How to temporarily disable 2FA on WordPress

There are cases in which you might need to temporarily disable two-factor authentication (2FA) without deactivating the WP 2FA plugin. There are 2 options for this:

Disable 2FA manually using wp-config

To do so, all you need to do is add the below directive to the wp-config.php file of your WordPress website.

define( 'DISABLE_2FA_LOGIN', true );

You can add this directive anywhere in the wp-config.php file as long as it is above the /* That’s all, stop editing! Happy publishing. */ comment.

Enabling 2FA again

To enable back 2FA on your website change true to false in the above directive, or simply delete the directive.

Allow a one-time login without 2FA (through admin action)

Administrators can also allow a user to log in once without 2FA. This option is useful in various situations, for example:

• When a user temporarily cannot access their 2FA device
• When there are email deliverability issues preventing the user from receiving the 2FA code
• When a user encounters difficulties generating or retrieving their one-time code.
• If there are depleted backup codes

It provides a secure and convenient way to let users access their accounts without permanently changing their 2FA configuration, or without completely disabling 2FA for everyone.

How to use it

1. Go to Users → All Users.

2. Hover over the target user and click Remove 2FA temporary:

Or open the user profile and click Remove 2FA temporary:

3. Inform the user they have 1 hour to log in. If they do not log in within 1 hour, the bypass expires and 2FA is required again.

The next login for that user will now not prompt for 2FA, but the user’s existing 2FA configuration (if any) is not reset or changed. After the bypass is used once (or expires), 2FA prompts resume as normal.

Note: This action is independent of enforcement rules. Even on sites where 2FA is enforced, the one-time bypass still allows the next login without a 2FA prompt.