Email 2FA
Email 2FA adds a two-step verification layer using a one-time code sent by email — an extra security check for sensitive forms or account access.
On this page
What this does
Where extra assurance is needed, the visitor confirms their identity with a one‑time code emailed to them, in addition to the normal step. This verifies the email address and adds protection against misuse.
Why it exists: for high‑value or sensitive forms and accounts, a second factor greatly reduces fraud and abuse.
Typical use cases
- Verifying the email on important submissions.
- Adding a second factor to protected access.
- Reducing fake or throwaway‑email submissions.
How to use it
- Enable Email 2FA on FormFlow → Features (Security & Analytics group). (Agency)
- Configure it on FormFlow → Security (code delivery and related options).
- Apply it to the flow you want to protect.
- Test: complete the step and confirm the emailed code is required.
Who the code comes from
By default the verification code is sent by the WordPress default sender — “WordPress <wordpress@your-domain>” — which is rarely what you want on a form protecting something valuable.
Set your own sender per form, in the Elementor editor, under Verification Email Sender:
| Control | What it does |
|---|---|
| From Name | The sender name the visitor sees. Empty means “WordPress”, or your site title when a From Email is set. |
| From Email | The sender address. Leave both empty to keep the current sender. |
While the fields are empty, the editor shows you the sender that is really being used, so the panel never displays a sender that is not in effect.
If only one is set:
- From Email only → your site title is used as the name.
- From Name only → it is used with the site’s default address.
- Both empty → nothing changes.
If WP Mail SMTP is forcing its own sender
When WP Mail SMTP is set to force a sender, it replaces whatever FormFlow sets after FormFlow has set it — which makes these fields look ignored.
The editor detects this and says so directly under the affected field, naming the address or name being forced. To use your own sender instead, switch off Force From Email in WP Mail SMTP → Settings, or set that plugin to the address you want.
Tips & Best Practices
-
Use it where it matters. Reserve 2FA for sensitive or high‑value flows so it doesn’t add friction everywhere.
-
Keep the email clear. A short, well‑worded code email reduces confusion.
-
Set a reasonable code lifetime — long enough to receive it, short enough to stay secure.
-
Combine with Turnstile and IP blocking for layered protection.
Frequently Asked Questions
Is Email 2FA available on Free or Pro?
No — it’s an Agency feature.
How does the visitor get the code?
By email, to the address they provide/own.
Where do I configure it?
On the FormFlow → Security tab.
Does it verify the email address?
Yes — receiving the code confirms access to that email.
Will it slow down every form?
Only the flows you apply it to — use it selectively.
Can I combine it with other security features?
Yes — pair it with Turnstile and IP Blocking.
The code email comes from “WordPress”. Can I change that?
Yes. Set From Name and From Email under Verification Email Sender on the form, in the Elementor editor, then publish the page.
I set a sender and it is still ignored.
Two likely reasons. Either the page has not been published since the change — the sender is read from the saved form — or an SMTP plugin is forcing its own sender. The editor names a forced sender directly under the field.
Is the sender per form or site-wide?
Per form. Each form carries its own From Name and From Email.
Developers: can I set the sender in code?
Yes. The ffe_2fa_email filter receives the mail arguments; when a form has a From Email, the headers it receives already contain the matching From header. A From header added by the filter still takes precedence.
Was this article helpful?
Something missing or unclear? Tell the @Rank support team and we will fix the page.
For product help beyond the documentation, visit at-rank.com.