Google Authenticator for WordPress Login: Setup Guide

This article is a localized edition of the Japanese original. Read the Japanese original

Introduction

Google Authenticator is an app that generates a 6-digit one-time password that changes every 30 seconds. Setting it up as two-factor authentication for WordPress prevents unauthorized access even if your password leaks.

Prerequisites

• Google Authenticator or Authy is installed on your smartphone
• You can access the WordPress admin screen

Setup Steps

Step 1: Install the Two Factor plugin

wp plugin install two-factor --activate

Step 2: Enable TOTP

1. In the admin screen, go to Users → Profile

2. Find the "Two-Factor Options" section

3. Check "Time Based One-Time Password (TOTP)"

4. Scan the QR code that appears with Google Authenticator

Step 3: Initial verification

Enter the 6-digit code shown in the app in the "Authentication Code" field and click "Submit". If it succeeds, TOTP is enabled.

Step 4: Logging in

1. Enter your username and password and click "Log In"

2. An "Authentication Code" field appears

3. Enter the 6-digit code from the Google Authenticator app

4. You are logged in

Entering the secret key manually (when you can’t use the QR code)

# Check the current TOTP secret key
wp user meta get {user_id} _two_factor_totp_key

# Set a new secret key manually
wp user meta update {user_id} _two_factor_totp_key 'BASE32-encoded secret key'

In Google Authenticator, choose "Enter a setup key" instead of "Scan a QR code" and type the Base32 key in manually.

Saving backup codes

# Check the backup codes
wp user meta get {user_id} _two_factor_backup_codes

# Regenerate backup codes (from the profile screen)
# Admin screen → Users → Profile → Backup Codes → Generate Verification Codes

If you can no longer use Google Authenticator

# Disable TOTP over SSH or via phpMyAdmin
wp user meta delete {user_id} _two_factor_enabled_providers
wp user meta delete {user_id} _two_factor_totp_key

# You can now log in with just your password

Moving to Authy (recommended)

Google Authenticator has no cloud backup, so you have to set it up again when you change smartphones. Authy supports cloud sync and can be used on multiple devices.

Migration steps:
1. Install Authy
2. WordPress profile → reset TOTP (remove the existing QR code)
3. Scan the new QR code with Authy
4. Delete the entry in Google Authenticator

Watch out for server clock drift

TOTP is time-based, so if the clocks on the server and the smartphone drift apart, the codes will not match.

# Check NTP synchronization (Linux)
timedatectl status
chronyc tracking

# Force a time sync
chronyc makestep

Caveats

• Save your backup codes in a safe place before you ever lose your smartphone
• When you change phones, always move to the new smartphone before you reset the old one
• Create separate TOTP entries for your development and production environments

Summary

Install the Two Factor plugin and scan the QR code on your profile screen, and two-factor authentication with Google Authenticator is enabled. Be sure to save your backup codes in case you lose your device.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)