Skip to main content

Two-Factor Authentication (2FA)

The Dealers Site supports Two-Factor Authentication for all dealer accounts, adding an extra layer of security beyond username and password.

Plugin: WP Simple Firewall​

2FA and broader account security are handled by the WP Simple Firewall plugin (plugins/wp-simple-firewall/).

2FA Methods Supported​

MethodDescription
Email OTPA one-time code is sent to the account's email on login
Authenticator App (TOTP)Time-based OTP via Google Authenticator, Authy, etc.
Backup CodesPre-generated single-use backup codes

Enforcement​

2FA can be enforced by user role. For the Dealers Site, 2FA is strongly recommended for all dealer accounts and required for admin accounts.

Configuration: WP Admin → Shield Security → Login Protection → Two-Factor Auth.

WordPress Firewall Features (WP Simple Firewall)​

Beyond 2FA, Shield Security provides:

  • Login Brute Force Protection — lockout after repeated failed login attempts
  • IP Block List — block known malicious IPs
  • Username Enumeration Prevention — prevents attackers from discovering valid usernames
  • WordPress Vulnerability Scanning — checks plugins and themes for known vulnerabilities
  • Audit Trail — records all security events (logins, failed logins, settings changes)
  • Comment SPAM Protection — automated spam filtering
  • File Change Detection — alerts on unexpected changes to core WordPress files

SSL/HTTPS​

The Dealers Site is served exclusively over HTTPS, enforced by:

  • WP Engine's managed SSL certificate (auto-renewed)
  • WordPress WP_HOME and WP_SITEURL configured with https://
  • HSTS headers returned by WP Engine's Nginx configuration

Password Policy​

Configure minimum password strength requirements under Shield Security → User Management.

Login Page Security​

Custom login page redirects are handled by Theme\Login (inc/class-login.php):

  • Redirects non-dealer users away from restricted pages after login
  • Customises the WordPress login page for the dealers brand
  • Sets appropriate redirect targets post-login based on user role