Turning on two-factor authentication for WordPress, step by step

A password for your website gets stolen without anybody breaking into anything. Someone in the office uses the same one for a supplier’s portal, the supplier gets breached, and the list of email addresses and passwords is on sale by the weekend. Automated tools then try each pair on thousands of WordPress login pages, yours included.

If a stolen password is all it takes to get in, you are relying on nobody ever reusing one. Two-factor authentication adds a second step, so the password alone gets an attacker to a locked door rather than an open one.

What it does, and what it does not

When you log in, WordPress asks for your password and then for a six-digit code from your phone. The code changes every thirty seconds. A thief with your password but not your phone is stuck.

It does not stop a plugin with a security hole from being exploited, because that attack never touches the login page. It does not replace updates or backups. It closes one specific and very common way in, which is why we put it near the top of the list for any site with more than one person logging in.

WordPress does not have it built in. You add it with a plugin.

Pick a method

There are four ways to do the second step, and they are not equal.

• Authenticator app. An app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy, shows the six-digit code. Works without a phone signal, costs nothing, and is the one we would pick for most small businesses.
• Passkey or security key. Your phone, laptop fingerprint reader or a small USB key proves it is you. Strongest of the four and the easiest to use day to day, but support in WordPress plugins is newer, so check the plugin you choose lists it.
• Text message. A code arrives by SMS. Better than nothing, and easy for staff to understand. The weakness is that someone can talk a phone company into moving your number to a new SIM, and then the texts go to them. Use it if the alternative is no second step at all.
• Email code. The code goes to your inbox. If the same password opens both the website and the email account, a thief who has the password gets the code too. Skip it.

For the plugin, three are widely used and free for what a small site needs: Two Factor, which is maintained by WordPress contributors and keeps things plain, WP 2FA, which has friendlier set-up screens for staff, and Wordfence Login Security, which does the job without the full Wordfence firewall installed. Pick one. Running two at once causes login loops.

Setting it up

Allow ten minutes, and do it on a weekday morning when you can fix a mistake.

1. Check your backup exists first. Look at the file, with today’s date, stored somewhere other than the web server.
2. Install and activate the plugin from Plugins → Add New.
3. Open your own profile under Users → Profile and find the new two-factor section.
4. Choose the authenticator app option. WordPress shows a QR code. Open the app on your phone, add an account, and point the camera at it.
5. Type the six-digit code the app now shows to confirm it works.
6. Save the backup codes. The plugin shows a list of single-use codes. Put them in your password manager or print them and keep them somewhere locked. This step is the one people skip, and it matters more than any other on this list.
7. Log out, log back in, and test it in a private browsing window before you close the original one.

Do your own account first. When it works, do the other administrators.

When somebody loses their phone

This will happen, usually to the person who is on holiday. Plan for it now, while nothing is broken.

The first line is the backup codes. Each one works once, in place of the app code. That is why they get stored somewhere other than the phone.

The second line is another administrator. A second admin can open Users, edit the locked-out person’s profile and switch off their second step, and the person then sets it up again on the new phone. This is a good reason for a site to have two administrators it trusts, not one.

If you are the only administrator and you have lost both the phone and the codes, the way back is through the hosting account: rename the plugin’s folder in wp-content/plugins, which switches it off, log in with the password alone, rename the folder back and set it up again. Your host’s support or whoever manages the server can do this in a few minutes. It is also the reason the access to your hosting account should not live on the same lost phone.

An authenticator that backs itself up to an account, as Authy and Microsoft Authenticator can, saves the situation altogether, because the codes follow you to the new handset.

Getting staff to use it

An extra step meets resistance, and in a small team it comes from the person who logs in twice a week and sees it as time wasted. Three things help.

Start with the administrators. Editors and authors can come later. The accounts that can install plugins and add users are the ones a thief wants, so ten minutes spent on two or three people covers most of the risk. If you have not looked at who holds those accounts recently, work through that list first.

Set it up with them, in the room. An email with instructions gets read by half the people and done by a few. Sitting beside someone while they scan the QR code takes four minutes and it is finished.

Turn on the “remember this device” option if your plugin has one. The code is asked for once a month on the office computer rather than every time. It is a fair trade, as the risk is the stranger’s computer, not the one on your own desk.

Tell people what it is for in plain terms: it is there so that a password from a hacked supplier cannot be used to get into the business website. People accept a rule that has a reason.

Where this leaves you

Choose an authenticator app, install one of the three plugins, save the backup codes somewhere that is not your phone, and have a second administrator who can reset you. That covers the lost-phone problem before it exists and removes the most common way a WordPress login gets taken over.

If you would rather somebody else did it and checked it still works after each update, login protection is part of what our Care & Hosting covers at £49 a month, and the free website review tells you whether your login is protected today.