What does two-factor authentication mean?
Two-factor authentication means logging in takes two different proofs: something you know, like a password, plus something you have, like a code from a phone app or a security key, or something you are. “2FA” stands for two-factor authentication. For a WordPress admin, it means a stolen password alone shouldn’t be enough to open the dashboard.
You still enter your username and password. Then WordPress asks for that second proof before letting you in. It’s a small extra step at login, rather than another password you have to remember.
What does 2FA stand for (and what’s “2FA status”)?
2FA is just the short name for two-factor authentication. If you see “2FA status” beside a WordPress user, it usually means whether that person has turned on a second login check for their account. Check the plugin’s wording: “available” can mean the option exists, while “enabled” means the user has actually set it up.
That distinction matters. Installing a plugin doesn’t magically protect every account. You might finish your own setup while the colleague who manages orders still logs in with only a password. Check each user’s status after rollout, especially if several people share responsibility for the site. And please don’t share one admin login between staff. Separate accounts make this much easier to check.
Why WordPress admins need it
An administrator can install plugins, change settings and add users. That’s a lot of control to hand over to anyone who guesses or steals a password. Maybe you used the same password on another service years ago, or typed it into a convincing fake login page. A second factor gives that password a much harder job.
At our small WordPress security and maintenance agency in Estonia, we work with businesses across the EU. My take is simple: if your website takes bookings or sells anything, protect the people who can change it. Start with admin accounts, then cover anyone else with meaningful access. If you’re also dealing with repeated password guesses, our guide to securing the WordPress login page explains the other login checks I’d put beside 2FA.
Types of 2FA, from best to worst
WordPress core doesn’t include 2FA by default, so you add it with a plugin. Pick a method the people using the site can actually manage. An elaborate setup that leaves half your staff locked out isn’t a win.
- Security key or passkey: A strong option when your chosen login setup supports it. A physical key is useful for administrators, though it may be more kit than a small team wants to carry. Check the exact plugin support rather than assuming every key or passkey works.
- Authenticator app (TOTP): My usual pick for a small business. An app generates a code that changes every 30 seconds, without waiting for a text or email. Aegis, 2FAS, Google Authenticator and Microsoft Authenticator are examples.
- Email code: Convenient, but only as safe as the mailbox receiving it. If someone can open that inbox, this second check loses much of its value.
- SMS code: Better than a password alone, but the weakest choice here. A SIM swap can move your phone number to someone else’s device.
The free Two Factor plugin, maintained by WordPress contributors, supports authenticator app TOTP, email codes, backup codes and FIDO U2F security keys. Our free Bearmor Security 2FA feature offers email 2FA for administrator accounts. That’s a diferent method from the app setup below, so choose the plugin that matches the method you want.
How to set up 2FA for WordPress admin, step by step
For an authenticator app setup, use a plugin that supports TOTP, such as Two Factor. Plugin screens vary a little, but the path should look like this:
- Back up the site first. Make sure you can reach your hosting account and its FTP access or file manager. If a plugin locks you out, you’ll need a way to disable it without opening WordPress.
- Install and activate the 2FA plugin. In WordPress, go to Plugins, add the plugin you’ve chosen and activate it. Don’t assume activation has already switched 2FA on for your account.
- Open Users → Profile. Find the plugin’s 2FA settings and enable the authenticator app method for your own user account.
- Scan the QR code. Open your authenticator app and add the WordPress account by scanning the code shown on your profile page. Label it with the site name so you can find it later.
- Confirm with the 6-digit code. Enter the code from the app where the plugin asks for it. Wait for a fresh code if the current one is about to expire.
- Generate backup codes. Save them in a password manager or print them and store them somewhere private. Not in a note on the same phone that holds your authenticator app.
- Test the login. Log out, then sign in using a private browser window. Check that the password and app code both work before you close your original browser session.
- Repeat for everyone with elevated access. Set it up for every administrator, editor and shop manager. Once their logins work, enforce 2FA if your plugin allows it.
Don’t rush that last step. A person who hasn’t saved backup codes yet shouldn’t discover an enforced login check while trying to update a product before opening time.
Make every admin use it
Your own 2FA won’t protect another admin’s account. Give each person their own login, help them enable their chosen method, and check their 2FA status afterward. Editors and shop managers deserve attention too: they may not control plugins, but they can still change content, products or orders.
If the plugin offers enforcement by user role, turn it on after everyone has tested a login. If it doesn’t, keep a short onboarding checklist and check accounts when staff change. Someone leaving the business should have their access removed, even if they used 2FA. A code isn’t a substitute for tidying up old accounts.
Lost your phone? Recovery without panic
Try a saved backup code first. Once you’re in, set up your new authenticator app and replace any backup codes you used. This is exactly why they belong somewhere other than your phone.
No backup code? Use FTP or your host’s file manager to rename the 2FA plugin’s folder inside wp-content/plugins. That disables the plugin so you can log in and sort out access. Then restore the folder name and re-enable the plugin only after you’ve fixed the account’s 2FA setup. If hosting access belongs to someone else, find out who that is before you need them at a bad hour.
What 2FA doesn’t cover
2FA protects the login flow where it’s enabled. It doesn’t automatically cover every way into a WordPress site. XML-RPC and application passwords can let some logins skip the 2FA step in many setups; check whether you use either and how your plugin handles them. Our explainer on XML-RPC in WordPress can help you decide whether to disable that route.
It also won’t undo a stolen logged-in session or cookie. And it won’t fix a weak hosting password or a vulnerable plugin. Keep those accounts secure, update the site, and pair 2FA with login limiting so bots can’t hammer the password screen unchecked.
Today’s job? Check your own 2FA status, save your backup codes somewhere sensible, then ask who else can log into your WordPress dashboard. The answer is your setup list.