How to Enable Two-Factor Authentication on WordPress

TTS

By tipsnsolution · September 13, 2026 · 2 min read · Tutorials

Two-factor authentication (2FA) adds a second step to login — usually a six-digit code from your phone. Even if someone steals or guesses your password, they cannot get in without that code. It is the single most effective security improvement you can make to a WordPress site.

How it works

After entering your password, you enter a time-based code from an authenticator app (Google Authenticator, Microsoft Authenticator, Authy or 1Password), or approve a prompt. The code changes every 30 seconds, so a stolen password alone is useless.

Step 1: Install a 2FA plugin

Go to Plugins → Add New and install Two Factor (maintained by the WordPress security team), Wordfence Login Security or WP 2FA. Activate it.

Step 2: Set up your own account first

Go to Users → Profile (or the plugin’s settings page) and find the two-factor section. Choose your method — Time-based one-time password (TOTP) with an authenticator app is the best balance of security and convenience.

A QR code appears. Open your authenticator app, tap Add account / Scan QR code, and scan it. The app starts showing six-digit codes.

Step 3: Verify and save

Enter the current code from the app into the confirmation field and click Submit or Save. If it is rejected, the most common cause is that your phone’s clock is out of sync — enable automatic date and time in your phone settings.

Step 4: Save your backup codes

This is the step people skip and later regret. The plugin generates one-time backup codes. Download and print them, or store them in your password manager. If you lose your phone and have no backup codes, you may be locked out of your own site permanently.

Step 5: Set up a second admin user

Before enforcing 2FA on everyone, create a second administrator account with 2FA configured and test that you can log in with it. If your main account is ever locked, this is your way back in.

Step 6: Enforce it for all privileged users

In the plugin settings, require 2FA for the Administrator, Editor and Author roles. Anyone who can publish or change settings should be protected — a compromised editor account is enough to inject spam or malware.

Give your team a deadline and simple instructions. Most plugins show a reminder on login until 2FA is enabled.

Step 7: Test the whole flow

Log out and log back in with password plus code
Test a backup code works
Log in from a second device
Confirm the codes still work after an hour (the time-based window can reveal a clock problem)

Optional extras

Email codes — weaker than TOTP, but better than nothing; useful as a fallback
Physical security keys (YubiKey) — the strongest option, resistant to phishing
Remember this device for 30 days — convenient on trusted machines; avoid on shared computers
Limit login attempts and change the login URL to reduce brute-force noise

If you get locked out

Use a backup code. If those are gone, use your second admin account, or ask your host to disable the plugin by renaming its folder in wp-content/plugins via File Manager or FTP.

While you are at it

2FA protects the login form. Also keep WordPress, themes and plugins updated, delete unused plugins and themes, use unique passwords for every account, and keep automatic backups — security is layered, not a single switch.

TTS

tipsnsolution · Tips and Solution

Writing about tech deals, coupons and practical solutions. Every article here is tested before it's published — no fluff, no filler, just what works.