. Wait for the next one in your app.* | Each code works once. Wait for the next one, about 30 seconds |
| *That recovery code is not valid or was already used.* | Each recovery code works once. Try another one |
| I cannot change the options of When DooFiles asks for it | Turn on your own second factor first |
| *This server cannot use a second factor* | Your server does not have the PHP OpenSSL extension. Ask your hosting provider to turn it on |
| *The second factor is turned off on this site* | `DOOFILES_DISABLE_2FA` is set in `wp-config.php`. Remove that line to use the second factor again |
| An administrator can only browse | Your site asks every administrator for a second factor, and they do not have one yet |

Need more help? [Open a support ticket](https://doothemes.com/account/tickets/new).