Look after your own account from your profile
Every user can set up two-factor, add passkeys and see where they are signed in from their WordPress profile, or from a store’s My Account page.
BetterShield’s own screens are for people who manage the site. Everyone else, from authors to store customers, looks after their own sign-in from their WordPress Profile. BetterShield adds three sections there, below WordPress’s own: Two-factor sign-in, Passkeys and Where you are signed in. Administrators see the same three on their own profile.
Two-factor sign-in
Anyone can turn on two-factor for their own account here: press Set up two-factor, scan the code with an authenticator app or type the Manual entry key, enter the Code from the app, press Confirm code, then store the ten backup codes and confirm. The steps are the same as on Protect › Two-Factor; see Two-factor and passkeys.
Once it is on, the section shows how many backup codes are left. When three or fewer remain, it suggests issuing a new set while you still can. Issue new backup codes asks for a Code from the app, or a backup code first.
Passkeys
Type Name this device, such as Work laptop, and press Add a passkey, then confirm on your device. Each passkey is listed with Remove. An account holds up to ten, and passkeys need HTTPS. If your role signs in with a passkey only, the section says so, and that your password no longer signs you in.
Where you are signed in
A table of every device signed in to your account, most recent first:
| Column | What it shows |
|---|---|
| Device | The browser it signed in from, or An unnamed device. The one you are using is marked as this device. |
| Network | The network it came from, such as 203.0.113.0/24, never the full address, or Not recorded. |
| Last active | When that session was last used. |
- This was not me ends one session straight away. It is not shown beside the device you are using.
- Sign out everywhere except this device ends all the others at once.
If you do not recognize a device, end it and change your password. Each ending is recorded in the activity log as Signed out of a device.
On multisite, a session covers every site of the network, so ending one here ends it everywhere. Where another plugin has replaced how WordPress stores sessions, This was not me is not offered, and Sign out everywhere except this device still works.
On a store’s My Account page
WooCommerce keeps customers out of the dashboard, profile included. For them, BetterShield adds a Sign-in security tab to My Account with the same three sections. Links that would point to the profile point there instead.
Notices on your dashboard
If the site requires two-factor of your role, a notice on your dashboard pages says how long you have to set it up. With BetterShield Ultra’s Sign-in policies, a role can also be reminded to add a passkey.
What an administrator sees on your profile
Opening someone else’s account under Users, an administrator sees only whether it uses two-factor. If it does, Turn off two-factor for this account removes it, for someone who lost both their phone and their backup codes. Nobody can set up two-factor or add a passkey for another person, and their sessions are ended from Protect › Login & Access (Who is signed in) instead.