Find this at Settings → Security in the Contractor Hub.

1. Open Settings → Security. In the Two-step sign-in card, type your password under Your password, to begin.
2. Press Set up two-step sign-in.
3. Open an authenticator app (such as Google Authenticator, Microsoft Authenticator or Authy). Add a new account.
4. Scan the picture, or choose “enter a key” and type the key shown. The key is shown once.
5. Type the 6-digit code under Code from the app and press Turn on.
6. Your recovery codes appear. There are 10. Press Copy, Download or Print.
7. Tick “I have saved these codes somewhere safe” and press Done.

If the card warns that the website cannot keep the key safe, ask your host to turn on PHP OpenSSL.

Type your password and then the 6-digit code (or a recovery code). Each recovery code works once. The code covers the WordPress sign-in page, the VisionScaper website sign-in, and the phone app sign-in. The Security screen has a card Where two-step sign-in applies that marks each path as Covered or Not covered. Application passwords and XML-RPC are not covered, nor are sessions already signed in before you turned it on.

Five wrong codes in 15 minutes pause sign-in for 15 minutes.

Type your password and a current code (or a recovery code). Press Make new recovery codes (the old ones stop) or Turn off.

Owners can tick Require it for managers and press Save. A manager without it can open only the Security screen until they set it up. The owner is never blocked.

If a team member lost their phone and codes, press Reset beside their name, type your own password, and press Reset two-step. They are signed out everywhere and can set it up again.

• Sign-in history is kept for 90 days. Addresses are shortened on purpose. Filter by result and, for owners, by person. Press Download list for a CSV.
• Account activity shows who changed what: reviews, library, security, your data, automations, training, messages and calls, billing and sign-ins. Filter by area, person, words and dates, and download the list.
• Sign out other devices ends every other browser and phone sign-in.

1. Use a recovery code.
2. Another administrator can reset your two-step.
3. A site administrator can add define( 'DREAMSCAPER_DISABLE_2FA', true ); to wp-config.php. That switches off every second step on the whole site. Sign in, fix things, then remove the line.

• Store recovery codes away from your phone.
• Make new codes when you are down to 3 or fewer.
• Customers with two-step on cannot use Google or Facebook sign-in. They use password plus code.

• “That code was already used”: wait for the next 30-second code.
• Codes always fail: check your phone’s clock is automatic.

• Customer records, data export, erasing and privacy requests
• Google sign-in for customers
• Cron, WP-CLI, caching, SSL and REST troubleshooting (401, 403, 404)
• Creating access keys and choosing scopes