How do I add two-factor authentication (2FA) to WordPress?

Why it matters

Passwords leak. They get reused on another site that's breached, typed into a fake login page, or guessed. Once someone has your password, WordPress can't tell them apart from you.

Two-factor authentication (2FA) adds something only you hold: a six-digit code from an app on your phone that changes every 30 seconds. To get in, an attacker needs both your password and your phone at the same moment. For an administrator account, that one change removes the most common way sites are taken over.

The standard behind those codes is TOTP (time-based one-time passwords). It's open, it runs offline, and every major authenticator app supports it, so you're not tied to one vendor.

Common mistakes

• Not saving recovery codes. Losing a phone without recovery codes is the most common way people lock themselves out after turning on 2FA. Print them or keep them in a password manager that isn't on the same phone.
• Using one phone for everything. If the codes and the recovery codes live on the same device, losing it loses both.
• Assuming 2FA covers every door. If xmlrpc.php still accepts passwords, or failed codes aren't counted, attackers can keep guessing. Close XML-RPC login and make sure 2FA failures count toward your login limit.
• QR codes made by a third-party service. Some setups draw the QR code using an external image service, which means your secret is sent over the internet. Prefer a QR code made on your own server.
• Changing security salts without a plan. In some setups the 2FA secrets are tied to your WordPress salts. Know what your plugin does if the salts change.

Without a plugin

There's no honest way to add TOTP 2FA to WordPress without code. The options outside a WordPress plugin are:

• Your host's login protection. Some managed hosts put a 2FA layer in front of wp-admin. It's convenient where available, but it isn't portable when you move hosts.
• Single sign-on. Larger teams can route WordPress logins through an identity provider that enforces 2FA. Strong, but more setup than most small sites need.
• HTTP basic auth on wp-admin. This adds a second password, not a second factor. It slows bots, but a leaked password list can contain both.

If you write your own, you'll need to store each user's secret encrypted, verify codes with a small clock drift, rate-limit the code step, generate recovery codes and give admins a reset. That's a lot of security-critical code to maintain alone.

If something goes wrong

• The code is always "invalid". Check the time on your phone. TOTP depends on the clock; turn on automatic time in your phone's settings.

• You lost your phone. Use a recovery code on the code screen. Each code works once.

• No recovery codes left. Add this line to wp-config.php:

  define( 'GATEKEEPER_2FA_DISABLE', true );
  

  Log in, set up 2FA again on your new phone, save the new codes, then remove the line.

• Another admin can help. An administrator can reset 2FA for your account from your user profile.

The full guide is in Locked out after changing the login URL.

With Hushfort

Hushfort's Two-Factor layer uses TOTP, so it works with any authenticator app.

• The QR code is generated locally. Your secret never leaves your server.
• Each user sets up 2FA from their own profile screen; administrators can reset it.
• Recovery codes can be downloaded or printed.
• Secrets are stored encrypted (AES-256 with an HMAC check).
• If your WordPress security salts change, 2FA doesn't silently switch off. Affected users sign in with a recovery code and are asked to set up 2FA again. You can also set a separate key, GATEKEEPER_2FA_KEY (32 characters or more), in wp-config.php so salts don't matter.
• Failed codes count toward Login Limits.