How to Secure WordPress with 2FA

Two-factor authentication (2FA) is one of the most secure methods today to protect your WordPress website from brute-force attacks.

When you use 2FA, you always have to confirm your WordPress backend login with a second method, which is a code that you receive through SMS, email, or an authenticator app like Google Authenticator.

Basically, you need more than just your password to log in.

In my opinion, it is a must-have security procedure that every WordPress website should enable.

In this tutorial, I’ll show you how to make your WordPress site safer with 2FA using a free plugin called Two-Factor.

Step 1: Installing Two-Factor Plugin

I use this plugin for all my WordPress sites.

It’s lightweight, with over 70,000 people using it, and it has a perfect 5-star rating. I’ve never had any problems with it.

The first step is super easy.

Just install and activate the plugin, and you’re good to go.

Open your WordPress dashboard, head to the plugins page, search for Two-Factor, and then simply install and activate the plugin.

Now that you’ve installed and activated the plugin, we’re all set to move on to step 2.

Step 2: Enabling 2FA

The plugin puts its settings on the user edit page.

When you edit any user on your site, just scroll down until you see the Two-Factor Options section.

You’ll find four 2FA methods to choose from: Email, Time-Based One-Time Password (TOTP), FIDO U2F Security Keys, and Backup Verification Codes (Single Use).

You can enable one or more of these 2FA methods as per your preference.

You can choose one of them as your primary method, which you’ll use by default when signing in.

If you ever lose access to your primary method, you can change the method during the sign-in process. Think of the other methods as backups to your primary one.

I always enable Email, TOTP, and Backup Verification Codes, with TOTP as my primary method.

If I ever lose access to my phone and can’t use the authenticator app, I can simply opt to receive a code via email or use a backup code for easy access.

Note: Your WordPress website needs to be able to send emails via SMTP for you to receive the code by email.

Select your preferred primary method – I suggest TOTP, but the choice is yours.

Make sure to enable at least one backup method. It won’t cause any issues if you enable two backup methods, as I do.

So, go ahead and set them up.

Conclusion and Final Thoughts

Adding Two-Factor Authentication to your WordPress site is like putting an extra lock on your door.

It makes sure only you can get in, even if someone has your password.

I hope this tutorial has been of great help to you.

If you found value in this tutorial or have any questions or feedback, please don’t hesitate to share your thoughts in the comments section below.

Your input is greatly appreciated, and you can also contact me directly if you prefer.