Quick answer
To set up two-factor authentication on WordPress, install a reputable 2FA plugin (like Wordfence Login Security or a dedicated 2FA plugin), scan the QR code with an authenticator app such as Google Authenticator or Authy, save your backup codes, and enforce 2FA for all admin and editor accounts.
Key takeaways
- 2FA blocks logins even when a password has been stolen.
- An authenticator app is more secure than SMS-based codes.
- Enforce it for every admin and editor, not just your own account.
If you do one thing to secure your WordPress site this week, make it two-factor authentication. It means a stolen password alone isn't enough to log in — the attacker also needs the code from your phone. Here's how to set it up.
Choose a 2FA method
An authenticator app (Google Authenticator, Authy) or a hardware security key is the strongest option. Avoid SMS where you can — it's better than nothing, but it can be intercepted.
Install a 2FA plugin
Use a reputable plugin such as Wordfence Login Security or a dedicated two-factor plugin. Install and activate it from the official plugin directory.
Scan the QR code
Open your authenticator app, scan the QR code the plugin shows, and enter the generated code to confirm the pairing.
Save your backup codes
The plugin gives you one-time backup codes for when you don't have your phone. Store them somewhere safe — a password manager is ideal.
Enforce it for everyone who can edit
Require 2FA for all admin and editor accounts. A single un-protected admin account undoes the benefit for everyone else.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
An authenticator app (like Google Authenticator or Authy) or a hardware key is more secure than SMS, which can be intercepted or SIM-swapped.
Keep reading
How to Recover Your Google Rankings After a Hack
A hack can tank your search rankings. Here's how to recover them once the site is clean.
WordPress Security for Small Businesses: A Practical Guide
You don't need an IT team to secure a small-business WordPress site. Here's a practical, no-jargon plan that covers the essentials.
How to Secure a WooCommerce Store
A WooCommerce store handles money and customer data, which makes it a target. Here's how to secure it without hurting sales.