Your WordPress password is only one secret standing between your site and everyone who wants into it. Passwords leak in data breaches, they get reused across sites, they get guessed by bots that try thousands of combinations an hour, and they get stolen by phishing emails. Two factor authentication, often shortened to 2FA, adds a second check after the password, and that second check is the difference between a stolen password and a stolen site.
WordPress core has no built in two factor authentication. There is no toggle in Settings that turns it on. You add 2FA with a free plugin, or with a small code snippet if you would rather not install another plugin. This guide covers both routes, explains backup codes and recovery, and shows how to enforce 2FA for admins, so you can pick the setup that fits your site and finish it today.
What is two factor authentication and why does WordPress need it?
Two factor authentication asks for two different kinds of proof before it lets someone in. The first factor is something you know, which is your password. The second factor is something you have, which is usually your phone. After you enter the correct password, WordPress asks for a six digit code from an authenticator app, or a code sent to your email. That code changes every 30 seconds, so a stolen password alone is useless to an attacker.
WordPress sites need this more than most, because the login page is public and the admin username is often easy to guess. Automated bots scan the internet for wp-login.php pages and hammer them with common passwords around the clock. A strong password helps, and limiting login attempts helps too, but 2FA closes the gap both leave open: the day a password leaks somewhere else and a bot tries it on your site. If you only secure one thing on your site this week, make it the login page. Our guide to limit login attempts in WordPress without a plugin pairs well with this one, because it slows the bots down while 2FA stops them outright.
Which free plugin should I use for WordPress 2FA?
The safest free choice is the plugin called Two Factor, published on WordPress.org and maintained by WordPress core contributors. It is free, with no premium upsell locking the basic features, and it supports three methods: an authenticator app using time based one time codes, codes sent by email, and single use backup codes for emergencies. Because it comes from people who work on WordPress core itself, it is kept up to date with new WordPress releases.
The other strong free option is WP 2FA by Melapress. It adds a setup wizard that walks each user through enabling 2FA, plus policies that let you require 2FA for specific roles and give users a grace period to set it up. Both are free, both work with standard authenticator apps, and either one is a good choice. Pick Two Factor for the simplest setup, and pick WP 2FA if you need role based enforcement. You can find both in the official plugin directory at WordPress.org.
How do I set up the Two Factor plugin step by step?
Setup takes about ten minutes. Install an authenticator app on your phone first, such as Google Authenticator or Authy, because you will need it during setup. Then go to Plugins, then Add New, search for Two Factor, install it, and activate it. Nothing changes on the login screen yet, because each user turns on 2FA in their own profile.
Open Users, then Profile, in your dashboard and scroll to the Two Factor Options section. Tick the authenticator app method, and a QR code appears on the screen. Open your authenticator app, tap the add button, and scan the code. The app immediately starts showing six digit codes that change every 30 seconds. Type the current code into the profile page to confirm the pairing works, then save. Log out, log back in, and confirm that WordPress asks for a code after your password.
Repeat the same steps for every admin account on the site, and ask your editors to do it for theirs. A site is only as secure as its weakest admin login, so one unprotected admin account undoes the work you did on your own. If a user loses access to their authenticator app, an admin can reset their 2FA methods from that user profile page. For a regular health check of your whole setup, read our guide to WordPress Site Health check explained.
How do I add email code login without a new plugin?
Some site owners would rather not install another plugin, and a small code snippet can add an email code step to the login flow instead. The idea is simple: when a user logs in, WordPress generates a six digit code, stores it briefly, emails it to the user, and asks for it before completing the login. The snippet below shows the sending half of that flow using the authenticate filter and the Code Snippets plugin. It generates a code with wp_rand, stores it for ten minutes, and emails it to the address on file.
add_filter( 'authenticate', 'vutg_email_code_check', 30, 3 );
function vutg_email_code_check( $user, $username, $password ) {
if ( ! $user instanceof WP_User ) {
return $user;
}
$code = get_transient( 'vutg_code_' . $user->ID );
if ( false === $code ) {
$code = wp_rand( 100000, 999999 );
set_transient( 'vutg_code_' . $user->ID, $code, 10 * MINUTE_IN_SECONDS );
wp_mail( $user->user_email, 'Your login code', 'Your code is ' . $code );
return new WP_Error( 'vutg_code_sent', 'We emailed a 6 digit code. Log in again and enter it.' );
}
return $user;
}Be honest with yourself about this route before you use it. The snippet above is a starting point, not a finished security system. A complete email code flow also needs a form field on the login screen to accept the code, a check that compares the entered code with the stored one, and protection against repeated guesses. Building all of that correctly takes real care, and a mistake can lock you out of your own site or leave a hole an attacker can use. For almost every site owner, the free plugin route in the previous section is the safer and faster choice. The official developer reference at developer.wordpress.org documents the authenticate filter and the functions used here if you want to study them before you build further.
What are backup codes and how do I use them?
Backup codes are single use codes that let you log in when your normal second factor is unavailable. Your phone battery dies, you lose the phone, you switch to a new phone and forget to move the authenticator app across: these are ordinary events, and backup codes exist for exactly those moments. Each code works once, so a set of ten codes gives you ten emergency logins. Generate them in your profile under the Two Factor options, and store them somewhere safe that is not your phone, such as a password manager.
Do not store backup codes in a plain text file on your computer, and never email them to yourself or share them in a chat message. Treat them like spare keys to your house: useful in an emergency, dangerous if the wrong person finds them. When you use a backup code to get in, go straight to your profile, turn off the old authenticator pairing, pair the new phone, and generate a fresh set of backup codes.
What do I do if I am locked out of WordPress 2FA?
First, try the backup code. That is what it is for, and it solves most lockouts in under a minute. If you have no backup codes, ask another admin on the site to log in, open your user profile, and reset your two factor methods. That is the cleanest recovery path, and it is the main reason every site should have at least two admin accounts.
If you are the only admin, you can disable the plugin from outside WordPress. Log into your hosting file manager or connect with FTP, open the wp-content/plugins folder, and rename the two-factor folder to something like two-factor-off. WordPress will deactivate the plugin automatically because it can no longer find it, and you can log in with your password alone. Log in, rename the folder back, and set up 2FA again from scratch. Only use this method when no other recovery path exists, and change your password afterwards. If the login page itself shows errors rather than a code prompt, our guide to fix the WordPress white screen of death covers the next steps, and our web hosting guide explains how to reach your host file manager.
Should I force 2FA for all admins and editors?
Yes for admins, and yes for editors on any site that matters. Admin accounts can install plugins, change themes, edit files, and create new users, so a compromised admin account is a compromised site. Editors can publish and edit any post, which is enough to deface a site or inject spam links. Start with admins, then editors, then everyone else.
Use a grace period rather than switching enforcement on overnight. WP 2FA lets you give users a set number of days to set up 2FA before it becomes mandatory, and that avoids locking out a colleague who is on holiday. Send a short message to your team explaining what 2FA is, why the site needs it, and where to get help, and offer to walk anyone through setup on a call. Pair the rollout with a captcha on the login form as well, because bots and humans are stopped by different defences, and our guide to add Google reCAPTCHA in WordPress without a plugin shows how to add that layer.
Finally, remember that 2FA protects the login page, not the whole site. It does not patch an outdated plugin, it does not block a vulnerable theme, and it does not replace backups. Keep WordPress, your themes, and your plugins updated, remove anything you no longer use, and keep a backup you have tested restoring. Security works in layers, and 2FA is one of the strongest layers you can add. For one more layer that is often overlooked, read our guide to disable XML-RPC in WordPress, because that old interface is another door bots knock on.
Frequently asked questions
Does WordPress have built-in two factor authentication?
No. WordPress core has no built-in 2FA, so you add it with a free plugin such as Two Factor or WP 2FA, or with a code snippet if you prefer no new plugin. The plugin route is recommended for most site owners, because it is tested, maintained, and handles recovery properly.
Is the free Two Factor plugin safe to use?
Yes. It is published on WordPress.org and maintained by WordPress core contributors, it is free with no premium lock on the basic methods, and it supports authenticator apps, email codes, and backup codes.
What happens if I lose my phone with the authenticator app?
Use one of your backup codes to log in, then pair your new phone and generate a fresh set of backup codes. If you have no backup codes, ask another admin to reset your 2FA methods, or rename the plugin folder through your hosting file manager to disable it temporarily and set it up again.
Does two factor authentication slow down logging in?
Only by a few seconds. You type your password, then type the six digit code from your phone or email, and you are in. Authenticator apps work offline, so there is no waiting for a text message.
Last updated: November 2026.
