How to Secure WordPress with 2FA
Learn the simple steps to lock down your WordPress site with two-factor authentication.
Two-factor authentication (2FA) is one of the most secure methods today to protect your WordPress website from brute-force attacks.
When you use 2FA, you always have to confirm your WordPress backend login with a second method, which is a code that you receive through SMS, email, or an authenticator app like Google Authenticator.
Basically, you need more than just your password to log in.
In my opinion, it is a must-have security procedure that every WordPress website should enable.
Here is how to add 2FA to a WordPress site with a free plugin.
Installing Two-Factor Plugin
This is the plugin I used on every WordPress site I ran, back when I still ran them.
It is lightweight, widely installed and well rated, and it never gave me any trouble.
The first step is super easy.
Just install and activate the plugin, and you’re good to go.
Open your WordPress dashboard, head to the plugins page, search for Two-Factor, and then simply install and activate the plugin.
Configuring 2FA
The plugin puts its settings on the user edit page.
When you edit any user on your site, just scroll down until you see the Two-Factor Options section.
You’ll find four 2FA methods to choose from: Email, Time-Based One-Time Password (TOTP), FIDO U2F Security Keys, and Backup Verification Codes (Single Use).
You can enable one or more of these 2FA methods to suit your preference.
You can choose one of them as your primary method, which you’ll use by default when signing in.
If you ever lose access to your primary method, you can change the method during the sign-in process. Think of the other methods as backups to your primary one.
I always enable Email, TOTP, and Backup Verification Codes, with TOTP as my primary method.
If I ever lose access to my phone and can’t use the authenticator app, I can simply opt to receive a code via email or use a backup code for easy access.
Select your preferred primary method. I suggest TOTP, but the choice is yours.
Make sure to enable at least one backup method. It won’t cause any issues if you enable two backup methods, as I do.
So, go ahead and set them up.
Conclusion and Final Thoughts
Adding Two-Factor Authentication to your WordPress site is like putting an extra lock on your door.
It makes sure only you can get in, even if someone has your password.
A stolen WordPress password is no longer enough to get in.