Requiring it, and stepping up
Enforcement applies to a role, not to a person. That single fact is why the grace period exists.
Enforced roles
On Settings → U2 Secured, tick the roles that must use two-factor. With nothing ticked nobody is forced and linking stays opt-in, which is the state a freshly activated plugin is in, deliberately.
The grace period
Ticking “administrator” applies to every administrator at once, starting with whoever ticked it. The grace period is what stops that from being a mass lockout: a newly-required user is let through and warned rather than refused, until their window closes. The warning is a dismissible admin notice that appears on every admin screen — the Dashboard included, not only their profile — and links to the profile screen where they can actually link their phone. The clock starts on the first sign-in that requires them and starts once per user — it does not reset on every login.
- The default is 7 days. A user inside the window is told how long is left in whole days — except in the final 24 hours, where the notice reads “less than a day” rather than “1 day”. That wording is deliberate: rounding up to “1 day” reads as “tomorrow will do”, and tomorrow will not do. A user who has no window at all is told exactly that, rather than shown a zero.
- A grace of 0 days enforces immediately: the next sign-in by an unlinked user in an enforced role is refused with “Two-factor authentication is required for your account. Ask an administrator to help you enrol.”
- Once the window closes, that user cannot sign in until they have linked — and they cannot link without signing in. That is what the nudge is for, and what the escape hatch is for.
Keep a second administrator session open
Fail-closed means a misconfiguration blocks logins. A wrong API key, an unreachable base URL, or a role ticked by mistake can lock administrators out of their own site. Change enforcement with a second, already-signed-in administrator session open in another browser profile, so a mistake is something you fix rather than something you are locked out by.
Step-up approvals
A small set of sensitive capabilities requires a fresh tap even mid-session. Rather than intercepting individual admin screens, the plugin withholds the capability itself, so WordPress’s own permission checks do the enforcing and an action reached by an unexpected route — a REST call, WP-CLI, another plugin’s screen — is covered too. A denied screen sends the user to an “Approval required” interstitial naming the action; approving on the phone restores the capability and returns them to where they were going. One approval covers the next ten minutes, because re-prompting on every click trains people to approve reflexively. The approval request itself expires after about 120 seconds — the same window as a login — so an administrator who is interrupted mid-approval starts the request again rather than losing anything.
Gated by default
- install_plugins — “Install a plugin”
- update_plugins — “Update plugins”
- promote_users — “Change a user role”
- edit_users — “Edit a user account”
Changing the list
Use the u2auth_stepup_actions filter. Register it at load time — plugins_loaded or init — because the resolved list is memoized per request, so a filter added after the first capability check of a request does not take effect until the next one.
add_filter( 'u2auth_stepup_actions', function ( $actions ) {
$actions[] = 'edit_theme_options';
return $actions;
} );One capability is never withheld
read is excluded from the gate even if a filter asks for it, because the interstitial that clears the gate is itself a screen the user has to be able to reach. Gating read would withhold the only route back to every other capability — a permanent lockout, in the hardest possible place to find one.