Two-factor authentication (2FA) means logging in needs something you know (your password) plus something you have (a phone app code, a security key, or a passkey). Even if a password is leaked, phished or guessed, an attacker can’t log in. For WordPress administrators and editors, 2FA is one of the most effective security measures you can add.

Types of second factor

Method Security Convenience Notes
Passkeys / security keys (WebAuthn) Highest (phishing-resistant) High Face ID, Windows Hello, YubiKey
TOTP authenticator app High Good Google Authenticator, Authy, Aegis, Bitwarden, 1Password
Email codes Medium Good Only as strong as the email account; needs working mail
SMS Lower Good SIM-swap risk; usually needs a paid service
Backup codes — — One-time recovery codes. Always generate and store them

Use a TOTP app or passkeys for admins. Email codes are acceptable for lower-privilege users.

Plugin options

  • Two Factor (by WordPress contributors): lightweight, TOTP, email, backup codes, and FIDO/security keys via an add-on.
  • WP 2FA (Melapress): setup wizard, policies to enforce 2FA by role, grace periods.
  • Wordfence Login Security: TOTP 2FA, reCAPTCHA. Can be used without the full Wordfence plugin.
  • Solid Security, miniOrange and others include 2FA.
  • Passkey plugins (for example Secure Passkeys, or 2FA plugins with WebAuthn support) for passwordless or second-factor passkeys.

Pick one plugin. Don’t stack several 2FA plugins.

Setting up TOTP (example)

  1. Install and activate your chosen 2FA plugin.
  2. Go to Users → Profile (or the plugin’s setup wizard).
  3. Scan the QR code with your authenticator app.
  4. Enter the 6-digit code to confirm.
  5. Generate backup codes, and store them somewhere safe (a password manager, or printed).

From now on, after your password, WordPress asks for the current code from the app.

Enforce 2FA for privileged roles

Making 2FA optional means the accounts that need it most often skip it. Use a plugin with policies:

  • Required: Administrator, Editor, Shop Manager (WooCommerce).
  • Optional: Authors, Contributors.
  • Grace period: a few days for existing users to set it up.

Server time matters

TOTP codes depend on the current time. If the server clock drifts, valid codes are rejected. Keep time synced:

timedatectl
sudo timedatectl set-ntp true

See NTP time sync with chrony.

Lost your phone? Recovery options

  1. Backup codes: enter one instead of the app code.
  2. Another admin can reset your 2FA in your user profile (most plugins allow this).
  3. WP-CLI: deactivate the plugin temporarily, log in, set 2FA up again, and re-activate:
wp plugin deactivate two-factor
# log in, then
wp plugin activate two-factor

Some plugins also store per-user 2FA settings in user meta that you can delete with wp user meta delete <id> <key>. Check the plugin’s documentation. See WP-CLI guide.

2FA is one layer, not all of them

Combine it with:

  • strong, unique passwords (use a password manager);
  • login rate limiting and Fail2ban;
  • blocking xmlrpc.php (it can bypass some 2FA plugins’ login screens). See disable XML-RPC;
  • application passwords for the REST API (built into WordPress) instead of real passwords for integrations;
  • regular updates and backups. See WordPress hardening.

SSO alternative for teams

If your team already uses an identity provider (Google Workspace, Microsoft Entra ID, Authentik, Keycloak), an OpenID Connect / SAML plugin can move WordPress logins there, with 2FA enforced centrally. See Authentik.

Quick reference

Task How
Best factor Passkeys/security keys, or a TOTP app
Enforce for admins Plugin policy (e.g. WP 2FA)
Recovery Backup codes; another admin; WP-CLI deactivate
TOTP codes rejected Check server time sync
Integrations Application passwords

Related: reset the WordPress admin password and WordPress user roles.

  • WordPress
  • Security
  • 2FA