Two-factor authentication on WordPress, set up properly

Two-factor is the single highest-return security change available on WordPress. It takes about ten minutes and eliminates an entire category of attack — every stolen, guessed or leaked password becomes useless on its own.

Why it matters more than a strong password

Passwords leak constantly, in breaches that have nothing to do with your site. Attackers take those lists and try them against WordPress logins automatically, which is called credential stuffing and costs them essentially nothing.

If you have reused a password anywhere, ever, this is a live risk rather than a theoretical one. Two-factor makes the leaked password insufficient.

It also defends against the case a strong password does not: you being phished. Someone who captures your password on a convincing fake login page still cannot get in.

Which method to use

An authenticator app. Google Authenticator, Authy, 1Password, Bitwarden — all fine. Six-digit codes, rotating every thirty seconds, generated on your device with no network involved. This is the right default for nearly everyone.

A hardware key. YubiKey or similar. The strongest option and genuinely phishing-proof, because the key checks the domain. Worth it if the site is business-critical.

Email codes. Acceptable, and weaker: if your email is compromised, so is the second factor. Better than nothing.

SMS. The weakest, because SIM-swap attacks are real and not rare. Use it only if nothing else is workable.

Setting it up

1. Pick a plugin. WP 2FA, Two Factor Authentication, or the two-factor support built into Wordfence and Solid Security if you already run one. Any of them is fine; the choice matters far less than doing it.

2. Turn it on for your own account first. Scan the QR code with your authenticator app, enter the verification code, save.

3. Save the backup codes somewhere real. This is the step people skip and regret. Put them in your password manager, not in a note on the same phone that runs the authenticator.

4. Test it. Log out. Log back in. Confirm the flow works before you enforce it on anyone else.

5. Enforce it for all administrators. Most plugins let you require it per role. An administrator without two-factor is the weak point in an otherwise protected site, and that is usually the account an attacker wants.

6. Give people a grace period. A week, with a notice, so nobody is locked out at an inconvenient moment.

The two ways people lock themselves out

The phone is lost or replaced. Without backup codes, the authenticator is gone with the device. This is the common one, and it is why step 3 matters.

The plugin breaks. Rare but real, usually after an update.

The way back in either case is through the database or the filesystem: rename the plugin's folder over SFTP, which deactivates it and removes the second factor. Which is a useful reminder that two-factor protects the login, not file access — hardening covers the rest.

If you have neither backup codes nor file access, you are dependent on your host. Worth knowing before it happens.

What it does not do

Two-factor protects the login form. It does nothing about:

• A vulnerable plugin being exploited directly, which is how most sites are actually compromised
• An existing session hijacked through a stolen cookie
• Malware already on the server

Which is the general pattern with security measures: each one closes a specific door, and none of them substitutes for keeping software current.

Still — ten minutes, no ongoing cost, and it removes the entire password-guessing category. There are not many changes with that ratio.