Title: Step-up authentication
Author: WordPress VIP Documentation
Published: March 5, 2025
Last modified: June 18, 2025

---

 1. [Manage user access](https://docs.wpvip.com/manage-user-access/)
 2. [VIP Dashboard access](https://docs.wpvip.com/manage-user-access/vip-dashboard/)
 3. Step-up authentication

#  Step-up authentication

Step-up authentication protects areas of [the VIP Dashboard](https://docs.wpvip.com/vip-dashboard/)
where users can access secure information (e.g. [Single Sign-On (SSO) Configurations](https://docs.wpvip.com/manage-user-access/vip-dashboard/sso/configurations/))
and protects actions that are not reversible (e.g. removing a domain or editing 
[IP Restrictions](https://docs.wpvip.com/security-controls/ip-restrictions/)).

## Limitations

 * For step-up authentication to work as expected, a user’s browser must allow pop-
   ups from `dashboard.wpvip.com`. If pop-ups from `dashboard.wpvip.com` are blocked,
   the user will be unable to complete the required authentication and will not 
   have access to protected actions or routes.
 * Step-up authentication does not apply to users who [log in to the VIP Dashboard with their organization’s SSO service](https://docs.wpvip.com/vip-dashboard/vip-dashboard-log-in/sso-auth/).
   For those users, authentication rules are handled by their organization’s IdP.

## Default behavior

Step-up authentication only applies to VIP Dashboard users who:

 * **Have logged in to the VIP Dashboard with a [VIP Authentication](https://docs.wpvip.com/vip-dashboard/vip-dashboard-log-in/vip-auth/)
   MFA method.** Step-up authentication does not apply to users who [log in to the VIP Dashboard with their organization’s SSO service](https://docs.wpvip.com/vip-dashboard/vip-dashboard-log-in/sso-auth/).
   For those users, authentication rules are handled by their organization’s IdP.
 * **Have an [Org admin role](https://docs.wpvip.com/manage-user-access/vip-dashboard/org-roles)
   or an [App admin role](https://docs.wpvip.com/app-role/) assigned to them.** 
   Only these roles have the permissions to access the actions and routes that are
   protected by step-up authentication.

When a user with an Org admin role or an App admin role attempts to perform a sensitive
action or access a higher-risk resource, they will be prompted by step-up authentication
to re-authenticate with [VIP Authentication](https://docs.wpvip.com/vip-dashboard/vip-dashboard-log-in/vip-auth/)
using one of their configured MFA methods. If the user re-authenticates successfully,
they will be allowed to perform protected actions and access protected areas in 
the VIP Dashboard for one hour. After one hour expires, the requirement to re-authenticate
will repeat.

## Pop-up window for authentication

Step-up authentication triggers a pop-up window in the user’s browser for VIP Authentication
and blocks access to the current VIP Dashboard panel with an overlay.

If the pop-up window fails, the user can attempt to re-trigger it by selecting the
button labeled “**Open authentication pop-up**” in the overlay. If the pop-up continues
to fail, the user’s browser might be blocking pop-ups. The browser’s settings must
be updated to allow pop-ups from `dashboard.wpvip.com` or the user will be unable
to complete authentication and have access to protected actions and routes.

![](https://docs.wpvip.com/wp-content/uploads/sites/2/2025/04/step-up-auth.png)

Example screenshot of the VIP Authentication pop-up

![](https://docs.wpvip.com/wp-content/uploads/sites/2/2025/03/image_64dae2.png)

Example screenshot of the step-up authentication overlay

Last updated: June 18, 2025