How to Enable Two-Factor Authentication for Your WordPress Login

Two-factor authentication (2FA) adds a second step to your WordPress login: after you enter your password, you also need a one-time code from your phone. If someone steals or guesses your password, they still can't get into your site without that code. Setting it up takes about ten minutes.

Before You Start

You'll need an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, or Authy. These are free and available for both Android and iPhone. You'll also need admin access to your WordPress dashboard (wp-admin).

Step 1: Install a 2FA Plugin

1. Log in to your WordPress dashboard and go to Plugins > Add New Plugin.
2. Search for a two-factor authentication plugin. Several well-maintained free options exist in the official WordPress Plugin Directory, such as "Two-Factor" or "WP 2FA".
3. Click Install Now, then Activate.

Stick to plugins with a large number of active installs and recent updates in the WordPress Plugin Directory. An outdated or abandoned security plugin can itself become a weak point.

Step 2: Set Up Your Authenticator App

1. After activating the plugin, go to your Users > Profile page (or the settings page the plugin adds).
2. Find the two-factor authentication section and choose the option to set up an Authenticator App.
3. The plugin will display a QR code. Open your authenticator app, choose Scan QR Code, and point your camera at it.
4. Your app will start generating a 6-digit code that changes every 30 seconds. Enter the current code into the plugin's setup field to confirm the pairing.
5. Click Save or Enable to turn on 2FA for your account.

Step 3: Save Your Backup Codes

Most 2FA plugins generate a set of one-time backup codes when you enable the feature. Each code can be used once to log in if you lose access to your phone.

Save your backup codes somewhere safe outside your website, such as a password manager or a printed copy in a locked drawer. If you lose your phone and don't have a backup code, you may need to ask your hosting provider's support team to help you regain access to your dashboard.

Step 4: Test It

1. Log out of WordPress.
2. Log back in with your username and password as usual.
3. You should now be prompted for a code from your authenticator app before you're let into the dashboard.

Step 5: Require It for All Admin Users

A single unprotected admin account undoes the benefit of 2FA. Most 2FA plugins include a setting under their main configuration page (often called something like Enforcement or Policies) that lets you require two-factor authentication for specific roles, such as Administrator and Editor. Enable this so the requirement isn't optional per user.

Two-factor authentication works best alongside other basic protections for your WordPress login. See how to limit login attempts and protect your WordPress login from brute-force attacks for another layer of defense.