Two-factor authentication, usually shortened to 2FA, is the single highest-impact security upgrade you can make to a WordPress site. It stops virtually all password-based attacks, including the constant brute-force traffic every WordPress site receives just by existing on the public internet. Setting it up takes about 10 minutes from start to finish. There’s genuinely no good reason not to do it today.
What 2FA actually is
Two-factor authentication requires two separate things before you can log in:
- Something you know, which is your password.
- Something you have, which is your phone or a physical hardware key.
The “something you have” usually means a 6-digit code generated by an app, refreshing automatically every 30 seconds. Even if an attacker steals your password outright, they still can’t log in without that second factor in hand.
Why it matters more than people think
Brute-force attacks against WordPress sites happen constantly and never really stop. Automated bots try common passwords against every WordPress site they can find, around the clock. Without 2FA, one unlucky password match hands over full admin access instantly.
With 2FA enabled, that password match alone isn’t enough anymore. The attacker also needs your phone, and they almost never have it.
According to OWASP’s own Multifactor Authentication Cheat Sheet, MFA is by far the best defense against the majority of password-related attacks, and Microsoft’s own analysis found it would have stopped roughly 99.9 percent of account compromises. That’s about as close to a security silver bullet as this field ever gets.
The plugins
1. Two Factor (free)
Maintained by contributors closely aligned with WordPress core, and generally considered the closest thing to what native core 2FA would eventually look like. Solid, minimal, and free, available directly from the official Two Factor plugin page on WordPress.org.
It supports authenticator apps, email codes, and FIDO U2F security keys.
2. Wordfence Login Security (free)
A free standalone plugin from Wordfence. You don’t need the full Wordfence security suite installed to use just this piece.
It supports authenticator apps and also includes brute-force login protection as a bonus.
3. WP 2FA (free and paid)
More configurable than most alternatives. The Pro version adds email-based 2FA, role-based requirements, and additional configuration options beyond the free tier.
4. Solid Security (formerly iThemes Security)
If you already run Solid Security as your main security plugin, it includes 2FA built right in. Configure it from within that plugin rather than adding a separate one.
5. Wordfence (full plugin)
If you’re running the full Wordfence plugin, 2FA is already built in. Configure it under Wordfence, then Login Security.
The general recommendation is the standalone Two Factor plugin if you want a minimal install, or whichever option your existing security plugin already offers.
The authenticator app on your phone
You’ll need an authenticator app installed on your phone. A few solid options:
- Google Authenticator. Free and simple. Older versions lacked cloud backup, though recent versions have added it.
- Authy. Free, with cloud backup of your 2FA codes built in, so changing phones doesn’t mean losing access to everything.
- 1Password. Built directly into the 1Password password manager, which is convenient if you already use it daily.
- Bitwarden. Built into Bitwarden’s password manager, available on its premium tier.
Authy is the most commonly recommended free option specifically because of that backup feature.
Setting it up
Step 1: Install the 2FA plugin
Go to Plugins, then Add New, and search for “Two Factor” or whichever plugin you’ve chosen. Click Install, then Activate.
Step 2: Open your user profile
Go to Users, then Your Profile. Scroll down to the Two-Factor Options section, which the plugin adds automatically.
Step 3: Enable the authenticator app option
Check the box for “Time Based One-Time Password (Authenticator app).” A QR code appears on screen once you do.
Step 4: Scan the QR code with your authenticator app
Open Authy or Google Authenticator, choose to add a new account, and scan that QR code. The app immediately starts generating fresh 6-digit codes for your WordPress site.
Step 5: Enter the current code
Type the current 6-digit code shown in your app into the WordPress field to verify the connection works.
Step 6: Save your backup codes
The plugin generates a set of one-time backup codes at this point. Save them somewhere genuinely safe, such as a password manager’s notes field or a printed copy kept in a physical safe. These codes are your recovery plan for the day you lose your phone.
Step 7: Save changes
Update your profile to lock everything in. 2FA is now active on your account.
Step 8: Test it
Log out of WordPress, then log back in. You’ll be prompted for the 6-digit code right after entering your password. Enter it and confirm you can log in successfully.
The “what if I lose my phone” plan
This is the most common fear people have before setting up 2FA. Fortunately there are several solid answers:
1. Backup codes (the standard answer)
Save the one-time backup codes the plugin generated during setup. Each one can be used exactly once to log in if you’ve genuinely lost access to your phone.
Reasonable places to save them include the following:
- A password manager, such as 1Password or Bitwarden.
- A printed copy kept in a physical safe.
- An encrypted note stored on a separate device.
Don’t save them in plain text inside your email or a regular notes app, since that defeats much of the point.
2. Authy’s cloud backup
If you’re using Authy with backup enabled, you can install Authy on a brand new phone and recover all your 2FA codes directly. This removes the “lost phone” problem almost entirely.
3. Multiple devices
You can configure the same 2FA setup on two devices at once, such as a phone plus a tablet, or a phone plus a desktop authenticator app. If you lose one, the other still works fine.
4. A hardware key as an alternative
A YubiKey or similar hardware security key works as a second factor too. Plug it into a USB port, tap it, and you’re in. It works without any internet connection and makes a solid backup option if your phone becomes unavailable.
Requiring 2FA for all users
If your blog has multiple authors or contributors, requiring 2FA specifically for high-privilege roles is good practice worth adopting early.
Most 2FA plugins let you require it for specific roles, like admin or editor, while leaving it optional for lower-privilege roles like subscriber or contributor.
Set this policy once, and new users created with admin-level roles will be prompted to enable 2FA automatically on their first login.
What about app passwords for the REST API?
If you use the WordPress REST API for mobile apps, integrations, or automation, 2FA doesn’t apply directly to those API calls.
The solution is WordPress’s built-in “Application Passwords” feature, found under Users, then Profile, then Application Passwords. Generate a separate password for each app that needs API access. These bypass 2FA entirely, but each one is scoped to a specific application and can be revoked individually without affecting your main login. The official WordPress REST API Handbook covers the full technical details if you’re integrating something more involved.
For anything API-heavy, this is the right pattern to reach for.
Common 2FA mistakes
Not saving backup codes
The classic “I’ll deal with that later” trap. Save them the moment you set up 2FA, not after you’ve already lost your phone and need them urgently.
Using only SMS-based 2FA
SMS-based 2FA is better than having no 2FA at all, but it’s meaningfully weaker than app-based codes. SIM swap attacks can bypass SMS entirely. Use an authenticator app instead of text messages whenever you have the choice.
Disabling 2FA “temporarily” and forgetting
Sometimes admins disable 2FA briefly to test something, then simply forget to turn it back on. Set yourself a reminder if you ever do this, or better yet, avoid disabling it in the first place.
Enabling 2FA on only the admin account
If your blog has editors or additional admin accounts, enable 2FA for them too, not just yourself. The weakest link in the chain is the one that breaks it.
Is this overkill?
No, it really isn’t. 2FA is the cheapest, easiest, and most effective security upgrade available to any WordPress site. It takes about 10 minutes to set up once and prevents virtually all credential-based attacks going forward, indefinitely.
The only real reason not to set it up is forgetfulness. Don’t be the person who learns the value of 2FA the hard way, after an account has already been compromised. Pairing 2FA with the rest of a broader WordPress security routine and a working automatic backup setup covers most of the realistic risk a small blog actually faces. If you want the fuller hardening checklist beyond just login security, see this WordPress security hardening checklist as well, and if your site runs on Aurora, none of this setup conflicts with anything the theme does. 2FA lives entirely at the WordPress login level, independent of theme choice.
Ten minutes that close off nearly every credential attack
2FA stops virtually all password-based WordPress attacks. Setup takes 10 minutes. Install a 2FA plugin, scan a QR code into Authy or Google Authenticator, save backup codes somewhere safe. Test by logging out and back in. Require 2FA for all admin-level accounts on multi-user blogs. The single most cost-effective security upgrade available.
