Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSelf-hosted WordPress does not include interactive-login two-factor authentication (2FA) in core. To protect wp-admin, install a maintained 2FA plugin or connect WordPress to an identity provider, then have each user enroll a method from their own profile. The safest practical rollout combines a phishing-resistant passkey or FIDO2 security key where available, a TOTP authenticator app as a broadly compatible option, and offline backup codes tested before enforcement.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This guide covers the complete setup for a self-hosted WordPress site: choosing a method, installing and configuring the official Two-Factor plugin, enrolling users, protecting administrator accounts, keeping API integrations working, and recovering access after a lost phone or key.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does WordPress have two-factor authentication built in?
WordPress core does not provide 2FA for interactive browser logins. WordPress.org’s security guidance explicitly says that “WordPress core does not include 2FA.” A normal username and password can therefore remain the only challenge at wp-login.php unless you add a plugin or use an external identity provider.
That limitation applies to self-hosted WordPress installations. A hosting control panel, security service, or identity provider may offer a separate login layer, but that is not the same as a feature inside WordPress core. Check which layer is enforcing the second factor so you do not accidentally protect one entry point while leaving another exposed.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Two-factor authentication adds a second proof after the password. Depending on the method, that proof can be a time-based code, a hardware security key, a passkey, or a code delivered by email. It reduces the damage from a stolen or reused password, but it does not make a weak password, an unpatched site, or an unprotected email account safe by itself.
Choose the second factor before you change login policy
Decide which methods your users will use and which one will be mandatory for privileged accounts. The following options are supported by the official Two-Factor plugin when the relevant providers are enabled, or by a connected identity provider.
| Method | How it works and where it fits | Trade-offs and preparation |
|---|---|---|
| TOTP authenticator app | The app creates a six-digit (or similarly formatted) code from a shared secret. Codes work without cellular service and change every 30 seconds. | A lost or reset phone can block the user unless backup codes, a second enrolled device, or an administrator recovery process is available. The secret must be transferred carefully during enrollment. |
| FIDO2/WebAuthn security key or passkey | A hardware key or platform passkey proves possession using public-key cryptography. WordPress.org identifies passkeys and YubiKey devices as examples of this phishing-resistant approach. | The user needs a compatible browser, operating system, and hardware or platform authenticator. Register a spare key, or another passkey on a separate device, before making the method mandatory. |
| Email code | A one-time code is sent to the email address associated with the WordPress account. The official Two-Factor plugin can provide email codes when that provider is enabled. | Security now depends on the email account, its recovery options, and its own 2FA. A compromised mailbox can defeat both the password reset and the email-based second factor. |
For administrators, prefer a passkey or FIDO2 key when the site and users’ devices support it. TOTP is a strong, widely compatible fallback. Treat email codes as a convenience or recovery option rather than the only protection for a high-privilege account.
Prepare a recovery plan before enabling 2FA
Lockouts are preventable if recovery is designed before enforcement. Complete these checks while you still have a working administrator session:
- Create a current backup of the database and the files needed to restore the site. Confirm that the backup can actually be retrieved.
- Identify a separate administrator recovery route. This can be a second trusted administrator who can reset a user’s 2FA settings, or a documented hosting and database procedure handled by someone authorized to use it.
- Keep at least one second factor that is independent of the primary device. Examples are a spare security key, a second enrolled passkey, or securely stored backup codes.
- Decide where backup codes will be stored. An offline, access-controlled location is safer than an unencrypted note on the same phone used for TOTP.
- List every person, service, and integration that signs in. Human browser logins and REST/API clients should not share the same credential or recovery path.
Do not enforce 2FA for every account until a noncritical administrator account has completed a real logout, login, and recovery test. A test that only displays the enrollment screen does not prove that recovery works.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Install and activate a maintained 2FA plugin
The exact plugin screen and supported versions can change. The official “Two-Factor” plugin is the reference implementation described here; verify its current maintenance status and its stated WordPress and PHP requirements on the live plugin page before installing it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Sign in with an administrator account. Use an account that has a tested recovery route. Do not begin by enforcing 2FA on the only administrator.
- Back up the site. Save a database backup and the files required for restoration, then make sure another administrator or your hosting team can reach the recovery procedure.
- Open the plugin installer. In the dashboard, go to
Plugins → Add New. Search for Two-Factor, check that the listing is the maintained plugin you intend to use, and review its current compatibility information. - Install and activate it. Select Install Now, wait for the installation to finish, then select Activate. If the plugin reports an incompatible WordPress or PHP version, stop and resolve that compatibility issue instead of forcing activation.
- Open your profile settings. Go to
Users → Your Profile. Scroll to the Two-Factor Options section. Enrollment is per user; activating a provider does not automatically enroll every account. - Choose an enabled provider. Select TOTP for an authenticator app, email codes if that provider is enabled, or a passkey/security-key provider when your installation offers it. A site administrator may hide particular providers, so the choices can differ between users.
- Complete enrollment. Follow the provider’s prompt, submit the verification code or security-key response, and save the profile. Do not close the page before WordPress confirms that the configuration was saved.
- Generate backup codes. Create the codes in the Two-Factor section, copy or print them once, and store them offline. They are intended for one-time recovery, so treat them like spare keys.
- Test a complete login. Open a private browser window, sign out of the original session, and sign in with the password plus the new factor. Then test one backup code on the noncritical account and mark that code as consumed.
If the Two-Factor Options section is not present after activation, confirm that the plugin is active and that an administrator has not hidden all providers for your user. Also check whether a site-wide policy or an identity provider is controlling authentication outside the profile screen.
Set up a TOTP authenticator app
Time-based one-time passwords (TOTP) use a shared secret stored by WordPress and your authenticator app. The app calculates a short-lived code from that secret and the current time. WordPress.org’s Make documentation states that TOTP codes change every 30 seconds, so a code that was valid moments ago may be rejected after the next interval.
- In
Users → Your Profile → Two-Factor Options, select the TOTP or authenticator-app option. - Open the authenticator app on the phone or computer you will use at login.
- Scan the QR code shown by WordPress. If scanning is unavailable, choose the manual-entry option in the app and type the displayed secret exactly, preserving capitalization and digits.
- Wait for the app to display the current code, enter it into the WordPress confirmation field, and submit it before the 30-second window closes.
- Save the profile configuration and perform a fresh login in a private window.
Store the secret and backup codes according to your organization’s access policy. A screenshot of the QR code is effectively a copy of the second factor; do not leave it in an unencrypted shared folder. If the phone is replaced, migrate the authenticator entry before wiping the old device, or use backup codes and the documented administrator recovery process.
When TOTP codes are rejected
- Check the device’s date and time. A clock that is significantly wrong can produce codes outside the server’s acceptance window.
- Make sure you are entering the code for the correct WordPress site and account; authenticator apps often contain several similarly named entries.
- Use the newest displayed code rather than repeatedly submitting an expired one.
- If the secret was entered manually, remove the entry and enroll it again carefully instead of guessing at ambiguous characters.
Use a passkey or FIDO2 security key for phishing resistance
Passkeys and FIDO2/WebAuthn security keys authenticate with a public-private key pair. The private key stays on the device, while WordPress stores the corresponding public key. The browser verifies the site origin during the ceremony, which makes this method resistant to the fake-login pages that can capture passwords and TOTP codes.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
WordPress.org specifically names passkeys and YubiKey devices as examples. Availability depends on the plugin or identity provider, the browser, the operating system, and the user’s hardware. When the option is offered in Users → Your Profile → Two-Factor Options, follow the registration prompt and complete the device’s biometric, PIN, or touch requirement.
Register more than one key
Enroll a spare hardware key or a second platform passkey before making the method compulsory. Keep the spare in a separate secure location. A single key attached to one laptop is a single point of failure: loss, damage, or travel without that device can otherwise lock the user out.
Use security keys across multiple devices
A hardware key can be moved between compatible devices, while a platform passkey may be tied to a particular device ecosystem or synchronized account. Test the exact browsers and computers your administrators use. Confirm that the sign-in prompt appears at wp-login.php and that the spare key is recognized before ending the original session.
Understand the limits of email codes
Email codes are simple for users who cannot install an authenticator app, but they move the second-factor boundary to the mailbox. Anyone who controls that mailbox may be able to receive the code and password-reset messages. Protect the email account with its own strong password and 2FA, limit recovery delegates, and verify that users can access it during an outage.
If your policy requires phishing-resistant authentication for administrators, do not make email the sole required method. It can remain an additional provider or a temporary bridge while users enroll a security key or TOTP.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Generate, store, and test backup codes
Backup codes are one-time alternatives for the moments when the primary factor is unavailable. Generate them from the user’s Two-Factor Options section after enrollment. The plugin displays them at creation; save them before leaving the page because they may not be shown again in the same form.
- Store codes offline in a password manager with controlled emergency access, a printed copy in a secure location, or another method approved by your organization.
- Do not store the only copy on the phone protected by the missing factor.
- Record which codes have been used and regenerate the set if the list is exposed.
- Give each administrator a recovery route that does not depend on the same person, device, and mailbox failing together.
Test recovery before enforcement: sign in to a noncritical administrator account, deliberately use one backup code, confirm that it is consumed, and then verify that the normal factor still works. Document the exact steps for a lost phone, lost key, and compromised account. Recovery should include disabling the old factor, enrolling a replacement, rotating exposed credentials, and reviewing recent account activity.
Require 2FA for administrators and other privileged users
WordPress security guidance recommends 2FA for administrator accounts because those accounts can install code, change users, and alter site settings. Extend the requirement to editors, developers, support staff, and service accounts according to the capabilities they hold, not merely their job titles.
Recommended Free Tools
- Start with a pilot. Enroll a second administrator and one representative from each user group. Confirm normal login, backup-code use, and recovery.
- Set a deadline. Tell users which method is accepted, when enrollment closes, and who handles lockouts. Give them time to register a spare key or migrate a phone.
- Enforce in stages. Use the plugin’s policy controls or your identity provider to require 2FA first for administrators, then for other privileged roles. Keep a documented emergency administrator outside the enforcement test until recovery has been proven.
- Review exceptions. A temporary exception should have an owner, expiry date, and compensating control. Never leave an untracked permanent bypass for a legacy account.
- Remove stale access. When a user leaves or changes role, disable the account, revoke its factors, and review any application credentials created under it.
Do not confuse a user’s successful enrollment with site-wide enforcement. A person can have a configured TOTP provider while still being allowed to log in with only a password if the policy does not require the second factor.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep REST and other integrations working with Application Passwords
2FA protects interactive browser authentication, but automated clients should use a separate credential. WordPress Application Passwords were introduced in WordPress 5.6 in December 2020. They are revocable API credentials associated with a user and are intended for programmatic authentication.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Sign in as the user whose integration needs access and open
Users → Your Profile. - Find the Application Passwords section, enter a descriptive name such as the integration or deployment environment, and create the credential.
- Copy the generated password immediately. WordPress shows it only at creation; if it is lost, revoke it and create a replacement.
- Store it in the integration’s secret store, not in source code, a public configuration file, or a chat message.
- Use the credential over HTTPS and grant the associated user only the capabilities the integration requires.
- When the integration is retired, compromised, or transferred, revoke that Application Password without changing the user’s interactive password or other API credentials.
An Application Password cannot log in to wp-admin through wp-login.php; it is not a way around interactive 2FA. If an API client fails after enforcement, replace its interactive password with a dedicated Application Password and check that the request is using HTTPS, the correct username, and the correct site URL.
Run a controlled rollout and verify failure cases
Use a staging site or a noncritical administrator account for the first complete test. The goal is to exercise both success and failure paths, not merely to see a QR code.
- Log in from the normal browser with the password and enrolled factor.
- Log in from a private window or second device to confirm that no existing session is masking a problem.
- Use one backup code, confirm it becomes invalid after use, and verify that another code remains available.
- Sign in with the spare security key or second passkey if that is part of the recovery plan.
- Temporarily simulate a lost phone or key and follow the documented administrator recovery process.
- Run a real REST/API request with the dedicated Application Password after the 2FA policy is active.
- Record the date, account, factor, and result without storing secret codes in the test record.
Only after these checks pass should you require 2FA for the remaining privileged accounts. Keep monitoring login failures and support requests during the first enforcement window; a pattern of failures often reveals a clock problem, an unannounced email change, or an integration still using a browser password.
Troubleshoot common WordPress 2FA problems
| Symptom | Likely cause | Action |
|---|---|---|
| The Two-Factor Options section is missing. | The plugin is inactive, the wrong plugin was installed, or an administrator has hidden the available providers. | Check Plugins → Installed Plugins, confirm activation, then ask an administrator to review which providers are enabled or hidden for the user. |
| A TOTP code is always rejected. | The phone clock is out of sync, the code is for another account, or the shared secret was copied incorrectly. | Set the device to automatic network time, verify the account label, wait for a fresh 30-second code, and re-enroll if the secret may be wrong. |
| A user lost a phone. | The primary TOTP device is unavailable. | Use an unused backup code, a spare enrolled factor, or the documented administrator recovery route. After access returns, remove the old factor and enroll the replacement. |
| A user lost a security key. | The only registered key is unavailable. | Use the spare key, another passkey, or backup codes. Revoke the lost key from the account and register a replacement. |
| An API client stopped working after enforcement. | It is trying to use an interactive password against an API endpoint. | Create a dedicated Application Password under the integration user, use it over HTTPS, and revoke the old credential. |
| Email codes never arrive. | The mailbox is inaccessible, delivery is delayed, or the message is filtered. | Confirm the account’s email address, inspect spam and mail-delivery logs, and use a backup code or alternate factor instead of repeatedly requesting codes. |
| Every administrator is locked out. | 2FA was enforced before recovery was tested, or all factors were lost together. | Follow the preapproved hosting, database, or identity-provider recovery procedure. Restore access only through an authorized route, then reset factors and review account activity. |
Maintain 2FA after deployment
- Keep WordPress, PHP, the 2FA plugin, and the identity-provider components within their supported versions.
- Review administrator and other privileged-user accounts on a schedule; remove dormant accounts and stale factors.
- Ask users to verify their spare key or backup method after device changes, role changes, and extended leave.
- Regenerate backup codes when a set is exposed or a recovery event occurs.
- Revoke Application Passwords that are no longer needed, especially after staff turnover or a deployment migration.
- Document who can perform emergency recovery and audit that procedure periodically without recording secret values.
- Watch for repeated failed logins, unexpected factor resets, and new Application Passwords, and investigate them as security events.
WordPress Developer Resources describes the password as the weakest link in the security of anything you do online. 2FA addresses that weakness most effectively when it is paired with tested recovery, least-privilege accounts, secure API credentials, and regular maintenance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
