WordPress powers over 40% of all websites, making it the single most targeted platform for brute-force login attacks. Your wp-admin login page is constantly being probed by automated bots testing common passwords. Two-factor authentication stops these attacks completely — even if an attacker somehow obtains your password, they cannot access your site without the second factor.
WordPress.com vs Self-Hosted WordPress.org
There are two different WordPress products, and they handle 2FA differently. WordPress.com is the hosted platform — it has built-in two-step authentication in account settings and no plugin is required. WordPress.org is the self-hosted software that most sites run — it requires a plugin to add 2FA because the feature is not built in. This guide covers both.
Enabling 2FA on WordPress.com
- Sign in to WordPress.com and click your avatar.
- Go to Account Settings → Security → Two-Step Authentication.
- Click Get Started and choose your method: authenticator app, SMS, or security key.
- For authenticator app: scan the QR code, enter the confirmation code.
- Save the backup codes provided.
Adding 2FA to Self-Hosted WordPress (Plugin)
The recommended plugin is WP 2FA by Melapress (free on WordPress.org). It has over 60,000 active installations and a setup wizard that makes configuration straightforward.
- In your WordPress dashboard, go to Plugins → Add New.
- Search for WP 2FA and click Install, then Activate.
- The setup wizard launches automatically. Follow the steps to configure your 2FA policy.
- Choose which user roles require 2FA (recommended: at minimum, Administrator).
- Select the allowed 2FA methods — TOTP authenticator app is the most secure option.
- Each user who needs 2FA will be prompted to set it up on their next login.
Setting Up Your Authenticator App
Once the plugin is active and you begin the 2FA setup as a user, you will see a QR code. Open your authenticator app (Google Authenticator, Authy, 1Password, Bitwarden, or any TOTP-compatible app), add a new account, scan the QR code, and enter the 6-digit confirmation code. From that point forward, logging into wp-admin requires both your password and the current code from your app.
Enforcing 2FA for All Users
In WP 2FA's settings, you can make 2FA mandatory for specific roles. Under WP 2FA → Policies, set "Enforce 2FA" for Administrators and Editors at minimum. You can set a grace period (e.g. 3 days) to allow existing users time to set up 2FA before they are locked out. New users will be prompted to configure 2FA on first login.
Protecting wp-admin Beyond 2FA
2FA is the most impactful single change, but combining it with a few additional measures significantly hardens your WordPress login. Consider renaming the login URL from the default /wp-login.php using a plugin like WPS Hide Login — this eliminates the majority of automated bot attacks before they even reach the login form. Limit login attempts using a plugin like Limit Login Attempts Reloaded. And keep WordPress core, plugins, and themes updated — many WordPress compromises exploit vulnerabilities in outdated software, not just weak passwords.
Recovery If You Are Locked Out
If you lose access to your 2FA device, use your backup codes — these should have been saved during setup. If you have no backup codes, an administrator can disable 2FA for your account from the WordPress dashboard under WP 2FA settings. If you are the only administrator and cannot log in, you can deactivate the 2FA plugin by renaming its folder via FTP or cPanel's file manager, which disables it and lets you log in normally. Once in, re-enrol 2FA from scratch and save your backup codes this time.
Common WordPress 2FA Problems and Fixes
The most common problem after enabling 2FA is a rejected code, and the usual cause is time drift on your phone. TOTP codes are generated from your device clock, so enable automatic network time on both Android and iOS. If codes fail on a shared computer, check that you are entering the code for the correct account when you use one authenticator app for many sites. Plugin conflicts are also possible: a caching plugin or another security plugin that adds its own login rules can interfere with the 2FA prompt. If the prompt never appears after enabling a plugin, clear your site cache and try a different browser. When all else fails, an administrator can remove the 2FA requirement for your user account from the plugin's settings.
Choosing the Right 2FA Plugin for Your Site
Your choice depends on your setup. WP 2FA by Melapress offers the smoothest setup wizard and granular policies for user roles, making it a strong default for most sites. The Two Factor plugin by WordPress contributors is a leaner, no-frills option that adds TOTP without marketing noise. If you already run Wordfence for scanning and login protection, its built-in 2FA avoids installing an extra plugin. For sites with many editors or clients, look for a plugin that supports per-role enforcement and a grace period, so you can roll out 2FA without locking out users who have not configured it yet.
Securing Multisite Networks and Client Installations
On a WordPress Multisite network, security decisions live at the network level: a 2FA plugin installed network-wide can be configured so super admins cannot opt out, while policies for individual sites can be left to their own administrators. Decide whether enforcement should be global or per-site before enabling the plugin, because changing the policy later forces every site's users through the setup flow again. At minimum, require 2FA for every super admin — a compromised network admin account exposes every site in the network.
Agencies managing several client sites should avoid shared admin logins entirely. Create a separate administrator account per agency employee, enforce 2FA on each, and document the handover: when a project ends, the client removes the agency accounts rather than just changing one shared password. Keep each client's backup codes with the client, not in the agency's notes, so a departing employee cannot carry them into a competitor's hands.
What to Do If Someone Compromises Your WordPress Admin
Signs of a compromised admin include 2FA prompts you did not trigger, codes suddenly being rejected, unknown users appearing under Users → All Users, and plugins or themes you did not install. If you see any of these, do not simply log in and change the password — the attacker may already have added their own admin account and backdoor files. Log in from a clean device, check the user list first, delete unknown administrators, and review recent plugins and themes for anything unfamiliar.
Next, force a fresh 2FA enrollment for every administrator: reset their 2FA from the plugin settings, have them re-scan the QR code, and rotate the WordPress passwords for all users with edit capability. Run a security scanner such as Wordfence or a server-level malware check to find injected code, then restore any core, plugin, or theme files from a clean backup. Finally, re-enable your 2FA enforcement policy and review the site's recent login and file-change logs to understand how the attacker got in.
WordPress Backups and 2FA: What Survives a Restore
When you restore a WordPress backup, the 2FA plugin's settings and each user's enrollment records come back exactly as they were at the moment of the backup. That sounds convenient, but it has a trap: if you restore a database from before a user changed their phone, that user's stored authenticator secret refers to a dead device, and they will be locked out until an admin resets their 2FA. Restores also wipe users created after the backup date, and their 2FA records disappear with them.
Keep your own backup codes outside WordPress — in a password manager or printed copy — because a full site restore does not recover codes you never saved. After any restore, test a real login with 2FA on a staging copy before pointing traffic back at the site, and re-check the plugin's enforcement policy, since an older backup may contain an older, weaker policy. If your host offers off-site file backups, store the wp-config.php outside the web root as an extra layer that survives database restores.
Does 2FA Cover Every Way Into Your Site?
2FA protects the wp-admin login form, but WordPress has more doors. The XML-RPC endpoint (used by some mobile apps and pingback features) and the REST API can authenticate with a username and password without ever showing the 2FA prompt, depending on the plugin and server configuration. If you do not use XML-RPC, disable it — most security plugins do this with a switch — and check that your 2FA plugin also protects REST API login if your site accepts traffic there.
Just as important: WordPress 2FA does nothing for server-level access. Anyone with FTP, SFTP, cPanel, or SSH credentials can read and modify files without touching the login form, so enable the 2FA your hosting provider offers on the hosting account itself and disable password-based SSH login in favour of keys. Treat the hosting account as a second admin surface with its own authentication, not as part of WordPress.