By Hridoy Ahmed | Last updated: October 2026 | 8 min read
Short answer: Two-factor authentication (2FA) asks for a second proof, such as a code from an app, after the password. If someone steals or guesses a password, they still cannot log in without the second step. As far as I know, WordPress core does not include 2FA, so you add it with a well-maintained plugin. Turn it on first for administrators, save backup codes, and test it before you log out.
In this guide
- Why 2FA matters for WordPress
- Which 2FA method to choose
- How to set it up safely
- If you get locked out
- What 2FA does not do
- FAQ
Why 2FA matters for WordPress
Your WordPress login page is public. Bots try common passwords and passwords leaked from other sites all day. A strong, unique password helps, but people reuse passwords, and one leak can open your site. 2FA adds a second barrier that a stolen password alone cannot pass.
An admin account is the most valuable target, because it can install plugins and change code. That is why 2FA matters most for administrators and editors.
Which 2FA method to choose
- Authenticator app (TOTP): an app on your phone shows a code that changes every few seconds. This is a good default.
- Security key or passkey: a physical key or a device-based passkey. This is a strong option. Some plugins need an extra add-on for it.
- Email code: a code is sent to your email. It is easy to use, but it is only as safe as your email account, so protect that account with 2FA too.
- Backup codes: one-time codes you save for emergencies. Every setup should have them.
Pick the strongest method that your team will actually use.
How to set it up safely
- Take a backup first. See how often to back up WordPress.
- Choose a plugin that is actively maintained. Check the update date, the supported WordPress version and the reviews. The Two Factor plugin on WordPress.org is one option. Its page says each user must set up their own 2FA settings, and passkeys and hardware keys need a separate add-on. Whichever plugin you pick, read its page first.
- Enable 2FA on your own admin account first. Open your profile and look for the 2FA options the plugin adds.
- Save your backup codes in a password manager or a safe offline place.
- Test it. Open a private browser window, log in and complete the second step. Do not log out of your first window until this works.
- Roll it out to other privileged users. Start with administrators, then editors and shop managers. Tell them how to set it up and where to get help.
- Write down your recovery steps so you or your developer can fix a lockout.
2FA is one layer. Combine it with the basics in my WordPress security checklist. If you want someone to set this up and review the rest, see my WordPress security service.
If you get locked out
This happens, for example when a phone is lost. Plan for it:
- Use a backup code first.
- If you have no code, use your hosting file manager or SFTP to rename the 2FA plugin folder inside wp-content/plugins. WordPress will then deactivate it, and you can log in with your password.
- Log in, re-enable the plugin and set up 2FA again with new backup codes.
- Only people you trust should have file access to the site. If someone else could do this, treat it as a risk.
What 2FA does not do
- It does not fix outdated or vulnerable plugins and themes. Keep them updated. See how to update WordPress plugins safely.
- It does not remove malware that is already on your site. If you suspect a hack, read WordPress backdoors: what they are and how to find them.
- It does not protect other ways in, such as hosting accounts, FTP or database access. Use strong passwords and 2FA there as well.
- It does not replace limiting login attempts, using unique passwords and removing unused admin accounts.
Common mistakes
- Turning on 2FA without saving backup codes
- Logging out before testing the second step
- Protecting WordPress but not the email account used for recovery
- Leaving old administrator accounts without 2FA
- Installing an abandoned 2FA plugin
- Thinking 2FA makes updates and backups unnecessary
FAQ
Does WordPress have built-in two-factor authentication?
As far as I know, WordPress core does not include it. You add it with a plugin. Check your WordPress version and the plugin’s own page for current details.
Should all users have 2FA?
At least everyone who can publish, edit or change settings. Customers and subscribers usually do not need it.
Is email 2FA enough?
It is better than a password alone, but an authenticator app or security key is stronger. If you use email codes, secure the email account well.
Will 2FA slow down my site?
It only affects the login step, not what visitors see on your pages.
Want your login and site hardened properly? I set up 2FA and review the rest of your WordPress security. See my WordPress security and malware removal service.
About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.