Security Settings

The Security settings tab is the control center for account protection — two-factor authentication and Cloudflare Turnstile — presented in two clear boxes.

Where to find it: SubscriptionFlow → Settings → Security.

What this does

This one page configures how customer accounts are protected. It’s split into two sections:

Two‑Step Verification (2FA) — codes at login, by email (and SMS on higher plans).
Cloudflare Turnstile — bot protection on the login and registration forms.

For the concepts and customer experience, see Two‑Factor Authentication and Cloudflare Turnstile. This page is the settings reference.

Two‑Step Verification settings

Setting	What it controls
Enable 2‑Step Verification	Turns 2FA on for your store.
Mode	Optional (customers choose) or Forced (required for all).
Allow Email verification	Enables email as a code delivery method.
Code Expiry (minutes)	How long a one‑time code stays valid.
Verified Session Duration (minutes)	How long a customer stays verified before being asked again.
Maximum Failed Attempts	How many wrong codes before the attempt is blocked.
Resend Cooldown (seconds)	The wait before a new code can be requested.
Security Log Retention (entries)	How many recent security events to keep.
Email Template (Subject / Body)	The wording of the verification email. Body placeholders: `{code}`, `{minutes}`, `{name}`, `{site}`.

Cloudflare Turnstile settings

Setting	What it controls
Enable Cloudflare Turnstile	Turns on bot protection.
Site Key / Secret Key	Your Cloudflare Turnstile widget keys.
Protect the Login form	Adds the bot check to login.
Protect the Register form	Adds the bot check to registration.
Widget Theme	Auto, Light, or Dark.

How to set it up

Go to Settings → Security.
In Two‑Step Verification, enable 2FA, choose a Mode, allow Email verification, and adjust the timing/attempt limits and email template.
In Cloudflare Turnstile, enable it, paste your Site and Secret keys, choose which forms to protect, and pick a theme.
Click Save Security Settings.

Tips & Best Practices

Start 2FA in Optional mode, then move to Forced for sensitive stores.
Keep code expiry short but realistic (a few minutes) and set a friendly resend cooldown.
Personalize the email template with the {code} and {name} placeholders.
Protect the registration form with Turnstile to stop spam sign‑ups.
Set a sensible log retention so you keep useful history without clutter.

Frequently Asked Questions

Is the Security settings tab available on Free?

No — it’s Pro. On Free it shows an “Upgrade to Pro” panel.

Can I require 2FA for everyone?

Yes — set the Mode to Forced.

Which placeholders can I use in the 2FA email?

{code}, {minutes}, {name}, and {site}.

Where do I get Turnstile keys?

From a Cloudflare Turnstile widget — see Cloudflare Turnstile.

What does “Verified Session Duration” do?

It’s how long a customer stays verified after entering a code, so they aren’t prompted on every visit.

Do these settings protect the WordPress admin login?

They protect your store’s customer login/registration flow. Admin logins follow WordPress’s own mechanisms.

Will changing retention delete past logs?

Entries beyond the retention limit are cleared over time; lowering it keeps fewer recent entries.