Repository navigation
TOTP verification field initially appears blank #1014
Description
Describe the bug
Hello Two Factor team,
My website is hosted on WordPress.com Business, and I installed the latest available version of your Two Factor plugin.
When testing my local administrator login, I entered my username and password, but the TOTP verification field did not appear.
Clicking “Use a recovery code” and then switching back to TOTP/authenticator-app verification made the field appear. I could then enter my authenticator code and log in successfully.
Is this a known issue, and is there a fix so the verification field appears immediately?
Thank you for your help.
Steps to Reproduce
- Install and activate the latest version of Two Factor on a WordPress.com Business site.
- Configure authenticator-app verification (TOTP) for a local administrator account.
- Log out and open
/wp-login.phpin any browser. - Enter the administrator’s username and password, then click Log In.
- The two-factor verification page appears, but the TOTP input field is missing. The alternative authentication links remain visible.
- Click “Use a recovery code,” then click the link to switch back to TOTP/authenticator-app verification.
- The TOTP input field now appears, allowing successful login using the authenticator code.
Screenshots, screen recording, code snippet
No response
Environment information
No response
Please confirm that you have searched existing issues in this repository.
No
Please confirm that you have tested with all plugins deactivated except Two-Factor.
No
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
- Status
Activity
masteradhoc commentedon Oct 2, 2026
Thank you for the report, @afirwana!
Could you please provide a list of the plugins currently installed and active on the site?
Also, would you be able to run a conflict test by temporarily deactivating the other plugins and testing with only Two-Factor active? If the issue goes away, you could then re-enable the plugins one by one to identify which plugin is causing the conflict.
That would help us narrow down whether this is a plugin conflict or an issue within Two-Factor itself.
afirwana commentedon Oct 2, 2026
Thank you @masteradhoc I’ll provide the installed plugin names, versions, and activation status.
My site is a live learning platform hosted on WordPress.com Business, so I’ll perform the conflict test on staging. I’ll first confirm that the issue also occurs there, then deactivate the other plugins and re-enable them one by one if the issue disappears.
I’ll report the results and note any WordPress.com-managed plugins that remain active during testing.
afirwana commentedon Oct 2, 2026
Thank you @masteradhoc . My site is hosted on WordPress.com Business and runs WordPress 7.1.2.
There are 48 installed plugins: 33 active and 15 inactive. The attached export shows the active plugins only and does not display individual plugin versions.
Currently active plugins:
Neither Wordfence Security nor Wordfence Login Security appears in the active plugin list.
I’m unable to perform a full plugin deactivation test at the moment. Could you suggest targeted checks based on this list, or specific console errors or failed requests that would help diagnose the issue?
The issue occurs on the standard wp-login.php screen across browsers. Switching to “Use a recovery code” and then back to the authenticator-app option makes the TOTP field appear.
masteradhoc commentedon Oct 2, 2026
Could you check with JetPack disabled? We've an open report here thats fixed but not yet published: #1009
afirwana commentedon Oct 2, 2026
Thank you for pointing me to #1009. The symptoms described look very similar to mine.
My site is hosted on WordPress.com Business, where Jetpack is automatically managed and cannot be deactivated. There is no “Deactivate” option for it.
I log in through the standard wp-login.php page using a local administrator account.
Could you suggest a way to confirm this CSS conflict while keeping Jetpack active—for example, by inspecting the affected elements or temporarily disabling only the SSO module?
Also, when will the fix be included in a published release? @masteradhoc
masteradhoc commentedon Oct 3, 2026
Thank you for understanding! What i would suggest so you dont have to do it on every login is to manually apply the changes from this PR (see https://github.com/WordPress/two-factor/pull/1009/changes) to the plugin until we prepare a release and fix this for everyone.
Could you test that?
CC: @kasparsd
masteradhoc commentedon Oct 5, 2026
Fixed in #1009 :)