How to Enforce Two-Factor Authentication (2FA) for WordPress Admins

This article is a localized edition of the Japanese original. Read the Japanese original

With two-factor authentication (2FA), nobody can log in without the code from an authenticator app or similar, even if a password leaks or is guessed by brute force. However, most 2FA plugins work on an opt-in basis, where each user turns it on for themselves, so simply installing one leaves some users without it.

This article explains two ways to require 2FA setup for specific roles, such as administrators and editors.

Either way, first set up 2FA on your own administrator account and confirm that you can log out and log back in before enforcing it.

Method 1: Enforce 2FA with WP 2FA

The free version of WP 2FA lets you set a policy that "enforces 2FA for all users or for users with specific roles," plus a grace period before setup is required (as of November 2026, according to the plugin page on wordpress.org). The free authentication methods are an authenticator app (TOTP) and email codes, and backup codes are also available.

wp plugin install wp-2fa --activate

To install it from the admin, go to Plugins → Add New and search for "WP 2FA." After activation, a setup guide appears: set up your own 2FA, then choose who is covered (all users or specific roles) and the grace period. Setting names can change between versions, so follow what the screens show.

Method 2: Enforce 2FA by adding code to the Two Factor plugin

Two Factor is a feature plugin developed by WordPress contributors. Version 0.17.0 (as of November 2026) supports an authenticator app (TOTP), email codes and backup codes (FIDO U2F, which existed earlier, was removed after browsers dropped support for it). Version 0.17.0 requires WordPress 7.0 or later and PHP 7.4 or later.

Two Factor has no feature that forces specific roles to set it up. So we add code that sends users without 2FA to their profile in the admin.

Step 1: Install it and set up your own 2FA

wp plugin install two-factor --activate

1. Open Users → Profile and scroll down to "Two-Factor Options."
2. Select "Authenticator App" and scan the QR code shown with a TOTP app such as Google Authenticator, Microsoft Authenticator or 1Password.
3. Enter the 6-digit code shown in the app to verify it.
4. Generate backup codes and store them somewhere safe, such as a password manager. They are your way in if you lose your phone.
5. Click "Update Profile."

Log out once and confirm that you're asked for a code after your password.

Step 2: Send users without 2FA to their profile

Save the following code as wp-content/mu-plugins/require-2fa.php (create the mu-plugins directory if it doesn't exist). Code in mu-plugins can't be deactivated from the admin, which makes it a good place for an enforcement mechanism.

<?php
/**
 * Plugin Name: Require Two Factor
 * Description: Until users in the listed roles set up 2FA, the admin only lets them open their profile.
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

// Roles that must use 2FA
function r2fa_required_roles(): array {
	return array( 'administrator', 'editor' );
}

// Does this user still need to set up 2FA?
function r2fa_needs_setup( WP_User $user ): bool {
	if ( ! class_exists( 'Two_Factor_Core' ) ) {
		return false; // Do nothing if Two Factor is inactive
	}
	if ( ! array_intersect( r2fa_required_roles(), (array) $user->roles ) ) {
		return false;
	}
	return ! Two_Factor_Core::is_user_using_two_factor( $user->ID );
}

// If any admin page other than the profile is opened, send the user to the 2FA section of the profile
add_action(
	'admin_init',
	function () {
		if ( wp_doing_ajax() || ( defined( 'WP_CLI' ) && WP_CLI ) ) {
			return;
		}
		$user = wp_get_current_user();
		if ( ! $user->exists() || ! r2fa_needs_setup( $user ) ) {
			return;
		}
		global $pagenow;
		if ( 'profile.php' === $pagenow ) {
			return;
		}
		wp_safe_redirect( admin_url( 'profile.php#two-factor-options' ) );
		exit;
	}
);

// Explain why on the profile screen
add_action(
	'admin_notices',
	function () {
		global $pagenow;
		$user = wp_get_current_user();
		if ( 'profile.php' !== $pagenow || ! $user->exists() || ! r2fa_needs_setup( $user ) ) {
			return;
		}
		echo '<div class="notice notice-error"><p>';
		echo esc_html( 'This account must use two-factor authentication. Register an authenticator app under Two-Factor Options below before using other screens.' );
		echo '</p></div>';
	}
);

• Two_Factor_Core::is_user_using_two_factor() returns true if the user has a usable (primary) authentication method set up.
• #two-factor-options is the ID of the settings section that Two Factor outputs on the profile screen.
• Change the target roles in the r2fa_required_roles() array. Add roles such as Author (author) if you want to cover them too.

This code means "after logging in, the user can't use other admin pages until 2FA is set up." It doesn't stop a user without 2FA from logging in with just a password. Once setup is done, the code is requested at every login from then on.

Step 3: Check who has set it up

Two Factor 0.17.0 includes WP-CLI commands that show each user's status.

# Status for one user (using_2fa, primary_provider, remaining backup codes, etc.)
wp two-factor status admin

# Show the status of every administrator in turn
for u in $(wp user list --role=administrator --field=user_login); do
  wp two-factor status "$u"
done

Users with using_2fa set to false haven't set it up yet.

What to do if someone is locked out

If a user can't log in because they lost their phone or deleted the authenticator app, they should first use a backup code. If they have no backup codes either, an administrator with SSH access can do the following.

# Two Factor 0.17.0 or later: disable all 2FA for the user (their sessions are destroyed too)
wp two-factor disable admin --yes

# If the user is only temporarily locked out after too many wrong codes, just clear the lock
wp two-factor unlock admin

# To turn off the plugin entirely
wp plugin deactivate two-factor

If SSH isn't available either, renaming the wp-content/plugins/two-factor folder via FTP or your host's file manager deactivates the plugin. The enforcement code in mu-plugins/require-2fa.php does nothing when Two Factor is inactive, so you can then get into the admin.

Access through APIs and WP-CLI

• By default, Two Factor refuses logins to XML-RPC or the REST API with the regular password for users who have 2FA set up, and allows only logins with an application password. Application passwords bypass 2FA, so revoke any you don't need under Users → Profile.
• WP-CLI runs on the server with a user you specify, so it isn't subject to 2FA. Control who has SSH access instead.

Things to watch out for

• Before enforcing 2FA, tell the affected users how to set it up and by when; that cuts down on support requests and lockouts.
• If you use email codes and mail from the server doesn't arrive, users can't log in. On sites where email delivery isn't reliable, rely mainly on authenticator apps and backup codes.
• Measures other than 2FA, such as limiting login attempts and protecting wp-login.php, are covered in WordPress brute-force protection.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)