WordPress doesn’t include two-factor authentication out of the box, it has to be added, either through a dedicated 2FA plugin or a broader security plugin that includes it. This walks through the actual setup, method by method, so a stolen or guessed password stops being enough on its own to get into your dashboard.
Choose your method first
Not all second factors are equally secure, worth choosing deliberately rather than defaulting to whatever’s first in a settings menu. NIST’s own digital identity guidelines, the US government’s standard reference for authentication security, specifically flag SMS-delivered codes as the weakest common method, since a SIM-swap attack can redirect a phone number to an attacker without ever touching the account itself. An authenticator app (TOTP, time-based one-time passcodes) is meaningfully stronger. A passkey, built on the WebAuthn standard, is stronger still, since it’s bound to your site’s exact domain and can’t be phished the way a typed code can.
Step 1: install a plugin that supports it
WordPress.org’s own Two Factor plugin, maintained by the WordPress core contributor team, is a solid, free, lightweight option for TOTP and backup codes, though it needs a separate companion plugin for passkey support specifically. A broader security plugin, SecondGate’s free tier included, bundles 2FA (passkeys and standard TOTP both included at no cost) alongside other protections in one install rather than needing multiple plugins working together.
Step 2: set it up for your own account first
Go to your user profile (Users → Your Profile on most setups, or wherever the plugin adds its settings) and enable 2FA for yourself before rolling it out to anyone else. For an authenticator app, you’ll scan a QR code with an app like Google Authenticator, Authy, or 1Password, which then generates a new six-digit code every 30 seconds that you’ll enter alongside your password at login. For a passkey, your browser will prompt you to use your device’s fingerprint, Face ID, or Windows Hello to register it directly, no code to write down at all.
Step 3: save your backup codes somewhere safe
Almost every 2FA implementation generates a set of one-time backup codes at setup, meant specifically for the situation where you lose access to your phone or authenticator app. Save these somewhere genuinely separate from the device they’re backing up, a password manager’s secure notes feature, or printed and stored physically, not just a screenshot on the same phone that would be lost alongside them.
Step 4: require it for every admin and editor, not just yourself
One weak or unprotected account is enough for a site to get compromised, so 2FA is only as strong as its least-protected user. Most plugins that support 2FA also support enforcing it by role, requiring every Administrator and Editor to set it up before they can continue using the dashboard, rather than leaving it optional and hoping everyone opts in on their own.
Step 5: roll it out without locking anyone out
If you’re enforcing 2FA across a team rather than just yourself, give people a real grace period rather than an immediate hard cutoff, and send clear, simple instructions alongside the change, most support tickets around 2FA come from people who weren’t told what to expect rather than the technology itself being confusing. Test the recovery flow before you need it for real too, know in advance how an admin regains access if they genuinely lose both their password and their second factor, most plugins have a defined recovery path, but it’s worth knowing what it actually involves before an emergency forces you to find out.
Verify it actually works
Log out completely and log back in to confirm the 2FA prompt actually appears and that your saved backup codes work if you deliberately test one. It’s a genuinely common and avoidable mistake to assume a 2FA setup is working just because the setup wizard completed without error, actually testing the full login flow once is the only way to know for certain.
Where this fits into a broader security setup
2FA is one of the highest-impact single changes on any WordPress security checklist, but it’s still one part of a fuller picture. For the complete approach, how to secure a WordPress site covers this alongside updates, backups, and the rest of what closes off the majority of real-world compromise routes. If XML-RPC is still enabled on your site, disabling it closes a related brute-force attack surface worth addressing at the same time.
