Quick answer: Two-factor authentication (2FA) asks for a second proof of identity after the password, usually a six digit code from an app on your phone. WordPress does not include it out of the box, so you add it with a plugin such as Two Factor, Google Authenticator, Duo Two-Factor Authentication or the 2FA feature in a security suite. Install the plugin, turn it on for administrators first, have each user scan a QR code with an authenticator app, save backup codes somewhere safe, and test logging in before you enforce it for everyone.
Brute force attacks on WordPress login pages are constant. Bots try common usernames and passwords on thousands of sites every day, and passwords reused from other breached sites make their job easier. Two-factor authentication means a stolen or guessed password is not enough to get in.
How two-factor authentication works
Authentication factors fall into three groups:
- Something you know: a password.
- Something you have: a phone, a hardware key or a code sent to you.
- Something you are: a fingerprint or face.
Two-factor authentication combines two of them. For WordPress, that almost always means a password plus a code from your phone.
Choosing a method
Authenticator apps (time based codes)
Apps such as Google Authenticator, Authy and similar tools generate a new six digit code every 30 seconds. You link the app to your WordPress account once by scanning a QR code. After that, it works without a signal or internet connection.
This is the method we recommend for most sites. It is free, reliable and does not depend on text message delivery.
Text message codes
A code is sent to your phone by SMS when you log in. It is familiar and easy for less technical users, but it relies on mobile signal and on a paid text service. It is also considered less secure than app codes, because text messages can be intercepted or redirected.
Email codes
A code is sent to your email address. Better than nothing, but if your email account is compromised, so is your second factor.
Push approval
Services such as Duo send a notification to your phone, and you tap to approve the login. Very convenient, but it relies on a third party service.
Hardware keys
Physical USB keys using the FIDO U2F standard offer strong protection. Support in WordPress plugins is still limited, and browser support is mainly in Chrome. Worth watching, especially for high value sites.
QR code sign in services
Clef lets users sign in by scanning a moving pattern with their phone, replacing the password altogether for those users. It is easy to use but makes you dependent on the service.
Plugin options
There are several solid choices. Test on a staging site before installing on a live site.
- Two Factor: a free plugin being developed by WordPress contributors as a possible future core feature. It supports authenticator apps, email codes, backup codes and FIDO U2F keys.
- Google Authenticator: a long standing free plugin that adds authenticator app codes to the login screen.
- Duo Two-Factor Authentication: connects WordPress to Duo’s service, with push approval, codes and phone calls. Free for a small number of users.
- Security suites: iThemes Security Pro includes two-factor authentication, and Wordfence offers sign in by text message as part of its premium plan. Useful if you already use these tools. Our comparison of Wordfence vs Sucuri looks at security plugins more broadly.
- Jetpack: if you sign in through WordPress.com accounts with Jetpack’s single sign on, you can use two-step authentication on your WordPress.com account.
When choosing, check that the plugin is actively maintained, works with your WordPress version and supports backup codes.
Setting it up
The exact steps vary by plugin, but the process is similar. Here is the general approach using an authenticator app.
1. Back up the site
Take a full backup before installing any login related plugin.
2. Install and activate the plugin
Install from Plugins, then Add New, and activate it.
3. Set it up for your own account
Go to your profile page under Users. The plugin will add a two-factor section. Choose the authenticator app option.
4. Scan the QR code
Open the authenticator app on your phone, add a new account and scan the QR code shown on screen. The app will start showing codes for your site.
5. Confirm the code
Enter the current code from the app to confirm the setup. Save your profile.
6. Save backup codes
Generate backup codes if the plugin offers them. Store them in a password manager or a safe place away from your phone. They are your way in if your phone is lost.
7. Test
Open a private browser window and log in. You should be asked for a code after your password. Keep your original session open until you are sure it works.
8. Roll out to other users
Start with administrators and editors, who can do the most damage if their accounts are taken over. Then decide whether to require it for all users who can publish content. Many plugins let you enforce 2FA by user role.
Helping users through it
Write a short guide for your team:
- Which app to install.
- Where to find the setup option.
- What to do if they get a new phone.
- Who to contact if they are locked out.
Set a date by which everyone must have it set up, and check that they have.
Avoiding lockouts
Getting locked out is the main worry with 2FA. Plan for it:
- Backup codes for every user.
- More than one administrator, so one can reset another.
- Correct server time. Time based codes depend on the server clock. If it drifts, codes fail.
- Recovery by file access. If all else fails, renaming the plugin’s folder over FTP or SFTP disables it, allowing a normal login. Make sure someone has hosting access.
2FA as part of wider login security
Two-factor authentication is one layer. Combine it with:
- Strong, unique passwords for every account, stored in a password manager.
- No “admin” username. It is the first one bots try.
- Limiting login attempts to slow down brute force attacks.
- HTTPS on the login page, so passwords and codes are encrypted. Our guide to Let’s Encrypt explains free certificates.
- Removing unused accounts, such as old staff or contractors.
- Keeping WordPress, themes and plugins updated.
Our WordPress security guide covers the full picture.
FAQ
Will two-factor authentication slow down logging in?
It adds a few seconds. Many plugins let you mark a device as trusted for a set period, so you are not asked every time.
What happens if I lose my phone?
Use a backup code to log in, then set up the authenticator app again on your new phone. If you have no backup codes, another administrator can reset your 2FA, or someone with hosting access can disable the plugin.
Do customers on my shop need 2FA?
Usually not. Focus on accounts that can change the site: administrators, editors and shop managers. Offering it as an option for customer accounts is a nice extra.
Want your WordPress logins locked down?
We set up two-factor authentication, harden login security and look after WordPress sites so problems are stopped early. See how we help businesses turn visitors into customers on sites they can trust.
