Setting up two-factor authentication for WordPress
With two-factor authentication (2FA), you need something besides your password when you log in: usually a six-digit code from an app on your phone. That means someone who has your password still can't get into your site's admin area. WordPress doesn't have this built in, so you add it with a plugin. Here's how it works, and what to do if you lose your phone.
Which plugin?
There are lots of plugins for two-factor authentication, and many security plugins include it too. A simple one is Two Factor, made by contributors to WordPress itself. We'll use it as the example below; other plugins work in a similar way. When choosing, check for:
- support for an authenticator app (codes based on the TOTP standard);
- backup codes in case you lose your phone;
- whether you can make two-factor authentication mandatory for administrators. Two Factor can't do this itself: each user turns it on in their own profile;
- whether the plugin is still being updated and has been tested with your version of WordPress.
Use just one. If you already have a security plugin with two-factor authentication, turn it on there.
Setting it up with Two Factor
- Install and activate the plugin via Plugins > Add New Plugin.
- Go to Users > Profile and scroll to the two-factor authentication section.
- Choose the authenticator app. Scan the QR code with the app on your phone and enter the code to verify.
- Generate backup codes. These are ten codes you can each use once. Store them in your password manager or on paper, not just on your phone.
- Set the app as your default method and click Update Profile.
- Log out and back in to check that it works.
Have every other administrator and editor do the same in their own profile. A site is only as strong as its weakest admin account.
Lost phone or new phone
- New phone: transfer the app before you wipe your old phone, or set up the app again in your profile.
- Lost phone: log in with one of your backup codes and then set up the app again. Generate new backup codes as well.
- No backup codes left: another administrator can turn off two-factor authentication for your account under Users. If you're the only administrator, temporarily disable the plugin. You'll find how to do that in step 3 of I can't log in to WordPress: what now? Log in, set up the app again and re-enable the plugin.
Passkeys
With a passkey, you log in with your fingerprint, your face or a security key. A passkey only works on the real site, so a fake site can't intercept it. Two Factor itself doesn't support passkeys; there's a separate add-on plugin for that, and other plugins have it built in. You can read more about passkeys in Password managers and passkeys: how to log in securely.
What else to watch out for
- Application passwords (under Users > Profile) are meant for apps and integrations and can bypass the second step. Only create them when needed, and revoke them when you no longer use the integration.
- Two-factor authentication doesn't replace a good password. Use a long, unique password from a password manager.
- Restrict the login page itself too: see Securing WordPress's wp-login.php and Extra WordPress security: permissions, wp-config and .htaccess.
Around your site, too
An intruder who takes over your hosting panel or your mailbox doesn't need your WordPress password. So turn on two-factor authentication on these as well:
- My WebOké: Setting up two-factor authentication in My WebOké with an authenticator app;
- DirectAdmin: Setting up Two-Step Authentication;
- your mailbox and your password manager.
Further reading
- Logging in securely (Veilig Internetten, Dutch government, in Dutch)
- Brute force attacks (developer.wordpress.org)
Want to learn more? Take the free WordPress course, lesson 7.3 Logging in: passwords, two-factor authentication and brute force.