WordPress Two-Factor Authentication (2FA) with the Two Factor Plugin

This article is a localized edition of the Japanese original. Read the Japanese original

Two-factor authentication (2FA) in WordPress asks for something in addition to the password, such as "the 6-digit code shown in an authenticator app on your phone." Even if a password leaks, nobody can sign in without that second factor. This article shows how to add 2FA with the Two Factor plugin published on WordPress.org, how to make 2FA mandatory for administrator accounts, and how to recover if you get locked out. It is based on Two Factor 0.17.0 as of October 2026.

How two-factor authentication works

The most common method is TOTP (Time-based One-Time Password, RFC 6238).

1. During the first setup, the site and the authenticator app on your phone (Google Authenticator, Authy, 1Password and so on) share the same secret key. That is what scanning the QR code does.
2. At every sign-in, the site and the app each calculate the same 6-digit code from the secret key and the current time (in 30-second steps).
3. If the code you enter matches the code the site calculates, the second factor passes.

Because the code is derived from the time, it will not match if the server clock is far off. On a Linux server, check that timedatectl shows "System clock synchronized: yes".

Why use a plugin instead of building your own

You will find examples that build 2FA from the authenticate filter and a hand-written TOTP function, but making a login flow secure is harder than it looks. You have to get all of the following right, for example:

• Do not issue the login cookie until the second factor has passed after the password check
• Show a code entry screen and tie it to the user with a temporary token (nonce)
• Rate-limit attempts so codes cannot be brute-forced
• Make sure REST API and XML-RPC logins with only a password do not become a back door
• Re-verify the user when 2FA settings are changed

The Two Factor plugin already implements all of this and is maintained by a community that includes WordPress core contributors. Installing it and filling gaps with hooks is safer than writing your own.

Install the Two Factor plugin

In the admin, go to "Plugins" (プラグイン in the Japanese UI) → "Add New Plugin", search for "Two Factor", then install and activate it. With WP-CLI:

wp plugin install two-factor --activate

As of October 2026, the available authentication methods (providers) are:

The former FIDO U2F method has been removed. For passkeys or hardware keys, add the separate Two-Factor Provider: WebAuthn plugin.

Set up 2FA for each user

With Two Factor, each user sets up 2FA on their own profile screen. Activating the plugin alone does not change anyone's login.

1. Open "Users" → "Profile".
2. Scroll to the "Two-Factor Options" section (it may appear translated depending on your site language).
3. Enable "Authenticator App" and scan the QR code with your authenticator app. Enter the 6-digit code the app shows to confirm.
4. Enable "Backup Codes" and generate the codes. They are shown only this once, so store them somewhere safe, such as a password manager.
5. If you enabled more than one method, choose your primary method.
6. Click "Update Profile" to save.

After setting it up, sign out once and confirm that a code entry screen appears after the password and that you can sign in with the code from your app. The code entry screen also shows links for switching to another method, such as a backup code.

Administrators can open another user's edit screen from "Users" → "All Users" and change the same section. To stop a method from being used anywhere on the site, disable it under "Settings" (設定) → "Two-Factor".

Users with 2FA enabled can no longer sign in to the REST API or XML-RPC with their normal password. To connect from external tools, create an "Application Password" on the profile screen and use that.

Require 2FA for administrators

Two Factor has no settings screen for making 2FA mandatory per role (the plugin's FAQ also points developers to filters for this). Instead, use the two_factor_enabled_providers_for_user filter to force-enable emailed codes (Two_Factor_Email) for administrators who have not set up any 2FA method. The email provider needs no prior setup, so this makes 2FA mandatory.

The filter's first argument is "an array of enabled provider class names" and the second is "the user ID (an integer)". Note that it is not a WP_User object.

Save the following as wp-content/mu-plugins/require-2fa-admin.php (must-use plugins cannot be deactivated from the admin, which suits an enforcement rule).

<?php
/**
 * Plugin Name: Require 2FA for administrators
 * Description: With the Two Factor plugin, force emailed codes for administrators who have not set up 2FA
 */

add_filter(
	'two_factor_enabled_providers_for_user',
	function ( $enabled_providers, $user_id ) {
		if ( ! empty( $enabled_providers ) ) {
			return $enabled_providers; // Leave it alone if the user has set something up
		}

		$user = get_userdata( $user_id );
		if ( $user && in_array( 'administrator', (array) $user->roles, true ) ) {
			$enabled_providers[] = 'Two_Factor_Email';
		}

		return $enabled_providers;
	},
	10,
	2
);

When you roll it out, check the following:

• Email is delivered: If the code does not reach the administrator's email address, they cannot sign in. Make sending reliable first, for example with WP Mail SMTP, and confirm with a test email.
• The email provider is not disabled: If Email Codes is disabled under "Settings" → "Two-Factor", this code has no effect.
• Test in another browser: While still signed in to the admin, try signing in from another browser (or a private window), confirm the code arrives by email, and only then close the original session.
• Encourage moving to an authenticator app: If the mailbox is compromised, email no longer works as a second factor. Ideally, administrators set up an authenticator app and backup codes after signing in. The filter does nothing for users who already have a method set up.

To extend this to other roles (such as editors), change the in_array() condition. For plugins that can enforce 2FA by role, see setting up a plugin to enforce 2FA in WordPress.

Check and change the status with WP-CLI

Since Two Factor 0.17.0, the wp two-factor command is available. You can specify the user by ID, login name or email address.

# Show the 2FA status
wp two-factor status admin

# List registered providers
wp two-factor list-providers

# Enable emailed codes
wp two-factor enable admin Two_Factor_Email

# Regenerate backup codes (existing codes stop working)
wp two-factor backup-codes generate admin

Methods that need a shared secret, such as TOTP, cannot be enabled from WP-CLI. The user sets them up on the profile screen.

Whether 2FA is on is decided by the user meta _two_factor_enabled_providers (an array of enabled providers). _two_factor_provider only records the primary method, so changing it alone does not turn 2FA on. Make changes with the commands above or on the profile screen.

Recovering from a lockout

Here is how to recover if you lost the phone with your authenticator app and cannot find your backup codes either.

If you have backup codes: Use the link on the code entry screen to switch to a backup code, sign in, and set up 2FA again.

If there is another administrator: That administrator opens the user from "Users" → "All Users", unchecks the enabled methods under "Two-Factor Options", and clicks "Update User".

If you can reach the server over SSH: Reset the 2FA settings with WP-CLI.

# Reset all 2FA settings (skip the confirmation)
wp two-factor disable admin --yes

# Disable only the authenticator app
wp two-factor disable admin Two_Factor_Totp

# Clear only the temporary lock caused by failed attempts
wp two-factor unlock admin

On older versions without the wp two-factor command, reset by deleting the user meta. Back up the database before you do this.

wp db export before-2fa-reset.sql
wp user meta delete admin _two_factor_enabled_providers
wp user meta delete admin _two_factor_provider

If you installed the enforcement code from the previous section, administrators will still be asked for an emailed code after the reset. If the problem is that email does not arrive, temporarily move the file out of mu-plugins before you sign in.

Summary

• 2FA asks for something besides the password, such as a code from an authenticator app. TOTP assumes the server's clock is accurate
• Hand-built login flows easily leave back doors. Use the community-maintained Two Factor plugin and fill gaps with hooks
• Each user sets up an authenticator app and backup codes on their "Profile". Keep the backup codes somewhere safe
• To require 2FA for administrators, you can force emailed codes with two_factor_enabled_providers_for_user (the second argument is the user ID). Confirm that email is delivered first
• Check status and recover with wp two-factor status and wp two-factor disable. Changing only _two_factor_provider does not turn 2FA on

Login protection works better when 2FA is combined with defenses against password guessing. See also brute-force attack prevention for WordPress.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)