Why passwords are not enough
Passwords leak in breaches of other sites, get typed into fake login pages and are reused far too often. Attackers feed lists of leaked passwords into login forms automatically, which is called credential stuffing.
Two-factor sign-in means that after the password, the person must also prove they hold something only they have, such as their phone. The attacker has the password but not the phone, and the attempt fails.
The main methods compared
Not every second factor is equally strong. Pick the strongest one your team will actually use.
- Authenticator app (TOTP): an app on a phone shows a six digit code that changes every 30 seconds. Strong, free and works offline.
- Email code or link: a code or sign-in link arrives by email. Convenient, but only as safe as the person's email account.
- SMS code: a code arrives as a text message. Better than nothing, but weaker, because phone numbers can be hijacked.
- Hardware key or passkey: a physical key or a device-bound credential. The strongest option, though it needs plugin support and some setup for each person.
- Backup codes: one-time codes for when the phone is lost. Every user should save them somewhere safe.
Who should use two-factor sign-in
Start with the accounts that can do the most damage and widen from there.
- Administrators: always, with no exceptions.
- Editors, shop managers and anyone who can install plugins, edit code or manage users.
- Authors and contributors, if your site publishes sensitive content.
- Customers or members on shops and communities: usually optional, because requiring it can hurt sign-ups.
How to set up WordPress two-factor authentication
WordPress does not include two-factor sign-in in core, so you need a plugin. The steps are similar for most of them.
- 1Install a two-factor plugin and switch on two-factor sign-in for the site.
- 2Choose which methods users may use. Keep the authenticator app method enabled.
- 3Set up your own account first: scan the QR code with an authenticator app, type the code it shows and save your backup codes.
- 4Test by signing out and signing in again in a private window.
- 5Require two-factor for administrators, then announce it to the team with a date and a short how-to.
- 6Widen the requirement to editors and other roles once the first group is working.
Backup codes and lost phones
People lose phones. Without a plan, a lost phone means a locked-out administrator and a support call at the worst moment.
- Ask everyone to store their backup codes in a password manager, not on the phone that holds the app.
- Make sure at least two administrators exist, so one can reset the other's two-factor.
- Know how to disable the plugin from the file system (rename its folder over SFTP) as a last resort.
- Keep the site's email delivery working, because email codes and reset links depend on it.
Gaps that can bypass two-factor
Two-factor protects the login form. Other doors may not ask for the second step at all.
- Application passwords are separate credentials for apps and scripts, and they generally skip the second step. Turn them off if nothing uses them.
- XML-RPC accepts a username and password directly. Disable it if you do not need it.
- Single sign-on or social login plugins have their own sign-in flows. Check how your two-factor plugin treats them.
- Weak email accounts turn email codes into a single factor. Protect the mailbox with two-factor too.
Fixing common problems
Most two-factor support questions come down to a handful of causes.
- Codes from the app are rejected: the phone's clock is off. Switch on automatic time on the phone.
- Email codes never arrive: the site's email delivery is failing or the message went to spam. Fix delivery or use the app method.
- A page cache shows the wrong sign-in step: exclude the login pages from caching.
- A user lost their phone and backup codes: an administrator resets their two-factor from the user's profile.
Pair it with other protections
Two-factor works best with the rest of the login defences: lockouts after repeated failures, strong password rules and a short idle sign-out. A password manager makes all of it easier for your team.
WordPress two-factor authentication: questions
Does WordPress have two-factor authentication built in?
No. WordPress core only has passwords, so you need a plugin to add a second step.
Which two-factor method should I choose?
An authenticator app is the best balance of safety and effort for most teams. Hardware keys are stronger, and SMS and email are weaker but better than a password alone.
What happens if a user loses their phone?
They can use one of their backup codes. If those are lost too, another administrator can reset their two-factor so they can set it up again.
Will two-factor slow down my team?
Only by a few seconds per sign-in, and a long-lived session keeps people signed in. The time it saves in preventing a takeover is far larger.
Do customers need two-factor too?
Usually not. Focus on staff and administrators, and offer it as an option for customers if your site holds sensitive account data.