How to enable two-factor authentication in WordPress?

Sajjad
WordPress
17 Sep, 2026

To enable two-factor authentication (2FA) in WordPress, install a trusted 2FA plugin such as Two Factor, Wordfence Login Security, or WP 2FA, then open your user profile and connect an authenticator app by scanning a QR code. From then on, logging in requires both your password and a short code from your phone. It takes about five minutes to set up and is one of the most effective ways to protect your admin account.

Passwords get reused, guessed, and leaked in data breaches. Two-factor authentication adds a second check so a stolen password alone isn't enough to get in. This article explains how 2FA works, which methods and plugins to consider, how to set it up step by step, how to enforce it for your team, and what to do if you ever lose access to your second factor.

What Is Two-Factor Authentication?

Two-factor authentication is a login method that requires two different types of proof before granting access:

Something you know: Your password.
Something you have: Usually your phone (with an authenticator app), a hardware security key, or access to your email.

Even if an attacker learns your password through phishing, a data breach, or a brute-force attack, they still can't log in without your second factor. This dramatically reduces the risk of account takeover.

WordPress core doesn't include 2FA out of the box, so you add it with a plugin.

Why Should You Enable 2FA on WordPress?

WordPress login pages are constantly targeted by automated bots trying common passwords. 2FA helps you:

Stop brute-force attacks: Guessing the password isn't enough.
Protect against leaked passwords: If you've reused a password that later appears in a breach, your WordPress site stays safe.
Secure privileged accounts: Administrators and Editors have powerful capabilities, so protecting their accounts protects your whole site.
Meet client or compliance requirements: Many organizations require 2FA for any system handling customer data.
Reduce damage from phishing: Even if someone tricks you into entering your password on a fake page, time-based codes and especially security keys make it far harder to reuse.

2FA works best as part of a broader security setup that includes strong passwords, updates, backups, and limited Administrator accounts.

Types of Two-Factor Authentication

Different 2FA methods offer different trade-offs between security and convenience.

Authenticator apps (TOTP): Apps like Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, or Aegis generate a new six-digit code every 30 seconds. This is the most popular method and works offline. It's a strong, practical choice for most users.

Hardware security keys and passkeys (FIDO2/WebAuthn): Physical keys like YubiKey, or passkeys stored on your phone or computer, let you confirm your login with a tap or biometric check. They offer the strongest protection against phishing. Some WordPress 2FA plugins support them directly or through add-ons.

Email codes: A one-time code is sent to your email address. It's easy to set up but only as secure as your email account, and email delivery can be unreliable on some servers.

SMS codes: A code is sent by text message. It's familiar, but SMS can be intercepted or hijacked through SIM swapping, so it's generally considered weaker than app-based codes. It usually requires a paid SMS service.

Backup codes: A list of single-use codes you generate in advance and store safely. They're not a primary method but are essential for recovery if you lose your phone.

Choosing a WordPress 2FA Plugin

Several well-established plugins add 2FA to WordPress. Here are some of the most widely used:

Two Factor: A free plugin developed by WordPress contributors. It supports authenticator apps (TOTP), email codes, and backup codes, and security keys can be added through companion WebAuthn provider plugins. It's lightweight and focused purely on 2FA.

Wordfence Login Security: The login security module from Wordfence, available as part of Wordfence or as a standalone free plugin. It supports authenticator apps, recovery codes, and optional reCAPTCHA on the login page.

WP 2FA: A free plugin from Melapress with a guided setup wizard and policies for enforcing 2FA by role, plus grace periods for users to set it up. Premium versions add more methods and features.

Solid Security (formerly iThemes Security): A broader security plugin that includes two-factor authentication along with other hardening features. Passkeys and additional features are available in its paid tier.

miniOrange Google Authenticator: Supports multiple 2FA methods, with some advanced options available in paid plans.

When choosing, consider:

Supported methods: At minimum, look for authenticator apps and backup codes.
Enforcement options: Can you require 2FA for specific roles?
Ease of setup for your users: A setup wizard helps less technical team members.
Compatibility: If you use WooCommerce, a membership plugin, or a custom login page, check that the 2FA plugin works with it.
Overlap with existing plugins: If you already run Wordfence or Solid Security, their built-in 2FA may be enough. Avoid running two 2FA plugins at once.

How to Enable 2FA With the Two Factor Plugin

This walkthrough uses the free Two Factor plugin, but the steps are similar for most plugins.

Back up your site: Before changing how logins work, make sure you have a recent backup and access to your hosting control panel or SFTP, in case you need to disable the plugin.
Install the plugin: Go to Plugins > Add New Plugin, search for "Two Factor," click Install Now, and then Activate.
Open your profile: Go to Users > Profile (or click your name in the top-right corner).
Find the Two-Factor Options section: Scroll down to see the available methods.
Enable the Authenticator App (TOTP) method:
- Open your authenticator app on your phone.
- Scan the QR code shown on the profile page, or type in the secret key manually.
- Enter the six-digit code from the app to verify it's working.
Generate backup codes: Enable the Backup Verification Codes method and generate a set of codes. Download or print them and store them somewhere safe, such as a password manager.
Set your primary method: Choose the authenticator app as your primary method.
Save your profile: Click Update Profile.
Test it: Open a private browser window and log in. After entering your password, you'll be asked for a code from your app. Keep your current session open until you've confirmed that the new login works.

How to Enable 2FA With Wordfence Login Security

If you already use Wordfence, you can enable 2FA from its dashboard:

Go to Wordfence > Login Security (or Login Security if you use the standalone plugin).
On the Two-Factor Authentication tab, scan the QR code with your authenticator app.
Download the recovery codes and store them safely.
Enter the code from your app and click Activate.
Under the Settings tab, choose which roles are required to use 2FA and whether to add reCAPTCHA to the login page.

How to Enforce 2FA for Your Team

Setting up 2FA for yourself is a good start, but your site is only as secure as its weakest privileged account. Most sites should require 2FA for at least Administrators and Editors.

With a plugin like WP 2FA:

Go to the plugin's settings page.
Choose to enforce 2FA for all users or specific roles.
Set a grace period so users have a few days to configure 2FA before it becomes mandatory.
Choose what happens when the grace period ends, for example, requiring setup on next login.

Wordfence Login Security and Solid Security offer similar role-based enforcement. The free Two Factor plugin doesn't include a built-in enforcement setting, but developers can add enforcement with code or companion plugins.

Tips for Rolling Out 2FA to Users

Communicate first: Tell your team why 2FA is being introduced and when it becomes required.
Share simple instructions: Recommend a specific authenticator app and include screenshots if possible.
Emphasize backup codes: Many lockouts happen when someone gets a new phone and hasn't saved their backup codes.
Offer help: Be available to assist users who get stuck during setup.

What About Passkeys?

Passkeys are a newer, passwordless login method based on the WebAuthn standard. Instead of typing a code, you confirm the login using your device's fingerprint reader, face recognition, or PIN. Passkeys are resistant to phishing because they're bound to your site's domain.

Several WordPress security plugins now offer passkey support, either as a second factor or as a way to replace passwords entirely. If your plugin supports them, passkeys are an excellent option for Administrators. Keep a backup method, such as an authenticator app or backup codes, in case you lose access to your device.

Protecting Other Login Points

2FA secures the standard login form, but WordPress has other ways to authenticate:

XML-RPC: An older API that some attackers use to try passwords in bulk. If you don't use it (for example, for the legacy mobile app or Jetpack features that rely on it), consider disabling it. Many security plugins offer a toggle, or you can use the xmlrpc_enabled filter:

add_filter( 'xmlrpc_enabled', '__return_false' );

Add this to a small custom plugin or your child theme's functions.php.

Application Passwords: These let external apps access the REST API and bypass 2FA by design, since they're meant for machine access. Only create them when needed, give them clear names, and revoke any you no longer use from the user's profile page.
Custom login forms: If your site uses WooCommerce, a membership plugin, or a page builder login form, confirm your 2FA plugin supports those forms too.

What to Do If You Get Locked Out

Losing your phone or deleting your authenticator app can lock you out. Here's how to regain access.

Use a Backup Code

If you saved backup codes, choose the option to use a backup code on the 2FA screen and enter one. Each code works only once, so generate a new set once you're back in.

Ask Another Administrator

If someone else on the site has Administrator access, they can reset or disable 2FA for your account from your user profile, depending on the plugin.

Disable the Plugin via SFTP or File Manager

If you're the only Administrator and have no backup codes:

Connect to your server with SFTP or your host's file manager.
Navigate to wp-content/plugins/.
Rename the 2FA plugin folder, for example, two-factor to two-factor-disabled.
Log in with just your username and password.
Rename the folder back, reactivate the plugin if needed, and set up 2FA again with a new device.

Disable the Plugin With WP-CLI

If you have SSH access, this is even faster:

wp plugin deactivate two-factor

Replace two-factor with the slug of the plugin you use, such as wordfence-login-security or wp-2fa. Some plugins also provide their own WP-CLI commands to reset 2FA for a specific user, so check the plugin's documentation.

Best Practices for WordPress 2FA

Use an authenticator app or security key rather than SMS whenever possible.
Store backup codes securely, ideally in a password manager.
Enforce 2FA for all privileged roles, especially Administrators and Editors.
Keep your 2FA plugin updated, just like any other plugin.
Combine 2FA with strong, unique passwords generated by a password manager.
Limit login attempts with a security plugin to slow down brute-force bots.
Review user accounts regularly and remove any that are no longer needed.
Test after major changes, such as switching themes, changing login plugins, or migrating hosts.

FAQ: Two-Factor Authentication in WordPress

No. WordPress core doesn't include 2FA, but you can add it easily with plugins like Two Factor, Wordfence Login Security, WP 2FA, or Solid Security.

Any app that supports TOTP codes works, including Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and Aegis. Choose one that fits your device and backup preferences.

SMS is better than no 2FA, but it's vulnerable to SIM swapping and interception. Authenticator apps, passkeys, and hardware security keys are stronger options.

Yes. Plugins like WP 2FA, Wordfence Login Security, and Solid Security let you enforce 2FA for specific roles, such as Administrators and Editors, while keeping it optional for others.

Use one of your saved backup codes to log in, then set up 2FA on your new device. If you have no backup codes, disable the 2FA plugin via SFTP, your file manager, or WP-CLI.

Only if you require it for their roles. Most sites enforce 2FA for staff accounts and leave it optional for customers or subscribers to avoid adding friction.

No. 2FA only adds a step during login and has no noticeable effect on how quickly pages load for visitors.

Conclusion

Enabling two-factor authentication in WordPress is one of the simplest and most effective security upgrades you can make. With a trusted plugin and an authenticator app, you add a second layer of protection that stops most automated attacks and makes stolen passwords far less dangerous.

Start by securing your own Administrator account, save your backup codes somewhere safe, and then roll out 2FA to everyone with elevated access. Pair it with strong passwords, regular updates, and careful user management, and your WordPress login will be much harder for attackers to break.