Your WordPress password is the only thing standing between a stranger and your whole website. If it leaks in someone else’s data breach, gets reused from an old account, or is typed into a fake login page, whoever has it can sign in as you, with access to your content, your customer data and your forms.
Two-factor authentication closes that gap. It takes a few minutes per person to set up. The part people skip, and later regret, is planning for the day someone loses their phone.
What two-factor authentication actually does
Two-factor authentication, usually shortened to 2FA, means a login needs two different things: something you know (your password) and something you have (usually your phone, sometimes a physical key). After the password is accepted, WordPress asks for that second proof before letting you in.
So a stolen password is no longer enough. Someone on the other side of the world might have your password from a breached list, but they do not have your phone. That is why, in our post on WordPress brute-force attacks, 2FA came out as the strongest single protection for administrator accounts. Even a script that eventually guesses the right password still hits a wall.
WordPress does not include 2FA out of the box. You add it with a plugin. Well-known options include Two Factor (built by WordPress contributors), WP 2FA, and the login security features in Wordfence and other security plugins. If you already run a security plugin, look through its settings first. It may have 2FA you have not switched on.
The options, and which to choose
Most 2FA plugins offer some mix of these. They are not equally strong.
| Method | Good for | Watch out for |
|---|---|---|
| Authenticator app | Most administrators. The sensible default. | Replacing the phone without moving the codes across |
| Email code | Staff who will not install an app | Only as safe as the email account, and useless if your site’s email is unreliable |
| Security key or passkey | Owners who want the strongest protection | Plugin support varies, and you need a backup method |
Authenticator apps
An app on your phone shows a six-digit code that changes every 30 seconds. Google Authenticator and Microsoft Authenticator both work, and so do password managers such as Bitwarden and 1Password. You scan a QR code once during setup. After that the phone needs no signal or data to produce codes, which is handy when travelling.
One quirk: the codes depend on your phone’s clock. If the time has been set manually and drifted, correct codes get rejected. Switching the phone to automatic time fixes it.
Email codes
WordPress emails you a one-time code at each login. It is better than nothing, and easy for people who find apps confusing, but it has two weaknesses. Anyone who gets into your email account gets both factors at once. And many WordPress sites send email badly, so codes arrive late, land in spam or never arrive. If you plan to rely on email codes, fix your site’s mail first. Our guide to WordPress not sending emails covers the usual cause.
Hardware keys and passkeys
A small USB or NFC key, or a passkey stored on your phone or computer, confirms it is you. These are the hardest to phish, because they check the real website address before responding, so a fake login page cannot trick them. Plugin support is less consistent than for authenticator apps. Treat them as an extra for the site owner rather than something to roll out to everyone on day one.
Some plugins also offer text-message codes. These are generally considered the weakest option, because a phone number can be hijacked by persuading a mobile carrier to move it to a new SIM. Use an app if you can.
How to turn it on for administrators
The screens differ between plugins, but the process is the same.
- Take a backup first. You are changing how people log in, so keep a way back.
- Install one 2FA plugin. Only one. Two plugins fighting over the login form can lock everyone out.
- Set it up on your own account first. This is usually under Users, then Profile, or in the plugin’s own menu. Scan the QR code with your app and enter the code it shows.
- Save your backup codes straight away.
- Test in a private browser window while staying logged in on the first one. If the new login works, you are set. If not, you still have a way in to fix it.
- Require it for the right roles. Most plugins let you make 2FA mandatory per role, often with a grace period so people set it up at their next login instead of being locked out.
One detail worth knowing: WordPress has application passwords, which let apps and services connect without the normal login form. Because they skip that form, 2FA does not apply to them. Check each administrator’s profile and revoke any you do not recognise or no longer use.
Backup codes, and what to do if you lose your phone
Most plugins give you a set of backup codes when you enable 2FA. Each works once, in place of an app code. Keep them in your password manager, or print them and store them with your important papers. Not in a note on the same phone that runs your authenticator app.
If you lose your phone, work through these in order:
- Use a backup code to log in, set up 2FA on the new phone, and generate fresh codes.
- Check whether your app synced. Some authenticator apps and password managers back up codes to your account, so they reappear on a new phone. Find out whether yours does before you need it.
- Ask another administrator to reset 2FA on your account, which most plugins allow from the user’s profile. This is a good reason to have at least two administrators, each with their own login.
- As a last resort, use your hosting access. Someone with file access can disable the plugin by renaming its folder inside wp-content/plugins. That switches 2FA off for everyone, so log in, rename the folder back, reactivate the plugin and set 2FA up again straight away.
When you replace a phone on purpose, move your codes before wiping the old one. It is a two-minute job then, and a much longer one afterwards.
Which users should have it
You do not need to force 2FA on everyone. Ask what each account could do in the wrong hands.
- Administrators: always. An administrator can install plugins, which means running any code on your server. That includes the developer’s account and any agency logins.
- Shop managers and editors: yes. A WooCommerce shop manager can see customer orders and addresses. An editor can change or publish any page, spam links included.
- Authors and contributors: lower priority. Their reach is smaller, but a hijacked author account can still publish under your name.
- Customers and subscribers: usually optional. Forcing 2FA on shoppers mostly adds friction at checkout. Offering it is enough for most stores.
Before you require it, tidy the account list. Delete users who no longer need access and downgrade anyone with more permissions than their work needs. Our WordPress security checklist for small businesses walks through that clean-up.
WordPress is not the only login that matters. Your hosting control panel, domain registrar and the email account tied to your site can each be used to take the website over, and most offer 2FA in their account settings. Switch it on there too. Our website security best practices guide covers those accounts alongside the rest.
A quick check once it is on
- Every administrator has 2FA set up, not just you.
- Backup codes are stored somewhere other than the phone.
- At least two people can reset 2FA if one is locked out.
- Unused application passwords are revoked.
- Hosting, domain and email accounts have 2FA too.
If you would rather have someone set this up and check the rest of your login security at the same time, our website security audit and hardening starts from ₹1,999. We go through user accounts, login protection and the other usual weak points, and show you what we found before changing anything.
Next in this series: "This Site May Be Hacked" in Google: How to Clear It
