Considerations when migrating a WordPress website while WP 2FA is activated

When migrating or cloning a WordPress site from staging to production, and you have active WP 2FA (Two-Factor Authentication) policies enabled for users, there are some important considerations to keep in mind.

WP 2FA encrypts user information using a secret key. This key is normally stored in the site’s wp-config.php file. If the plugin detects that the wp-config.php file is unwritable, this secret key will be stored in the database instead. On some sites, this is done on purpose for security reasons.

We also have a separate guide explaining how to move the secret key from the database to the wp-config.php file.

Below is an example of what you should see when opening the wp-config.php file and checking for our plugin encrypt key:

define( 'WP2FA_ENCRYPT_KEY', '8YB+38vAQvAfdMG73zLRCA==' );

Migration procedure

If the plugin is active during migration, it might regenerate the encryption keys, rendering existing 2FA configurations invalid.

To avoid this:

1. Deactivate the plugin before migration and reactivate once migration is complete.
2. Copy and preserve the WP2FA_ENCRYPT_KEY value before migration. If it changes after migration, replace the new key with the old one.
3. Ensure the WP_USERMETA table, containing wp_2fa_ database entries, remains unchanged.
4. Ensure that inside the WP_OPTIONS table, wp_2fa_ prefixed entries remain unchanged (these are responsible for the plugin settings and configuration)

Following these steps preserves the encryption key, plugin settings, and users’ existing 2FA configurations during the migration or cloning process.