Fixing Two-Factor Authentication (2FA) Issues After a WordPress Site Migration

Migrating a WordPress site is a complex process, and it's common for certain plugin settings to get out of sync. A frequent issue reported by users of the Solid Security – Password, Two Factor Authentication, and Brute Force Protection plugin is that Two-Factor Authentication (2FA) stops working correctly after moving a site to a new server or domain.

This guide will walk you through the most common causes and their solutions, based on community reports and troubleshooting.

Common Symptoms After a Migration

• The 2FA prompt no longer appears on the login screen.
• User profile pages are missing the 2FA configuration settings.
• Clicking the "Configure" button for 2FA redirects to the homepage or dashboard instead of showing a QR code.
• Seeing errors related to encryption or being unable to decrypt secrets.
• Server configuration rules in the plugin's Tools section still reference the old site paths.

Why This Happens

Site migrations can disrupt how plugins store and reference data. For Solid Security, this often involves:

1. Corrupted Settings: The migration process can sometimes corrupt the plugin's settings in the database.
2. Server Path Changes: File paths for server rules and other tools may remain hard-coded to the old server environment.
3. Encryption Key Issues: While the key might be the same, the migration can cause a mismatch in how encrypted data (like 2FA secrets) is decrypted.
4. Server Constant Conflicts: A testing constant left over in your wp-config.php file could be disabling 2FA entirely.
5. Plugin Conflicts: Other plugins, especially those that modify the login process, can interfere with the 2FA onboarding flow.

How to Troubleshoot and Fix 2FA Migration Issues

1. Check for a Disabling Constant

The first and easiest thing to check is your wp-config.php file. A constant might have been added for testing and never removed.

• Access your site's files via FTP or your hosting file manager.
• Open the wp-config.php file.
• Look for a line that says: define( 'ITSEC_DISABLE_TWO_FACTOR', true );
• If you find it, either delete the line or change true to false.
• Save the file and check if 2FA functionality returns.

2. Reset Server Configuration Paths (For NGINX Users)

If your server rules are pointing to the wrong paths, you can reset them.

• In your WordPress admin, go to Security > Settings > Global Settings.
• Find the section for "NGINX Conf File".
• Click the "Restore Default" button and save your settings.
• You may need to restart your web server for the changes to take full effect.
• Afterwards, run the site scan and config rules tools again to see if they now use the correct paths.

3. Check for Plugin Conflicts

If the "Configure" button redirects you instead of showing the QR code, a conflict is likely.

• Temporarily deactivate all other plugins except Solid Security.
• Try to configure 2FA again. If it works, reactivate your plugins one-by-one to identify the culprit.
• Common conflict sources are plugins that manage user registration, custom login pages, or other security tools.

4. Reinstall and Reconfigure the Plugin

If the above steps don't work, a clean reinstall can often resolve corrupted settings.

1. Go to Plugins > Installed Plugins.
2. Deactivate and then delete the Solid Security plugin. Note: This will not delete all of its settings from the database.
3. Reinstall and activate the plugin fresh from the WordPress plugin repository.
4. Go through the setup wizard to reconfigure your security settings, including 2FA.

5. Check Server Error Logs

If you are experiencing a 500 Internal Server Error when 2FA is enabled, the root cause will be logged.

• Access your server's error logs through your hosting control panel (e.g., cPanel) or ask your host for assistance.
• Look for errors that occur at the exact time you try to log in or access the 2FA configuration. The error message will provide specific clues about what is failing.

When All Else Fails

If you have tried all these steps and 2FA is still broken, the issue may be complex and require deeper database troubleshooting. The community on forums like the WordPress Support Forums can be a valuable resource for these edge cases.

Remember, always back up your site completely before making significant changes to files or plugins.