How to Set Up Two-Factor Authentication in WordPress

Two-factor authentication (2FA) adds a second verification step to your WordPress login, making it significantly harder for attackers to gain access even if they have your password. dotCanada recommends enabling 2FA for all admin accounts.

Choosing a 2FA Plugin

Several plugins can add 2FA to WordPress:

• Wordfence Security — includes 2FA as part of its broader security suite
• WP 2FA — a dedicated, easy-to-configure 2FA plugin
• miniOrange Google Authenticator — supports multiple authentication methods

Setting Up WP 2FA

1. Go to Plugins > Add New, search for WP 2FA, and click Install Now, then Activate.
2. Navigate to Users > WP 2FA Settings to open the setup wizard.
3. Choose your authentication method — a time-based one-time password (TOTP) app like Google Authenticator or Authy is recommended.
4. Set the policy: you can require 2FA for all users or specific roles such as administrators.
5. Each user will be prompted to configure their own 2FA on next login.

Completing Setup as a User

When prompted, scan the QR code displayed on screen with your authenticator app. Enter the six-digit code to confirm the setup. You will also be given backup codes — save these in a secure location in case you lose access to your device.

Need help with 2FA setup? Contact our support team and we will walk you through it.