Setting Up Two-Factor Authentication on WordPress, Properly

Most WordPress sites are not broken into with clever exploits. They are broken into with a password somebody should not have had. Two-factor authentication is the single change that closes that door hardest, because even a stolen password is useless without the second factor. This post is how I set 2FA up on a WordPress site, which plugin, which method, how to enforce it so it is not optional, and how to avoid the one mistake that locks you out of your own admin.

What 2FA actually protects against

Two-factor authentication means a login needs two things: something you know, your password, and something you have, a code or a device. The value is simple. Passwords leak. They get reused across sites, phished, guessed, and dumped in breaches. When a password leaks, 2FA is the thing standing between that leak and someone logging in as you.

It does not make your site unhackable. Nothing does. What it does is take the most common attack, credential stuffing and brute force against wp-login.php, and make it fail even when the attacker has the right password. For the effort involved, nothing else on a WordPress site gives you that much return.

TOTP, not SMS

There are three common second factors and they are not equal.

• TOTP, a code from an authenticator app (Google Authenticator, Authy, 1Password, or the authenticator built into your password manager). This is the right default. The code is generated on your device from a shared secret and a clock. Nothing is sent over a network to intercept.
• SMS codes. Better than nothing, but weaker, because SIM swapping is a real and well-practised attack. An attacker convinces your mobile provider to move your number to their SIM, and now the codes come to them. Do not use SMS as the second factor for an administrator account.
• Passkeys. The strongest option, phishing resistant, and worth moving admins to over time. I have written separately about setting passkeys up for WordPress admins. If you are ready for passkeys, use them. If not, TOTP is the solid, universally supported choice today.

For most sites, TOTP via an authenticator app is the answer. It works everywhere, it costs nothing, and it has no network dependency to attack.

Which plugin

You have two sensible paths.

If you already run Wordfence, you already have 2FA. It is built into the free version alongside the firewall and malware scanning. There is no reason to add a second plugin for it. Turn it on, enforce it, done.

If you do not, a dedicated plugin is cleaner than installing a whole security suite just for this. WP 2FA by Melapress is a good default: clear interface, supports TOTP apps, email codes, and backup codes, and lets you enforce 2FA by role, which is the feature that actually matters. Two-Factor by the WordPress contributor team is a lighter, no-frills option maintained close to core if you prefer minimal.

Any of these is fine. The plugin is not where sites go wrong. Enforcement and recovery are.

Enforce it by role, do not leave it optional

This is the step that separates real 2FA from theatre. Almost every plugin lets users opt in to 2FA on their own profile. Almost nobody does. Voluntary 2FA on an admin site means the one account that never got round to it is the one that gets compromised.

Every plugin worth using lets you require 2FA by role. Set it to mandatory for every Administrator and Editor account at minimum. New users in those roles should be forced to set up 2FA on their next login before they can do anything else. If the plugin supports a grace period, keep it short. The point of enforcement is that "I'll do it later" is not an option for a privileged account.

The setup that will not lock you out

A badly configured 2FA rollout can lock you out of your own site. Follow this order and it will not.

• Set up your own account first, and test it before enforcing for anyone else. Log out, log back in with the code, confirm the whole flow works, before you make it mandatory site-wide.
• Generate and save backup codes. Every good 2FA plugin gives you a set of one-time recovery codes for when you do not have your authenticator to hand. Generate them, print them, keep them somewhere physical. These are what get you back in if you lose or replace your phone.
• Add the account to more than one device if you can. Password managers like 1Password and Bitwarden can hold TOTP secrets and sync across your devices, so a lost phone is an inconvenience, not a lockout.
• Know the emergency route. If you are ever fully locked out, 2FA can be disabled from the server by removing the plugin's data or deactivating the plugin via the database or WP-CLI. Knowing that this exists takes the panic out of a lost device. You should not need it if you kept backup codes.

The setup checklist

1. Pick your method: TOTP via an authenticator app, unless you are ready for passkeys.
2. Use Wordfence's built-in 2FA if you run it, or install WP 2FA if you do not.
3. Configure 2FA on your own admin account first.
4. Save and print your backup codes.
5. Add the TOTP secret to a synced password manager as a second copy.
6. Log out and back in to confirm the flow works end to end.
7. Enforce 2FA by role for all Administrator and Editor accounts.
8. Confirm every other privileged user completes setup, no "later" exceptions.
9. Diary a six-month reminder to review who has 2FA and revoke any stale accounts.

Where this fits

The Protect My WP handbook covers user and authentication security in Chapter 3, including 2FA enforcement alongside the rest of the login layer: password policy, limiting login attempts, blocking user enumeration, locking down XML-RPC, and managing application passwords and the newer AI agent access that authenticates through them. 2FA is the highest-return single change you can make. It works best as one part of a login that has been hardened all the way through.

If you want the full picture rather than just the 2FA piece, the book is where it lives.

Get the book for £19.