WordPress Two-Factor Authentication: Two Factor Setup and Recovery

This article is a localized edition of the Japanese original. Read the Japanese original

With two-factor authentication (2FA), logging in requires something in addition to your password, such as a 6-digit code from an authenticator app on your phone. Even if a password leaks or is guessed, it is no longer enough to log in. WordPress core has no 2FA feature, so you add it with a plugin.

This article focuses on the free Two Factor plugin. Everything was checked as of November 2026 (Two Factor 0.17.0, WP 2FA 4.3.0).

What the Two Factor plugin is

Two Factor is a free plugin on wordpress.org, developed by people involved in WordPress core development under the WordPress organization on GitHub (WordPress/two-factor). It is not built into WordPress itself, but it has no extra features to wade through, and each user configures it entirely from their own profile screen.

These are the available methods:

The former FIDO U2F (security key) method was removed after browsers dropped support for it. If you want passkeys or security keys, a separate plugin, "Two-Factor Provider: WebAuthn", adds that method to Two Factor.

Install Two Factor

In the admin screen, go to Plugins → Add New Plugin, search for "Two Factor", then install and activate it. With WP-CLI:

wp plugin install two-factor --activate

Administrators can choose which methods are available on the site under Settings → Two-Factor (all are enabled by default). For example, you can turn off Email Codes on a server where mail delivery is unreliable.

Set up an authenticator app (TOTP)

Each user sets this up on their own profile screen.

1. In the admin screen, open Users → Profile
2. Scroll down to the "Two-Factor Options" section (the heading may be translated, depending on your language setting)
3. Enable "Authenticator App" and scan the QR code with your authenticator app (if you can't scan it, type in the key shown instead)
4. Enter the 6-digit code from the app to verify it
5. Generate spare codes under "Backup Codes" and print them or keep them somewhere safe, such as a password manager
6. Choose your default (primary) method and click "Update Profile"

From your next login, you'll be asked for a code after entering your password.

Administrators can manage the same section on another user's edit screen (Users → All Users → Edit for that user).

When codes are rejected

TOTP computes the code from a shared secret key and the current time (RFC 6238). If the server's clock and your phone's clock are far apart, even the correct code fails. Two Factor tolerates a drift of a few steps either way (one step is 30 seconds); beyond that, check time synchronization on the server (whether NTP is active in timedatectl). Also turn on automatic time on your phone.

Requiring 2FA for specific roles

Two Factor cannot force users in a given role (such as administrators) to set up 2FA. The plugin's FAQ lists enforcement as a tracked feature request. The two_factor_user_roles filter that this article used to mention does not exist.

To require 2FA for administrators or editors, use a plugin that can enforce it. For example, the free version of WP 2FA (by Melapress) can:

• Require 2FA for all users, or for users in specific roles
• Give users a grace period to set it up (or require it immediately with no grace period)
• Use an authenticator app (TOTP), email codes and backup codes
• Set your policy in the first-time setup wizard after activation

wp plugin install wp-2fa --activate

Activating Two Factor and WP 2FA together doubles up the login flow. Use only one of them.

Manage 2FA with WP-CLI

Since Two Factor 0.17.0, the plugin ships a wp two-factor WP-CLI command. You can specify a user by ID, login name or email address.

# Show a user's 2FA status
wp two-factor status admin

# List available methods
wp two-factor list-providers

# Regenerate backup codes (existing codes stop working; 10 by default)
wp two-factor backup-codes generate admin

# Clear only the rate limit after repeated failures (settings unchanged)
wp two-factor unlock admin

Backup codes are stored hashed, so they can't be read back from the database after you create them. If you lose them, generate new ones.

Getting back in after losing your phone

Log in with a backup code

When the login screen asks for a code, use the link to choose another method, pick "Backup Codes" and enter one of your saved codes. Each code works only once. After logging in, set up the authenticator app again on your profile screen and generate new backup codes.

Have another administrator reset it

If another administrator can log in, they open Users → All Users → Edit for that user, uncheck every enabled method in "Two-Factor Options" and click "Update User". The user can then log in with just a password.

Reset it with WP-CLI

If you can reach the server over SSH, this command resets all of that user's 2FA settings.

# Remove all of admin's 2FA settings without a confirmation prompt
wp two-factor disable admin --yes

# Disable only one method (check the name with list-providers)
wp two-factor disable admin Two_Factor_Totp

If you can reach neither the admin screen nor SSH

Temporarily rename the wp-content/plugins/two-factor folder with FTP or your host's file manager. This disables the plugin, and you can log in with just your password. After logging in, rename the folder back, activate the plugin and set it up again. While the plugin is off, every user can log in without 2FA, so keep this window short.

How it works with application passwords

Since WordPress 5.6, you can issue dedicated passwords for the REST API and XML-RPC, called application passwords (the "Application Passwords" section under Users → Profile). They are available on HTTPS sites or in a local development environment.

Users who have enabled 2FA in Two Factor can't authenticate to the REST API or XML-RPC with their regular password; only application passwords work (the default behavior of the two_factor_user_api_login_enable filter). If an external app or integration logs in as that user, issue an application password and switch it over.

# List a user's application passwords
wp user application-password list admin

# Create a new one (the password is shown only once)
wp user application-password create admin "External integration" --porcelain

For more on application passwords, see How to use application passwords in WordPress.

Decide these before you start

• Where to keep the backup codes (save them as soon as you create them)
• Who resets 2FA, and how, if someone loses the phone with the authenticator app (on a site with a single administrator, make sure you have SSH or FTP access)
• Whether to also limit login attempts (How to limit login attempts in WordPress)

Summary

• Install Two Factor, and have each user set up an authenticator app and backup codes under Profile.
• Two Factor can't enforce 2FA by role; if you need that, use a plugin with enforcement such as WP 2FA.
• If a phone is lost, try a backup code, a reset by another administrator, wp two-factor disable, and finally renaming the plugin folder, in that order.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)