Two-Factor Authentication (2FA)

A strong password is good, but passwords leak, get guessed and get reused. Two-Factor Authentication, or 2FA, adds a second check to your login. Even if someone knows your password, they still cannot get in without that second step.

For any WordPress site with an admin account, 2FA is one of the simplest security upgrades you can make.

How does Two-Factor Authentication work?

2FA asks for two different kinds of proof: something you know, like your password, and something you have, like your phone. It works just like an ATM, which needs both your card and your PIN.

The second factor can be any of these:

• A six-digit code from an authenticator app, which usually changes every 30 seconds.
• A one-time code sent to your email address.
• A physical security key that you plug in or tap.
• Backup codes that you save for emergencies.

Does WordPress have 2FA built in?

No, WordPress core does not include two-factor authentication, so you need a plugin to add it. Plenty of free security plugins offer 2FA, and there is also a dedicated free plugin simply called Two Factor. You can compare a few options in our list of the best security plugins for WordPress.

I turn on 2FA for every Administrator and Editor account on the sites I manage.

How to set up 2FA in WordPress

The exact screens differ between plugins, but the steps are usually similar:

1. First, install and activate a 2FA plugin from the Plugins menu.
2. Next, open your profile under Users → Profile or the plugin's own settings page.
3. Now, scan the QR code with an authenticator app such as Google Authenticator or Microsoft Authenticator.
4. Here, type the code from the app to confirm the setup.
5. Finally, download or write down your backup codes.

2FA turns a stolen password into a useless one, so enable it for every account with real power. That's all about two-factor authentication. Share which method you prefer in the comment section below.