Enable two-factor authentication

Your Manage GPL account is the single control point for every WordPress site you connect. A stolen password would let someone trigger updates, install plugins, or (with the right plan) issue SSO logins into your sites. Enabling two-factor authentication closes that gap completely.

What you'll need

• A TOTP authenticator app on your phone. Any standard one works: 1Password, Google Authenticator, Authy, Microsoft Authenticator, Bitwarden, Raivo (iOS), or any open-source alternative.
• A minute or two to scan a QR code and verify a code.

Enable 2FA

1. Go to Dashboard → Account.
2. Scroll to the Two-factor authentication section.
3. Click Enable. A QR code will appear along with a text-based secret.
4. In your authenticator app, add a new account and scan the QR code (or paste the text secret).
5. Your app will now show a 6-digit code that changes every 30 seconds. Enter the current code in the verification box and click Confirm.
6. Save the recovery codes somewhere safe (a password manager is ideal). Each code can be used once to log in if you lose access to your authenticator.

After it's on

On every login, after entering your password, you'll be prompted for a 6-digit code from your authenticator. The code is valid for 30 seconds; the app shows a countdown.

If your clock is off by more than a minute, codes won't validate. Most phones handle this automatically, but if you suddenly can't log in, check that your phone's time is set to network-synced.

Lost your authenticator?

Use one of your recovery codes. Each code is single-use; after logging in, immediately regenerate and re-save a fresh set from the Account page.

If you've lost both your authenticator and your recovery codes, contact us with proof of account ownership and we'll help you recover.

Disable 2FA

You can disable 2FA at any time from Dashboard → Account. We don't recommend it, but it's a one-click operation and we won't make you justify yourself.