Hello there @jimmy4429 !
The most common reason why codes from Google Authenticator (or any TOTP app) don’t work is a time mismatch. The app generates codes based on the current time, so if either of the following is out of sync, the codes will be rejected:
- Your device’s date & time
- Make sure your phone is set to automatic date & time and automatic time zone.
- In Google Authenticator, you can also try re-syncing the time (if available on your device).
- The server’s date & time
- The server hosting the website must also have the correct system time.
- If the server clock is even slightly off, authenticator codes will fail while backup codes still work (which matches what you’re experiencing).
A few additional things to check:
- Did this start happening after a plugin update, server migration, or hosting change?
- Are you using the latest version of WP 2FA (v3.1.0)? If not, please update and test again.
- If possible, try reconfiguring the authenticator app once the time sync is confirmed.
If the issue persists after checking the above, please let us know:
- Whether this happens on all devices or just one
- If you’re aware of any recent server or site changes
Looking forward to your reply!
Hi,
This happened right away after installing the plugin.
Yes, the plugin is the latest version of WP 2FA (v3.1.0)
I checked the date and time on WordPress settings, it’s set to the correct Eastern time zone.
I don’t think it’s a problem with the Google Authenticator app because I have other websites WP2FA linked to the same app and they don’t have problems.
I don’t know how to check or change the server date and time so I have asked the hosting company about this.
Is there anything else that I can check meanwhile?
Thank you.
The hosting company also just got back to me and showed me how to check the server date and time and it’s already set to the correct Eastern time zone.
Hi Jimmy @jimmy4429 ,
Thanks for checking all of that and for confirming the server time as well – that helps rule out the most common cause 👍
Since time sync doesn’t seem to be the issue here, the next best step would be to reconfigure 2FA for your user once again:
- Go to your User Profile in WordPress
- Click on “Reconfigure 2FA” and scan the QR code again with Google Authenticator
- Then test logging in with the newly generated codes
If the issue still happens after reconfiguring, could you please let us know a bit more detail so we can narrow this down further:
- Exact error message
- When entering the authenticator code, do you see a specific message like “Invalid code”, or does it fail in a different way?
- Users / roles affected
- Does this happen only for your user, or for all users?
- Does it affect all roles (e.g. administrators, editors, etc.)?
- 2FA methods
- Does the issue only happen with TOTP apps (Google Authenticator), or does it also happen if you try another method (for example email-based codes, if enabled)?
- Login form
- Are you logging in via the native WordPress login page (
/wp-login.php), or through a custom login form/page?
- If you try the native
/wp-login.php page, does the issue still occur?
These details will help us determine whether this is related to the user setup, the login flow, or something specific to the authenticator method.
Looking forward to your update, and we’ll take it from there.
Yes I reconfigured 2FA and it’s working now. Thanks.
Thanks for letting me know @jimmy4429 ! I am happy everything is now sorted!
Don’t forget to drop us a review based on your experience with our plugin and support – these reviews only take one minute to post, but they are really useful! 🙂
Should you have any other questions, feel free to reach out!
