Hi @alyssaavantcompany, thanks for getting in touch!
A good test for this would be whether any of the recovery codes we provide when setting up 2FA work. If they don’t work either, it could point towards a theme/plugin conflict stopping our code from running correctly at the point of login. If the recovery code works but the authenticator’s doesn’t, then there may be a time mismatch on that device or the server.
To get back into your site without 2FA, follow these steps:
- Please use FTP/SFTP – or any file manager your web host provides via their administration panel.
- Look inside the /wp-content/plugins/ directory and rename the wordfence directory to wordfence.bak. This will deactivate Wordfence and allow you to login without the 2FA code.
- Once you have logged in to your WordPress admin you can name the folder back to wordfence again.
- Go to your user profile and add 2FA back to your account, making sure to download the new backup codes in case of problems in the future.
If the initial code from your authenticator is immediately accepted at the point of reconfiguration, it may confirm there’s a plugin/theme conflict on your login page rather than a time mismatch. You can test this by trying to log in with Wordfence as your only enabled plugin (on a default theme such as Twenty Twenty-Five). If it works, reenable your other plugins and theme one-by-one until the functionality breaks again so you can pinpoint where the problem originates.
Our list of known conflicts can be found here: https://www.wordfence.com/help/advanced/plugin-theme-conflicts/#known-plugin-conflicts
Many thanks,
Peter.
