WordPress two-factor authentication (2FA) asks for a second proof, usually a six-digit code from an app on your phone, after your password. A stolen or guessed password then isn’t enough to get into your site. Every account that can install plugins, change users or edit a shop should have it, and setting it up takes about 15 minutes per person.
Key takeaways
- WordPress doesn’t include 2FA out of the box. You add it with a plugin, or with the security plugin you already run.
- An authenticator app is the practical choice for most businesses. Email and SMS codes are the weakest options.
- Save backup codes when you set it up. They’re what stops a lost phone becoming a lockout.
- Roll it out to your own account first, then every admin and shop manager.
What is two-factor authentication in WordPress?
It’s a second step at the login screen. You enter your username and password as usual, then a code from something you carry. WordPress’s own documentation describes two-step login as using two kinds of proof, usually a password plus a device. It points site owners to plugins in the WordPress.org directory, because core WordPress doesn’t provide it (WordPress Developer Resources).
Why does every admin account need it?
Because passwords leak. Bots try leaked and common passwords against WordPress logins around the clock: Wordfence blocked more than 55 billion of these attempts in 2024 (Wordfence). A password can also be stolen through a fake login page or malware on a staff laptop.
An admin login is the master key. Whoever holds it can add plugins, create hidden users and change your checkout. Australia’s cyber security agency, ASD, calls MFA one of the most effective ways to protect business accounts, because a stolen password alone can’t be used to get in (cyber.gov.au).
Many small businesses still skip it. auDA’s 2026 research found that owners who think they’re “too small to be targeted” were less likely to use MFA than other small businesses (auDA). Stolen logins are one of the main ways in, as our guide to how websites get hacked explains.
Which kind of second factor should you use?
| Method | How it works | Our view |
|---|---|---|
| Authenticator app | A new six-digit code every 30 seconds on your phone | Best default for most teams |
| Passkey or security key | Your phone, fingerprint or a USB key confirms it’s you | Strongest, but needs an extra plugin on WordPress |
| Email code | A code sent to your inbox | Better than nothing, but weak if email is hacked |
| SMS code | A code sent by text message | Weakest option |
ASD rates passkeys as more secure than passwords because they help stop you logging in to a fake website. It rates SMS and email codes as the least secure, since those accounts are easier to take over.
How do I set up 2FA on WordPress without locking anyone out?
- Make sure you have a way back in. Take a backup, and check you can reach your hosting file manager. If 2FA ever fails, that’s your recovery route.
- Pick one tool. If you already run a security plugin, check whether it includes 2FA. If not, the free Two-Factor plugin, maintained by WordPress contributors, supports authenticator apps, email codes and backup codes (WordPress.org). Don’t run two 2FA plugins at once.
- Set up your own account first. Go to Users, then Profile, and scan the QR code with an authenticator app. Log out and back in to test it.
- Save your backup codes. Store them in your password manager or print them and lock them away. Each code works once.
- Roll it out to every admin and shop manager. Give each person a deadline and a five-minute walkthrough. Each person sets up their own phone.
- Make it required. The Two-Factor plugin has no setting to force it by role. If your security plugin can require 2FA for administrators, turn that on, and check monthly that nobody has switched theirs off.
What if someone loses their phone?
Use a backup code to log in, then set up the new phone straight away. If the person has no backup codes, another administrator can turn off 2FA on their profile so they can set it up again.
If you’re the only admin and you’re locked out, the last resort is your hosting account. Renaming the 2FA plugin’s folder in the file manager switches it off, so you can log in and fix it. Our guide for when you can’t log in to WordPress walks through that safely. Turn the plugin back on as soon as you’re in.
Who else needs two-factor login?
Start with anyone who can change the site: administrators, editors and shop managers. Customer accounts on a shop can usually stay optional.
Then go beyond WordPress. Your email, hosting, domain and payment accounts need 2FA too, because each can be used to reset or take over the website. ASD suggests starting with email, banking and cloud accounts.
2FA is one lock among several. Our WordPress security checklist covers the rest, from updates to backups. Good hosting adds another layer underneath: our secure web hosting page explains what to look for in a host.
How we handle it for you
On our Maintain & Protect Advantage and Elite plans, we set up two-factor login and advanced firewall rules for you. Every plan includes login protection, malware scanning and off-site backups. Our website security monitoring adds daily malware scans and blacklist monitoring on top. Compare what each level includes on our website maintenance plans page.
Frequently asked questions
Does WordPress have built-in two-factor authentication?
No. Core WordPress logs you in with a username and password only. You add two-factor login with a plugin, such as the free Two-Factor plugin from WordPress contributors, or the 2FA feature in a security plugin you already use.
Is email two-factor authentication good enough?
It’s better than a password alone, but it’s the weakest option. If someone gets into your email, they get your codes too. An authenticator app on your phone is stronger, and just as easy once it’s set up.
Should my WooCommerce customers use 2FA?
Usually it’s optional for customers. Focus on accounts that can change the site or see orders: administrators and shop managers. If customers store payment methods or valuable account credit, offering 2FA to them is worth considering.
Does 2FA protect against every login attack?
No. It stops a stolen password working, but it won’t fix a vulnerable plugin, and some fake login pages can capture codes in real time. Passkeys resist that best. Keep plugins updated and limit who has admin access too.
Sources
- Two step authentication, WordPress Developer Resources
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- Small business cyber security handbook: Securing accounts and identities, Australian Signals Directorate, October 2026
- Digital Lives of Australians 2026, auDA
- Two-Factor plugin, WordPress.org plugin directory, version 0.17.0, September 2026