Turning on two-factor login
Learn how to set up two-factor authentication on your WordPress site to protect against unauthorized login.
- Time
- 15 minutes
- Difficulty
- Beginner
- You’ll need
- Administrator access · A smartphone with an authenticator app
Two-factor authentication (often called 2FA or two-step login) adds a second layer of security to your WordPress login. Even if someone gets your password, they still can't log in without the second factor. It's one of the most effective security measures you can take.
Quick summary
Install a 2FA plugin like WP 2FA, set it up with an authenticator app on your phone, and enable it for all Administrator accounts. After setup, you'll enter your password plus a short code from your phone each time you log in.
What you'll need
- Administrator access to your WordPress site
- A smartphone with an authenticator app installed
What is two-factor authentication?
When you log in to WordPress normally, you enter one thing: your password. Two-factor authentication requires two things:
- Something you know — your password
- Something you have — a code from your phone (generated by an app)
Even if an attacker guesses or steals your password, they'd also need physical access to your phone. That combination is what makes 2FA so effective.
Step 1: Install an authenticator app on your phone
You'll need an authenticator app. Common options that work with WP 2FA include:
- Google Authenticator
- Authy (offers secure cloud backup of your codes)
- Microsoft Authenticator
Download one from your phone's app store before continuing.
Which app should I use?
Any of the three works well for most people. Whichever you choose, check how it backs up your codes, so you can get them back if you lose your phone. Authy, for example, offers cloud backup.
Step 2: Install a 2FA plugin on WordPress
WordPress doesn't include two-factor authentication out of the box — you need a plugin.
Go to Plugins → Add Plugin in your WordPress dashboard.
Search for "WP 2FA" — it's a widely used, well-maintained option with a straightforward setup.
Install and activate the plugin.
Some security plugins (like Wordfence) also include 2FA as part of their feature set. If you already use Wordfence, you can use that instead of adding another plugin.
Step 3: Set up 2FA for your account
Open the WP 2FA setup wizard. When you first activate the plugin, a setup wizard walks you through it — follow its prompts. You can also start it any time from Users → Profile: scroll to the two-factor authentication settings and click Configure 2FA.
Choose your 2FA method. Select "One-time code via 2FA app" — this is the authenticator app method — and click Next step.
Scan the QR code. Open your authenticator app, tap the option to add a new account, and scan the QR code shown in the wizard. The app will generate your WordPress entry automatically.
Enter the six-digit code shown in your authenticator app: click Continue in the wizard, type the code, then click Validate & Save to confirm the connection is working.
Save your backup codes. If the wizard offers backup codes, generate them. They're one-time-use codes. Write them down or print them and keep them somewhere safe — they let you get back in if you lose access to your phone.
Complete the setup. From now on, logging in to WordPress will require your password plus a code from your app.
Save your backup codes in a safe place
If you lose access to your authenticator app and don't have your backup codes, you could be locked out of your own site. Keep backup codes printed and stored safely — not just on your phone.
Step 4: Require 2FA for all Administrators
One person using 2FA helps. Everyone with Administrator access using it is much better.
In WP 2FA settings, look for a policy option to require 2FA for specific user roles. Enable it for Administrators at minimum. The plugin can also give other users a grace period to set it up themselves.
Logging in with 2FA
After setup, the login process changes slightly:
Enter your username and password as normal.
Open your authenticator app and find your WordPress entry. You'll see a six-digit code.
Enter the code in the Authentication Code field that appears after your password. Each code only works for a short time — if it changes while you're typing, enter the new one.
Click Log in. You're in.
Common questions
I lost my phone — how do I log in?
Use one of your backup codes: on the login screen, click the Use backup code option below the Log in button. After logging in, go to Users → Profile and set up 2FA again with your new phone. This is why saving backup codes matters.
Do all my users need 2FA?
At minimum, all Administrators should use it. For other roles (Editors, Authors), it's a good practice but less critical. The higher the level of access, the more important 2FA becomes.
Can I use SMS text messages instead of an app?
Some plugins offer SMS codes (in WP 2FA, SMS is a Premium feature). However, WordPress's own security documentation warns that SMS is not a secure channel, and points to smartphone apps as the more secure option. We recommend an app.
Will 2FA slow down my login?
You'll add a few seconds to the login process — the time it takes to open your app and type a code. It's a small trade-off for significant security improvement.
Related guides
- WordPress security basics
- Two-factor authentication explained
- How to create strong passwords
- Using an authenticator app
- WordPress user roles explained
- Help, I can't log in
Need a hand?
Learn more
Last updated
WordPress security basics
A practical guide to the most important security steps for WordPress site owners — without requiring technical knowledge.
Dealing with spam comments
Learn how to handle spam comments on your WordPress site — how to block them, moderate them, and keep your comment section clean.