2FA Enabled but Not Requiring 2FA Code at Login

Hello @efinit, glad you reached out, and so sorry for the slow turnaround here!

The issue of 2FA configuration not saving typically occurs when the user meta data gets corrupted due to the following:

• Database inconsistencies between enabled providers and TOTP secrets (e.g. the  _two_factor_enabled_providers user meta might be missing or corrupted)
• Cached data
• Plugin conflicts interfering with user meta

First, I’d recommend that you double-check your Solid Security settings:

• Go to Security > Settings > Login Security (tab) > Two-Factor and make sure the “Authentication Methods” is set to “All Methods” or ensure “Mobile App” is included

Next, run this SQL query using phpMyAdmin or hosting panel to check for missing data

SELECT * FROM wp_usermeta 
WHERE user_id = [YOUR_USER_ID] 
AND meta_key = '_two_factor_enabled_providers';

If the result is empty or missing, run this to reset 2FA:

DELETE FROM wp_usermeta 
WHERE user_id = [YOUR_USER_ID] 
AND meta_key IN ('_two_factor_enabled_providers', '_two_factor_provider', '_two_factor_totp_key');

Then clear all caches (caching plugins, browser, CDN, object cache) and re-setup 2FA through your WordPress profile page.

I’d recommend doing the tests on a staging environment first as precaution.

Let me know if this helps!