The first-run wizard helps you configure FluentAuth in a short sequence. It explains each choice and presents a review before applying settings. Skipping the wizard does not save its proposed configuration. Everything it applies remains editable in ordinary settings.
What you choose
- Login limits: how many failed attempts an address can make within a time window.
- Two-factor authentication: protection for the roles that need it.
- Hardening: WordPress capabilities and public endpoints to restrict.
- Alerts: which login events should email you.
- Connection: check the visitor address and configure a trusted proxy if traffic passes through one.
Review before applying
Read the final summary. Keep application passwords available if your integrations need them, and check your profile email before enabling email verification at login. Do not require a device method before you have a working enrolment and recovery route.
The connection step is about recognising visitor IP addresses, so one person’s failed logins do not lock everyone out behind a proxy. The optional file-scan alerts service is configured separately under Security → Monitoring.
Email codes are selected by default in the two-factor step. An authenticator app is optional, and Who gets the second step chooses the roles. Requiring device enrolment is a separate choice you make later in General Settings.
After setup
Follow First-day setup to test a separate login, check the activity log, review findings and configure any member-facing sign-in options. You can revisit choices under Settings → General Settings at any time.