devteamzeal

1. WordPress version 6.6.2, PHP 7.4, WP 2FA version 2.8.0
2. We’re using the Google Authenticator app

We are also using both Redis Cache and W3 Total Cache, are you aware of any issues using either of these with WP 2FA?

• This reply was modified 22 minutes ago by devteamzeal.

The issue is affecting all users, including newly created users. If we go into the user and reconfigure 2FA from the profile page the issue still persists. It’s happening across multiple devices. The initial setup with the first validation code in the wizard works, it only throws the error when trying to login after 2FA has been configured.

Thank you for your response. We can confirm the server, website, and devices timezones are all in sync. It it is affecting all users.

Hi there,

I’ve just tried updating the plugin to version 2.1.0 and that did not resolve the critical issues. It seems to be linked to the session_start() on line 13 of conditional-content-cf-lite\public\class-cf-cc-public.php. There is no session_write_close() within the file, hence the critical issue saying “A PHP session was created by a session_start() function call. This interferes with REST API and loopback requests. The session should be closed by session_write_close() before making any HTTP requests.” When I add session_write_close() to the end the critical issues no longer appear in the site health check.

I’d like to implement this fix but don’t want to edit the plugin directly. What would be the best way to implement this fix?

Many thanks