How to set up two-factor authentication in WordPress
Install the Two Factor plugin, turn on an authenticator app and backup codes in your profile, and test the login before you close the window you are in. Keep the backup codes away from your phone. They are how you get back in when the phone is lost.
- By
- WP Ministry
- Updated
In short
- Two-factor login asks for a second proof after the password, so a stolen password alone no longer opens the dashboard.
- Start with an authenticator app, and turn on backup codes in the same sitting.
- Keep the backup codes somewhere other than the phone that runs the app.
- The Two Factor plugin has no setting that makes a role use it. Each administrator sets it up, and you check that they have.
- A lost phone is recoverable with a backup code, another administrator or WP-CLI.
A password is one thing to steal. It can be guessed, reused from another site, or typed into a fake login page. Two-factor authentication, often shortened to 2FA, asks for a second proof after the password: something you have, such as a code from your phone. Someone who holds only the password is stopped at the second step.
The steps below use Two Factor, a free plugin from the WordPress.org directory. The last section is how you get back in when the phone is gone. Read it before you need it.
Which second step to use
| Second step | What you need at login | What to know |
|---|---|---|
| A code from an authenticator app | Your phone, with an app such as Google Authenticator, Authy or 1Password | The app and the site each work out the same six-digit code from the time and a secret they share. Nothing is sent to the phone, so it works with no signal. Lose the phone and you lose the codes, which is what backup codes are for. |
| A passkey or a security key | The device or hardware key that holds it | It is tied to your site's own address, so a fake login page cannot use it. With Two Factor it needs a second plugin. |
| A code sent by email | Your mailbox | It is only as safe as the mailbox, and it fails whenever the site cannot send email. |
| Backup codes | A saved list of codes, each of which works once | They are for emergencies, and they are no help if the only copy is on the phone you lost. The Two Factor plugin's screens call them "Recovery Codes". |
Any code that you type, from an app or an email, can be typed into a fake login page by mistake and used by whoever runs it. A passkey does not have this weakness, because the browser will not offer it to a site at a different address.
Start with an authenticator app and backup codes. The plugin's own listing marks those two as recommended. Use email codes only as a fallback, and only if email from the site arrives reliably. If it does not, see what to do when WordPress is not sending email.
Set it up with the Two Factor plugin
Two Factor is listed in the plugin directory as by WordPress.org. It offers an authenticator app, email codes and backup codes, which its screens call "Recovery Codes". Other two-factor plugins are in the directory too. These steps are for this one.
Step 1: Install and activate Two Factor
On the Plugins screen, add a new plugin and search for Two Factor. Check that the one you install is listed as by WordPress.org, then install and activate it.
Step 2: Open your profile
Go to Users, then to your own profile. Scroll down to the section headed "Two-Factor Options".
Step 3: Turn on the authenticator app
Enable the authenticator app method. The page shows a QR code. Open the app on your phone, add a new account, scan the code and follow what the page asks next.
Step 4: Turn on recovery codes
Under "Recovery Codes", the plugin's name for backup codes, tick "Enable Recovery Codes" and select "Generate new recovery codes". The plugin makes ten, and each one works once. Copy them now, with "Copy Codes" or "Download Codes": the page says you will not be able to view them again once you leave it.
Step 5: Choose the primary method and save
Set the authenticator app as the primary method, the one the login asks for by default. Then select "Update Profile".
Step 6: Test the login in a private window
Open a private window and log in with your username and password. WordPress should now ask for a code. Enter the one your app shows. Then log out, log in again, and this time select "Use a recovery code" on the code screen, so that you know the codes work. That code is now used up.
With WP-CLI, one command installs and activates the plugin. The methods are still set up in your profile, because the app has to scan the QR code.
wp plugin install two-factor --activateKeep the backup codes away from the phone
Backup codes are for the day the phone is lost, broken or replaced. They only help if they are somewhere else.
- Store them in a password manager, or print them and keep the paper with other things that matter. A note or a photo on the same phone does not count.
- Cross off each code as you use it. When few are left, generate a fresh set from your profile and throw the old list away.
- When you change phones, set the app up on the new phone while you still have the old one.
Get every administrator to use it
Your own second step does not protect the site if another administrator still logs in with a password alone.
Two Factor has no setting that makes a role use it. Its listing says so: there are no built-in enforcement settings, and requiring it for a role takes custom code. With this plugin, you ask each person and then check.
- Keep administrators few. Someone who only writes and edits can have the Editor role.
- Have each administrator follow the steps above in their own profile, with their own phone.
- Check what each one has enabled. Go to Users, then All Users, edit the administrator's account and look under "Two-Factor Options". An administrator can change another user's methods there. Email codes need no setup by the user, so you can switch them on for an administrator who has not set up the app yet. Tell them first.
- Decide which methods are allowed. The plugin's page under Settings, then Two-Factor lets you switch a method off for the whole site.
On a store, treat any account that can see orders and customer details the same way.
With WP-CLI, the first command lists the administrators. The second is a command the plugin adds, and it shows what one user has set up. It takes a login, an email address or a user ID.
wp user list --role=administrator
wp two-factor status usernameIf the login itself must refuse an administrator who has not set it up, you need a different two-factor plugin. Look for that setting in its listing, and check whether it is part of the free version.
If you lose your phone
Work down this list and stop at the first step that is open to you.
Step 1: Use a backup code
Log in with your password, select "Use a recovery code" on the code screen and enter one. Once you are in, set up the app on the new phone and generate fresh backup codes.
Step 2: Ask another administrator
They go to Users, then All Users, edit your account, scroll to "Two-Factor Options", uncheck every enabled method and select "Update User". You can then log in with your password alone and set everything up again.
Step 3: Reset your own account with WP-CLI
If you or your host can run WP-CLI on the site, the plugin's own command clears two-factor for one user and leaves everyone else as they were. It asks you to confirm.
bashwp two-factor disable your-usernameStep 4: Switch the plugin off
This is the last resort, for a site with one administrator and no WP-CLI. In your host's file manager or over SFTP, open
wp-content/plugins/and rename the foldertwo-factortotwo-factor-off. WordPress can no longer find the plugin, so nobody is asked for a second step. Log in with your password.
Switching the plugin off does not clear your old settings, and once it is back on it will not let you change your own two-factor options from a login that skipped the second step. So, while it is off, add a second administrator account for yourself. Rename the folder back, and activate the plugin if WordPress has switched it off. Log in as the second administrator and uncheck the methods on your first account, as another administrator would. Then log in as yourself, set up the app and the backup codes, test them, and delete the spare account.
wp plugin deactivate two-factor switches the plugin off in the same way as renaming the folder, but where WP-CLI is available the reset in the third step is the better command. While the plugin is off, every account opens with a password alone, so turn it back on as soon as you are in.
If none of these is open to you, being locked out of your own site is one issue on one site, which is what our one-time fix covers.
Common questions
The code from my app is not accepted. Why?
The code is worked out from the current time, and each one is valid only for a short while, usually 30 seconds. If the clock on your phone is wrong, so is the code. Set the phone's date and time to automatic and try the next code. If it still fails, get in with a backup code and set the app up again from your profile.
Can I get the code by text message instead?
Not with this plugin. Its methods are the authenticator app, email codes and backup codes. Text messages are also a poor way to receive a code: they can be redirected, and a phone number can be moved to another SIM card without your knowledge.
How do I use a passkey or a hardware security key?
Two Factor once supported security keys through an older standard, FIDO U2F, which its listing says was removed when browsers stopped supporting it. For passkeys and hardware keys, the listing points to a separate plugin, WebAuthn Provider for Two Factor, which adds them as one more method inside Two Factor. It has a different author and its own requirements, so read its listing first. Keep backup codes switched on either way.
Does two-factor login make the site secure?
It protects the login and nothing else. An attacker who gets in through a hole in an out-of-date plugin never sees the login page. Updates, backups and the other basics are in the WordPress security guide, and slowing down password guessing is covered in how to protect WordPress from brute force attacks.