Set Up WordPress Two-Factor Authentication
WordPress does not ask for a second code by default. Install a 2FA plugin such as WP 2FA, choose the authenticator-app method, scan the QR code and save the backup codes, then require it for every administrator. It is working when a private window asks for a fresh six-digit code and rejects a wrong one.
For WordPress site owners and admins who want a stolen password to stop being enough to open the dashboard.
knowledge
- Read time
- 5 min
- Sections
- 6
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What does WordPress two-factor authentication check?
Two-factor authentication (2FA) makes WordPress ask for a second proof — usually a six-digit code from an authenticator app that changes about every 30 seconds — after the correct password and before the dashboard opens. Someone who has stolen or guessed the password stops at that second prompt.
WordPress core has no 2FA switch under Settings; on a self-hosted site, including WordPress hosting from WebJi®, you add it with a plugin that hooks into wp-login.php. The Security settings on a WordPress.com account protect that account, not a self-hosted site's own login.
Which second factor should you use?
Use an authenticator app (TOTP) for every administrator, keep one-time backup codes as the fallback, and run only one 2FA plugin per site. Google Authenticator, Microsoft Authenticator and most password managers read the QR code any TOTP plugin shows.
| Factor | Where the code comes from | Use it for |
|---|---|---|
| Authenticator app (TOTP) | A six-digit code on your phone, works offline | Administrators and anyone who can edit the site |
| Backup codes | A list saved during setup; each works once | When the phone is lost or replaced |
| Email code | A message to the account's inbox | Only users who cannot install an app; never the only factor for an admin |
| Hosting panel 2FA | A prompt on the control panel login | The hosting panel only; it does not protect wp-login.php |
An email code goes to the same inbox that can reset the password, so if someone can read that mailbox both checks fail together. Common plugin choices include WP 2FA by Melapress, the Two-Factor plugin maintained by WordPress contributors, and Wordfence Login Security. If one already prompts your users, finish that setup rather than adding a second; two prompts on one login can lock people out.
What should you prepare before enabling 2FA?
Keep an administrator logged in throughout, install an authenticator app first, decide where backup codes will live, and confirm you can reach the plugins folder through the file manager in case you need a way back in.
- Stay logged in as an administrator in this browser until the private-window test passes.
- Install Google Authenticator, Microsoft Authenticator or your password manager's authenticator on the phone.
- Choose a password manager or a printed sheet for backup codes, not a photo on the same phone.
- Check you can open
wp-content/pluginsvia the hosting file manager or SFTP.
How do you turn on 2FA with the WP 2FA plugin?
Install WP 2FA by Melapress, choose the authenticator app method, scan the QR code, enter the current code, save the backup codes, then prove in a private window that the login demands a fresh code.
- Go to Plugins › Add New Plugin, search for "WP 2FA", then install and activate the Melapress plugin. A setup wizard or a WP 2FA menu item appears.
- In the wizard, choose the authenticator app method and continue to the QR code. Do not choose email for an administrator.
- In the authenticator app, add an account and scan the QR code; it starts showing six-digit codes.
- Type the current code into the wizard. If rejected, set the phone's clock to automatic time and try the next code.
- Copy every backup code the wizard shows into your password manager or onto paper.
- Keep this browser signed in. Open a private window, go to
/wp-login.php, enter the password and a fresh code: the dashboard should load. Try once with a wrong code: the login should stay on the code screen.
If the wizard closed before showing backup codes, generate them from your profile or the WP 2FA user screen before logging out. A test that never asks for a code means the method was not saved for your user; run the wizard again.
How do you require 2FA for all administrators?
A code on your own account does not protect other administrator accounts, so set a policy that requires 2FA for the Administrator role. In WP 2FA, open its Policies settings, require two-factor authentication for Administrators and save; allow a grace period long enough for colleagues to enrol.
After the grace period, an administrator who has not set up a code should land on the setup screen instead of the dashboard — proof the policy works. Also consider Editors, who can publish content. Do not force codes on Subscriber or WooCommerce Customer accounts unless they use wp-admin; it blocks shoppers who never installed an authenticator. Who should hold which role is covered in WordPress user roles.
How do you sign in if you lose your phone?
At the code prompt, choose the backup-code option and enter one unused code; once in, generate a fresh list and enrol the new phone before logging out.
- If you have no backup codes and no other administrator can help, open
wp-content/pluginsin the file manager or SFTP. - Rename
wp-2fatowp-2fa-off(orwordfence, if that plugin supplies the code — not both). - Reload
/wp-login.phpand sign in with the password alone. - Rename the folder back, enrol the new device, and save new backup codes.
If the site is on WebJi® and you cannot find the folder, email support@webji.services; the inbox is staffed 24/7 in Hindi and English with an average first reply under 60 minutes, while the office phone line runs during business hours. If the password itself is rejected once the form is back, follow WordPress login not working.
What does two-factor authentication not protect against?
2FA stops a correct password from being enough, but it does not slow bots that try thousands of wrong passwords, protect the hosting panel, or fix vulnerable plugins.
- Brute-force volume: still needs login-attempt limits; see limit login attempts.
- The hosting panel: enable 2FA there separately; it does not cover
wp-login.php. - A hidden login URL: different job; anyone who finds it can still use a stolen password until a code is required.
- Outdated plugins and themes: attackers who exploit a vulnerability skip the login entirely; keep everything updated, as in the WordPress security checklist.
Frequently asked questions
Can I use Google Authenticator with WordPress?
Yes. Any TOTP-based 2FA plugin shows a QR code that Google Authenticator, Microsoft Authenticator or a password manager can scan. The app then produces six-digit codes that change roughly every 30 seconds.
Does 2FA work with WooCommerce customer logins?
Some 2FA plugins can extend to the My Account login, but most stores keep it optional for customers and required for staff. Forcing every shopper to use an authenticator app usually costs orders.
Can I use passkeys instead of a code?
Some security plugins now support passkeys or hardware security keys (WebAuthn), which are more resistant to phishing than six-digit codes. They need a compatible browser and device, so keep backup codes as a fallback.
Will 2FA slow down my login?
It adds a few seconds to type the code. Many plugins let you trust a browser for a set number of days, so you are not asked on every visit from your own computer.
Last editorial update: 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.