With two-factor authentication (2FA), logging in needs your password plus a short code from your phone. A stolen or guessed password alone is no longer enough, which stops the vast majority of account takeovers. Setting it up takes about five minutes per user.
Before you start
- An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, Authy, or the one built into your password manager.
- Administrator access to WordPress, and cPanel access as a fallback in case you lock yourself out.
Choose a plugin
| Plugin | Notes |
|---|---|
| Two Factor | Lightweight, maintained by WordPress contributors; authenticator app, email codes, backup codes, security keys |
| Wordfence Login Security | Standalone login module of Wordfence; authenticator app, backup codes, role-based enforcement |
| Security suites (Solid Security, AIOS and others) | Include 2FA among many features; use if you already run one |
Use one 2FA solution only. This guide uses the Two Factor plugin; others work similarly.
Set up 2FA for your account
- Go to Plugins → Add New, search Two Factor, install and activate it.
- Open Users → Profile and scroll to Two-Factor Options.
- Tick Authenticator App. A QR code appears.
- Scan it with your authenticator app, then enter the six-digit code the app shows to confirm.
- Tick Backup Verification Codes, generate the codes and store them in your password manager or print them.
- Set the authenticator app as the primary method and click Update Profile.
Log out and in again to test: after your password, WordPress asks for the code.
Require 2FA for administrators
A plugin only protects users who enable it. Ask every administrator and editor to set it up, or use a plugin with enforcement (Wordfence Login Security can require 2FA per role under Login Security → Settings). At minimum, every account that can install plugins should use 2FA.
Email codes: better than nothing
Email-based codes are weaker than an app because they depend on the security of the mailbox and on reliable mail delivery. If you use them, make sure WordPress mail is sent via SMTP so codes arrive quickly.
Security keys and passkeys
Hardware security keys (FIDO2/WebAuthn) are the strongest option and are supported by several 2FA plugins. They are a good choice for agency staff and site owners managing many sites.
Lost your phone?
- Log in with one of your backup codes.
- If you have no backup codes, open cPanel → Files → File Manager and rename the plugin's folder in
wp-content/plugins, for exampletwo-factortotwo-factor-off. 2FA is disabled and you can log in with your password. - Rename the folder back, then set up 2FA again with your new phone.
With WP-CLI you can also deactivate it: wp plugin deactivate two-factor.
Protect cPanel too
Your WordPress site is only as safe as the hosting account. Enable 2FA for cPanel in cPanel → Security → Two-Factor Authentication and for your MdmHost client account.
Troubleshooting
- Codes always rejected: the phone's clock is wrong. Enable automatic time on the phone.
- 2FA prompt does not appear: a cached login page; exclude
wp-login.phpfrom caching and purge. - Application or app login broken: use application passwords from Users → Profile → Application Passwords for tools that cannot handle 2FA.