Your WordPress password is the only thing standing between a stranger and your admin dashboard. If that password leaks in a data breach, gets guessed, or gets phished, the attacker walks straight in. Learning how to add two-factor authentication to WordPress fixes that: even with your password, nobody can log in without a second code from your phone. Setup takes about five minutes and costs nothing.
In this guide, you will pick the right 2FA method, install a free plugin, turn it on, and save the backup codes that keep you from ever getting locked out.
What Is Two-Factor Authentication — and Why Your WordPress Login Needs It
Two-factor authentication (2FA) asks for two proofs of identity at login: something you know (your password) and something you have (a code from your phone). WordPress core does not ship 2FA, so you add it with a plugin.
That matters because the WordPress login page is a public, well-known target. Bots hammer wp-login.php around the clock trying username and password combinations. A strong password helps, but passwords get reused, leaked in breaches on other sites, and phished. 2FA breaks that chain: a stolen password alone is useless without the second factor. For the other login layers, see my WordPress security hardening checklist.
The 2FA Methods, Ranked
Not every second factor is equal. Here is how the options stack up:
| Method | How it works | Verdict |
|---|---|---|
| SMS codes | A code is texted to your phone | Last resort only |
| Email codes | A code is emailed to you at login | Only as secure as your email account |
| Authenticator app (TOTP) | An app generates a 6-digit code that changes every 30 seconds | Solid baseline — free, works offline |
| Passkeys / WebAuthn | Your device or security key confirms it is really you | Strongest — resists phishing |
For most sites, use an authenticator app (TOTP) for every user, with passkeys for admins where your plugin supports them. Avoid SMS: security guidance from NIST classifies SMS-based verification as restricted, and it is the weakest method here by a clear margin.
Which WordPress Two-Factor Authentication Plugin Should You Use?
Three free options cover nearly every site:
Two Factor — best for single admins and small sites
Two Factor is maintained by WordPress core contributors and is the closest thing to an official option, with 100,000+ active installs and a 4.8 out of 5 rating on WordPress.org. It adds TOTP authenticator codes, email codes, and ten single-use backup codes, with no paid version and no user cap. It does not include passkey/WebAuthn support — that needs a separate companion plugin. If you run a site mostly by yourself, start here.
WP 2FA — best for teams and client sites
WP 2FA by Melapress also has 100,000+ installs and adds a guided setup wizard, plus the feature Two Factor lacks: you can require 2FA by user role, with a grace period so existing users are not locked out on day one. Its free tier includes TOTP, email codes, backup codes, and passkeys. If other people log in to the site, this is the one to install.
Wordfence — best if you already run Wordfence
If Wordfence is already your security plugin, use the 2FA built into it rather than adding a second plugin. One warning: the standalone Wordfence Login Security plugin was retired around July 1, 2026, and no longer receives updates — everything it did now lives inside the main Wordfence plugin, which is free. For a detailed side-by-side of the leading options, this comparison of the best WordPress 2FA plugins for 2026 is worth a read before you commit.
How to Add Two-Factor Authentication to WordPress (Step by Step)
The steps below use the Two Factor plugin. The flow is nearly identical in WP 2FA and Wordfence.
Step 1: Back up your site
Take a fresh backup first. If anything goes sideways, you can restore in minutes instead of debugging a lockout. Follow my WordPress backup guide if you do not have a backup routine yet.
Step 2: Install an authenticator app
Install Google Authenticator, Microsoft Authenticator, Authy, or 1Password on your phone. Any app that supports TOTP works.
Step 3: Install and activate the Two Factor plugin
- In your WordPress dashboard, go to Plugins > Add New.
- Search for Two Factor — the one by WordPress.org.
- Click Install Now, then Activate.
Installing the plugin does not turn 2FA on for anyone yet. That is a separate, per-user step.
Step 4: Connect your authenticator app
- Go to Users > Profile in the dashboard.
- Scroll to Two-Factor Options.
- Under Authenticator App, check Enabled and select it as your Primary method.
- A QR code appears. In your authenticator app, tap the plus icon, choose Scan a QR code, and point your camera at it.
- The app starts showing a 6-digit code for your site. Type the current code into the verification field, then click Update Profile.
Step 5: Save your backup codes
In the same Two-Factor Options section, generate your backup codes — Two Factor gives you ten single-use codes. Download them and store them in your password manager, or print them and keep them somewhere safe. These codes are your way back in if your phone is lost, stolen, or reset. Do not skip this step.
Step 6: Test the login
Log out, then log back in. After your username and password, WordPress asks for the 6-digit code from your authenticator app. That extra screen is the whole point — anyone without your phone stops right there.
How to Require 2FA for Other Users on Your Site
Securing only your own account leaves the door open through every other account with dashboard access. If you installed WP 2FA, require 2FA for the Administrator and Editor roles, with a grace period of one to two weeks so existing users get time to set it up instead of being locked out on Monday morning.
With the plain Two Factor plugin there is no role enforcement — each user turns it on from their own profile. For a small team, walk each person through the five-minute setup. For larger teams, switch to WP 2FA so the policy enforces itself. While you are tightening logins, also add a CAPTCHA to the login form — my guide on adding Google reCAPTCHA to WordPress walks through it.
Locked Out? How to Get Back Into WordPress
If you lost your phone and have no backup codes, do not panic — you can still recover the site as long as you have hosting or FTP access. The fastest fix is to deactivate the 2FA plugin: connect with SFTP or your host file manager, open wp-content/plugins, and rename the plugin folder — for example, rename two-factor to two-factor-disabled. WordPress automatically deactivates any plugin whose folder it cannot find. Rename the folder back after you log in, then set up 2FA again properly.
If you have WP-CLI access, the same fix is one command:
wp plugin deactivate two-factor
One warning: if email codes are your second factor and WordPress is not sending mail, you will never receive the code. Fix email delivery first — see my guide on fixing WordPress not sending emails — before relying on email-based 2FA.
2FA Mistakes to Avoid
- Only protecting the admin account. Any account with dashboard access is a way in. Cover editors and shop managers too.
- Choosing SMS because it is familiar. It is the weakest method and the easiest to attack. Use an authenticator app.
- Skipping backup codes. A lost phone without backup codes turns a five-minute setup into a recovery job.
- Assuming 2FA fixes everything. 2FA protects the login form. It does not patch vulnerable plugins or stop attacks that never touch the login page. Keep the rest of your security layers in place.
Frequently Asked Questions
Does WordPress have built-in two-factor authentication?
No. WordPress core has no native 2FA or passkey support, even in the latest major releases. To add two-factor authentication to WordPress, you need a plugin — Two Factor, WP 2FA, or the 2FA inside Wordfence are the free options most sites use.
What is the best 2FA method for WordPress?
An authenticator app (TOTP) is the best balance of security and practicality: free, works offline, and the codes change every 30 seconds. Passkeys are stronger and resist phishing, but plugin support is thinner. Email codes are acceptable as a fallback, and SMS should be your last choice.
Final Thoughts
Adding two-factor authentication to WordPress takes about five minutes and costs nothing, yet it neutralizes the most common way sites get taken over: a stolen or guessed password. Install Two Factor or WP 2FA, scan the QR code, save your backup codes somewhere safe, and require it for every account with dashboard access. Do it today, while it is a calm five-minute job — not after a breach.
If your WordPress site needs a security review — 2FA setup, hardening, malware cleanup, or maintenance — get in touch.