Users are receiving ‘Invalid Verification Code’ errors

Hi there,

I am really sorry to hear about this unexpected experience. It’s not something we see on a regular, however, there are a few troubleshooting steps to take to narrow this one down.

You already did a great job ruling down the server time/sync, that’s usually one of the first things to rule out, and it’s helpful to know NTP is confirmed healthy.

To help us dig deeper and get to the root cause, we have a few follow-up questions:

1. Are you running a classic WordPress Multisite installation, or is this a Bedrock-based setup (e.g. via Roots/Trellis)?
2. Can you see a pattern in users affected roles maybe? Does this affect all users or just some? Also, are all users using the same log in form to access the site? If so, is that a custom form or the native WP login form?
3. Is this affecting all users across the board, or is it limited to existing users who had 2FA already configured? Are any newly enrolled users also experiencing the same ‘Invalid Verification Code’ error?
4. The invalid code errors you’re describing are most commonly associated with TOTP (the time-based authenticator app codes). However, we’d like to know: are users also seeing issues when using backup codes, or OTP via email (HOTP)? This would help us narrow down whether it’s specifically a TOTP/encryption issue or something broader.
5. Has anything changed in your setup over the past few weeks? Specifically, we’d like to know if the site (or any subsite) was recently migrated – for example, moved from staging to production or vice versa, or if the database was cloned or transferred in any way. This is one of the most common triggers for this type of issue, as the encryption keys used by WP 2FA can become out of sync during a migration.

On that last point, we have a dedicated knowledge base article covering best practices for migrating a site while retaining your 2FA encryption setup – it’s worth a read.

Looking forward to your answers and we’ll take it from there!

Hello again!

Thank you for coming back with such detailed answers – this is really helpful and you’ve done a great job narrowing things down!

Based on everything you’ve described, we have a working theory. The timing of the issue – occurring shortly after the US daylight saving time change -is interesting, and while the server itself is unaffected (as your host confirmed, it stays on UTC), the authenticator app on users’ devices could have been temporarily out of sync during or just after the DST transition. TOTP codes are extremely sensitive to time drift, and even a brief mismatch of 5–10 seconds on the device side is enough to cause “Invalid Code” errors consistently.

The fact that resetting and re-pairing 2FA resolved the issue for users – and that waiting for the next code cycle during setup also fixed things – is consistent with this. It suggests the pairing itself was fine, but the first code generated was caught in a transitional window.

This is also the first time we’re encountering this specific edge case, so your report is genuinely useful for us.

One thing we’d like you to do to confirm all is well now:
Could you try configuring 2FA from scratch with a brand new test user and go through the full setup and login flow? Since some time has passed since the DST change, clocks should have settled – and if a new user can set up and use 2FA without any issues, that gives us good confidence the root cause has passed and existing users simply need to re-pair their authenticator apps.

The slight oddity you’re seeing during setup – where the first code fails but the next one works – is also not the usual, and worth keeping an eye on in case it requires troubleshooting (ideally we need to know if it’s intermitent or always happening). If this persists consistently with the new test user as well, please let us know and we’ll dig further into that specific behaviour.

Looking forward to hearing how the test goes!