Two-Factor Authentication

On a membership site, a password alone is easy to guess, reuse or steal. Two-factor authentication for membership sites adds a second check, and this add-on puts it on your Ultimate Membership Pro login form: after a member enters the right username and password, your site sends a one-time code by email or SMS, and the member types it to get in.

On your login form, a stolen or guessed password is then not enough to open an account. Members confirm the login with something they have: their inbox or their phone.

Two-factor authentication with email and SMS verification

• Email, SMS or both. Send the code in an email, as a text message, or both ways for a more secure identification.
• Five SMS services. Connect TeleSign, BulkSMS, Messente, InfoBip or ClickSend, then check your credentials with a test SMS.
• Email as a backup. With SMS selected, the code goes out by email whenever a text can’t be sent, for example to a member with no phone number.
• Codes that expire. Choose how long a code works: 10, 30, 45 or 60 minutes.
• A limit on new codes. Set how many codes a member can request per hour, or allow as many as they need.
• Your words, your form. Edit the SMS text, the email that carries the code and the messages on the code screen. The code form uses the same template as your login form.

How Two-Factor Authentication works

1. Switch on the add-on in Ultimate Membership Pro and choose email, SMS or both.
2. For SMS, pick your SMS service, enter its credentials and add a Phone field to your registration form.
3. Set how long a code stays valid and how many codes a member can request per hour.
4. Members log in as usual, type the code from their email or phone and click Submit to finish.

If the password is wrong, the normal login error appears and no code is sent. A member who needs a new code clicks the resend link under the code field. Once the code is right, the login completes as usual, including any redirect you set for logins.

Step-by-step setup is in the Two-Factor Authentication guide.

When login verification protects your members

• Paid content worth protecting. When members pay for courses, coaching or premium articles, a guessed password shouldn’t be enough to get in.
• Members who reuse passwords. A password leaked from another site isn’t enough on your login form, because the code goes to their own inbox or phone.
• Login with phone verification. Send the code by SMS to the phone number in the member’s profile. When the member has a Country field, the country prefix is added for them.

For example, a coaching club sends codes by email, valid for 30 minutes, with up to three codes per hour. Free Community, Pro Monthly and Annual Pass members all confirm their login the same way.

Works well with

• Hidden WP Login, to send visitors from the WordPress login page to the Ultimate Membership Pro login form, where the code step runs.
• Manage Reset Password, so members who forget their password choose a new one on your site.
• Login security, the overview of how Ultimate Membership Pro protects member accounts.

Questions about Two-Factor Authentication

Which plans include Two-Factor Authentication?

Two-Factor Authentication comes with the Full Package and Agency plans, together with all 46 Pro add-ons. The Pro plan doesn’t include Pro add-ons.

Can members get the login code by SMS?

Yes. Choose SMS or Email & SMS, connect TeleSign, BulkSMS, Messente, InfoBip or ClickSend, and add a Phone field to your registration form. With SMS selected, a code that can’t go out as a text is sent by email instead.

How long is a login code valid?

As long as you choose: 10, 30, 45 or 60 minutes. A member who needs a new code clicks the resend link, and the new code replaces the old one.

Who is asked for a code?

Everyone who logs in through the Ultimate Membership Pro login form, administrators included, so every account gets the same protection.

Can I edit the email that carries the code?

Yes. The add-on creates the 2fa – Send Code for Login notification, which you edit with your other email notifications. The {code} tag places the one-time code, next to tags such as the member’s first name.