They use one of the ten recovery codes they were shown when they set it up — that is what those are for.
If those are gone too, an administrator switches it off from that person's profile, under Two-step sign-in, and they set it up again. That works for a shop's customers too: their profile is under Users in wp-admin even though they never see it. If the person locked out is the administrator, wp login-security two-factor off rosa does the same from a terminal.
Somebody who still has their phone and wants it off does that themselves, from their profile or from My Account → Two-step sign-in on a shop, and is asked for their password first. Make new recovery codes asks for it too.
There is deliberately no way to set up a second step for somebody else. Holding somebody else's secret is being able to sign in as them. Bringing over the app somebody already set up with Wordfence or Two Factor is the one exception: that is their own secret, and nobody is shown it.
Still stuck? Ask the developers who wrote it. We aim to reply within one business day.
Login Security
Stop the machines guessing at your passwords, and see exactly who has been trying.
From $19 a year · every feature · 30-day refund
