How to Set Up Two-Factor Authentication in WordPress?

A password alone is no longer enough to protect a WordPress login. Leaked credential databases, phishing pages that look identical to your real login screen, and brute-force bots that never sleep all target the same weak point: a single secret string that, once guessed or stolen, hands over full access to your site. Two-factor authentication (2FA) closes that gap by requiring a second, time-limited proof of identity — usually a six-digit code from an authenticator app — before a login is allowed to complete.

This guide covers both approaches to adding 2FA to WordPress: installing a dedicated plugin (the right choice for almost everyone), and, for developers who need to understand or customize the mechanism, the actual hook points WordPress exposes for building a second authentication factor into the login flow.

How TOTP-Based 2FA Actually Works

The vast majority of WordPress 2FA plugins use TOTP (Time-based One-Time Password), the same standard behind Google Authenticator, Authy, and 1Password's authenticator feature. It works like this:

1. When you enable 2FA, the server generates a random secret key and shows it to you as a QR code.
2. Your authenticator app scans the QR code and stores that same secret.
3. Both the server and your app independently compute a 6-digit code from the secret plus the current Unix time, using the HMAC-based OTP algorithm defined in RFC 6238.
4. Because the code changes every 30 seconds and is derived from a shared secret that never travels over the network again after setup, an attacker who steals your password still can't log in without physical access to your phone.

No SMS message or email is involved in TOTP, which is deliberate — SMS can be intercepted via SIM-swapping, and email accounts are themselves a common target.

Option 1: Install a 2FA Plugin (Recommended)

For nearly every WordPress site, a plugin is the right call. Implementing OTP verification correctly means handling clock drift, secret storage, backup codes, and QR code generation — all solved problems that a maintained plugin gets right so you don't have to.

Two solid, actively maintained options:

• WP 2FA — free, supports TOTP apps, and lets you set 2FA as optional or mandatory per user role.
• Two-Factor — built and maintained by core WordPress contributors, supporting TOTP, email codes, and backup codes.
• Wordfence — if you're already using it for securing your WordPress website, its Login Security module includes 2FA alongside brute-force protection.

Setting Up WP 2FA

1. Go to Plugins > Add New, search for "WP 2FA," install, and activate it.
2. A setup wizard launches automatically. Choose TOTP (One-Time Password) as the method.
3. Scan the displayed QR code with an authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or the TOTP feature built into most password managers).
4. Enter the 6-digit code the app generates to confirm the pairing.
5. Download and store the backup codes the plugin generates — these let you log in if you lose access to your authenticator app.

Enforcing 2FA for Specific Roles

Under WP 2FA > Settings > 2FA Policies, you can require 2FA for specific roles rather than leaving it optional. This is worth doing at minimum for Administrator and Editor roles — anyone who can publish content or install plugins should be behind a second factor. Users who haven't set it up yet are given a grace period (configurable, default 3 days) before they're locked out of the dashboard until they enroll.

Option 2: Understanding the Hooks Behind 2FA (For Developers)

If you're building a custom authentication flow — say, integrating with an internal SSO system or a hardware token — WordPress's authenticate filter is the hook every 2FA plugin builds on. It runs after a username and password check but before WordPress considers the login complete, which makes it the correct place to demand a second factor.

Here's the actual shape of it, checking for a TOTP code stored against the user:

add_filter( 'authenticate', 'tw_require_2fa_verification', 30, 3 );

function tw_require_2fa_verification( $user, $username, $password ) {
    // Let a failed username/password check fail normally.
    if ( ! $user instanceof WP_User ) {
        return $user;
    }

    $secret = get_user_meta( $user->ID, 'tw_2fa_secret', true );

    // 2FA isn't enabled for this account — nothing more to check.
    if ( empty( $secret ) ) {
        return $user;
    }

    $submitted_code = isset( $_POST['tw_2fa_code'] ) ? sanitize_text_field( wp_unslash( $_POST['tw_2fa_code'] ) ) : '';

    if ( empty( $submitted_code ) ) {
        return new WP_Error(
            'tw_2fa_required',
            __( 'Enter the 6-digit code from your authenticator app to finish logging in.' )
        );
    }

    if ( ! tw_verify_totp_code( $secret, $submitted_code ) ) {
        return new WP_Error(
            'tw_2fa_invalid',
            __( 'That authentication code is incorrect or has expired. Please try again.' )
        );
    }

    return $user;
}

The priority of 30 matters — it needs to run after WordPress's own wp_authenticate_username_password() (priority 20) has already confirmed the password is correct, so $user is a real WP_User object rather than the plain string username still being checked.

Add the code field to the login form itself with the login_form action:

add_action( 'login_form', function () {
    ?>
    <p>
        <label for="tw_2fa_code"><?php esc_html_e( 'Authentication Code' ); ?></label>
        <input
            type="text"
            name="tw_2fa_code"
            id="tw_2fa_code"
            class="input"
            inputmode="numeric"
            autocomplete="one-time-code"
        />
    </p>
    <?php
} );

Don't hand-roll the TOTP verification math yourself. tw_verify_totp_code() above needs to implement RFC 6238 correctly, including a time-drift window (checking the previous and next 30-second window, since clocks aren't perfectly synced) and constant-time comparison to avoid timing attacks. Use a tested library like pragmarx/google2fa via Composer rather than writing the HMAC-SHA1 windowing logic from scratch — this is exactly the kind of code where a subtle bug silently breaks security rather than throwing a visible error.

Backup Codes: Don't Skip This Part

Every 2FA implementation, plugin or custom, needs a recovery path for when a phone is lost, replaced, or simply out of battery. The standard pattern is generating 8-10 single-use backup codes at enrollment time, storing them hashed (never in plaintext) the same way WordPress stores passwords:

function tw_generate_backup_codes( $user_id, $count = 10 ) {
    $codes        = [];
    $hashed_codes = [];

    for ( $i = 0; $i < $count; $i++ ) {
        $code           = wp_generate_password( 10, false );
        $codes[]        = $code;
        $hashed_codes[] = wp_hash_password( $code );
    }

    update_user_meta( $user_id, 'tw_2fa_backup_codes', $hashed_codes );

    return $codes; // Show these to the user once — they can't be retrieved again.
}

Each code should be marked as used (removed from the stored array) the moment it's redeemed, since a backup code that can be reused defeats the purpose of a second factor.

Combine 2FA with Other Login Hardening

2FA is strongest as one layer in a broader login-security setup, not a replacement for the basics. It's worth pairing with:

• Enforcing strong, unique passwords (see how to change your WordPress password if any admin account is still using a weak or reused one).
• Rate-limiting or locking out repeated failed login attempts.
• Restricting wp-admin access by IP where your team works from a known set of locations.

Together, these make credential-stuffing and brute-force attacks — the two most common ways WordPress sites get compromised — dramatically less effective, since a correct password alone stops being enough to get in.

Frequently Asked Questions (FAQ) About Two-Factor Authentication in WordPress

Conclusion

Two-factor authentication turns a single stolen or guessed password from a full compromise into a dead end, and for most sites it takes less than ten minutes to set up through a plugin like WP 2FA or Two-Factor. Enroll your Administrator and Editor accounts first, generate and store backup codes immediately, and make 2FA mandatory for any role that can touch content or settings.

If you're building custom authentication logic instead of using an existing plugin, the authenticate filter is the right hook to build on — just lean on a tested TOTP library for the verification itself rather than writing the time-window and hashing logic by hand. Security code is exactly the kind of code where a subtle mistake fails silently instead of throwing an error.