← Back to Blog

Two-Factor Authentication in WordPress

Protect accounts even when a password is stolen by requiring a second authentication factor.

Veyra Admin

2 min read

  • Article
  • 2 minutes read
  • Reviewed August 4, 2026

Two-factor authentication requires two different forms of evidence before an account can sign in.

It reduces the risk that a stolen password alone will provide access.

WordPress core does not currently provide a complete built-in 2FA login system, so sites normally use a reputable plugin, identity provider or single sign-on platform.

Authentication Factors

Common factors include:

  • Something you know, such as a password.
  • Something you have, such as an authenticator app or security key.
  • Something you are, such as a biometric verified by a device.

Two passwords are not two-factor authentication because they belong to the same factor category.

Methods

Common methods include:

  • Time-based one-time passwords.
  • Push approval through an identity provider.
  • WebAuthn or hardware security keys.
  • Recovery codes.
  • SMS as a fallback where stronger methods are unavailable.

Phishing-resistant methods such as hardware-backed WebAuthn are preferable for high-risk accounts when supported.

Who Should Use 2FA?

Require it for:

  • Administrators.
  • Super Admins.
  • Developers and support staff.
  • Editors with broad publishing access.
  • Billing or ecommerce managers.
  • Accounts controlling security settings.

Consider broader rollout according to risk.

Recovery Planning

Store recovery codes securely and define an identity-verification process.

Avoid recovery procedures that let one unverified email request bypass 2FA.

Test the process before enforcing 2FA for all privileged users.

Rollout

  1. Select a maintained solution.
  2. Test on staging.
  3. Enroll administrators.
  4. Confirm time synchronization.
  5. Store recovery codes.
  6. Test lost-device recovery.
  7. Enforce by role where appropriate.
  8. Monitor enrollment and failures.

Frequently Asked Questions

Is SMS 2FA better than no 2FA?

It can reduce password-only risk, although authenticator apps and security keys are generally stronger.

What happens if a phone is lost?

Use a recovery code, backup factor or controlled administrator recovery process.

Continue Learning

Previous: [WordPress Password and Account Security](/resources/wordpress-manual/security/password-account-security/)

Next: [Roles, Capabilities and Access Control](/resources/wordpress-manual/security/roles-capabilities-access-control/)