How to Set Up 2FA on WordPress (wp-admin, 2026 Guide)

Short answer: WordPress has no built-in two-factor authentication, so you add it with a plugin. Install one of Two-Factor, WP 2FA, Wordfence Login Security or Solid Security, activate TOTP for your admin account, scan the QR code, and save the backup codes. Then close the two doors 2FA does not cover: XML-RPC and application passwords.

Why wp-admin is attacked constantly

Every WordPress site on the internet receives automated login attempts, whether it has ten visitors a month or ten thousand a day. The bots are not targeting you; they are trying leaked username and password pairs against every WordPress site they can find, because the login URL is predictable and the reward — a server that can host malware, send spam, or inject SEO spam links — is generic.

An admin account without 2FA is one credential-stuffing hit away from full site compromise. With 2FA, that entire category of automated attack stops working.

Step 1: Choose a plugin

Four solid options, all with free versions:

• Two-Factor — maintained by WordPress core contributors. Lightweight, no upsells, supports TOTP, email codes and security keys. The purist’s choice.
• WP 2FA — friendliest setup wizard, good for sites with non-technical authors. Can force 2FA on selected roles with a grace period.
• Wordfence Login Security — the 2FA component of Wordfence, standalone and light. Adds reCAPTCHA and login-attempt limiting.
• Solid Security (formerly iThemes) — 2FA as part of a broader hardening suite.

If you already run a security plugin, use its 2FA module rather than stacking two. Conflicting login filters are a common cause of lockouts.

Step 2: Enable TOTP for your account

The flow is similar across plugins:

1. Install and activate the plugin from Plugins → Add New.
2. Go to Users → Profile (or the plugin’s own settings screen).
3. Find the two-factor section and enable Time-based One-Time Password (TOTP) — sometimes labelled “Authenticator app”.
4. Scan the QR code with your authenticator app, or use the text key — see entering a setup key manually.
5. Enter the six-digit code to verify, then save the profile. Several plugins will not persist the secret until you click Update Profile.

Any standard app works — Google Authenticator, Authy, Aegis, 2FAS, Microsoft Authenticator, or a password manager. See the best authenticator apps if you have not chosen one, and how TOTP codes work for the mechanism.

Do not screenshot the QR code — it contains the raw secret key.

Step 3: Save backup codes before you log out

Every one of these plugins offers backup codes. Generate and save them now, in the same session.

Locking yourself out of WordPress is uniquely annoying because there is no support desk — recovery means database access through phpMyAdmin or WP-CLI to disable the plugin. That is fine if you are comfortable in a hosting control panel and a genuine emergency if you are not.

Store them offline or in an encrypted vault; see where to store backup codes safely. And read how to back up your authenticator app before you rely on a single phone.

Test before you close the tab: open a private browsing window and log in with 2FA. If it fails, you still have your original session to fix it.

Step 4: Enforce it for other users

Your own account is not the whole risk surface. An editor or author with a reused password is an equally good entry point, and contributors on client sites are often the weakest link.

WP 2FA and Wordfence can require 2FA by role, with a grace period during which users are prompted to set it up before being locked out. Apply it to Administrators and Editors at minimum.

Also audit your user list while you are there: delete accounts for people who have left, and demote anyone who does not need admin. Most sites have two or three admin accounts that should have been subscribers years ago.

Step 5: Close the doors 2FA does not cover

This is the part most guides omit, and it is why some sites get compromised despite having 2FA enabled.

• XML-RPC (/xmlrpc.php) accepts username and password authentication and bypasses the login form entirely — 2FA plugins do not intercept it. If you do not use the Jetpack or the classic mobile app, disable XML-RPC via your security plugin or server config.
• Application passwords (WordPress core, under Users → Profile) grant API access without 2FA by design. Review the list, revoke anything unfamiliar, and disable the feature if you do not use REST API integrations.
• The REST API can expose usernames at /wp-json/wp/v2/users. Bots harvest these to attack. Restrict it if you do not need public access.
• Your hosting account — 2FA on wp-admin achieves little if your cPanel, SFTP or registrar account has none. Secure those too; see securing your domain name.

Step 6: Layer the basics on top

Two-factor authentication stops credential attacks. It does nothing about the other common routes in:

• Limit login attempts, and consider changing the login URL to cut bot noise (obscurity, not security — do both).
• Keep plugins and themes updated. Vulnerable plugins, not weak passwords, are how most WordPress sites are actually breached.
• Remove plugins and themes you do not use — deactivated is not the same as deleted.
• Take backups you have actually tested restoring.

Frequently asked questions

Does WordPress have built-in 2FA?

No. WordPress core has no native two-factor authentication, though the community-maintained Two-Factor plugin is effectively the reference implementation. WordPress.com-hosted sites are different — 2FA is built into your WordPress.com account settings.

What if I lock myself out?

Disable the plugin without logging in: rename its folder in wp-content/plugins/ via SFTP or your host’s file manager, or run wp plugin deactivate with WP-CLI. WordPress deactivates the missing plugin automatically and you can log in again.

Will 2FA slow down my site?

No. These plugins run only on the login flow, not on page loads for visitors. There is no front-end performance cost.

Can I use a security key with WordPress?

Yes. The Two-Factor plugin and Wordfence both support FIDO2/WebAuthn keys. For an admin account on a site that earns money, this is worth doing — see what a hardware security key is and phishing-resistant MFA.

Why is my code rejected on WordPress but works elsewhere?

Server clock drift. TOTP depends on both ends agreeing on the time, and a misconfigured server clock breaks it even when your phone is correct. Ask your host to check NTP sync. See why 2FA codes get rejected.

Should clients and authors be forced to use 2FA?

For anyone who can publish or install plugins, yes. Use a grace period so nobody is surprised, and provide a one-page instruction sheet — resistance is usually confusion, not objection.

The bottom line

Install one plugin, enable TOTP, save the backup codes, and test in a private window before closing the tab. Then spend ten minutes on XML-RPC, application passwords and your user list — because those are the paths that make a “we had 2FA” site compromise possible.

Need a code to verify your setup? Our free online 2FA code generator runs entirely in your browser.