Hi @aenghus, thanks for reaching out to us.
If the backup codes stop working in addition to the authenticator app, it seems to point to a theme/plugin conflict that is stopping the login page code from working correctly. I’d expect backup codes to still work if there was an issue with the time losing sync on the server.
It does seem unusual that it would suddenly start happening after working in the past but auto-updates could’ve taken place that introduced a problem.
If you are unable to gain access to your site at all, look inside the /wp-content/plugins/ directory and rename the wordfence directory to wordfence.bak using your host’s file manager or via FTP access to your site.
Then try logging into WordPress as normal and, after gaining access, rename the folder back to “wordfence” before refreshing your browser. At this point you can try to re-activate 2FA through Wordfence > Login Security.
If that still doesn’t work, try the scan with all WordPress plugins disabled except for Wordfence. Does it work correctly then? If it does, re-enable your other plugins one-by-one until the issue reoccurs.
Thanks,
Peter.
