2026年11月12日

How to Set Up Two-Factor Authentication (2FA) in WordPress with Two Factor

This article is a localized edition of the Japanese original. Read the Japanese original

Two-factor authentication (2FA) asks for something in addition to your password at login, such as a six-digit number shown in an authenticator app on your phone. Even if a password leaks, nobody can log in without the second factor. It is a measure worth setting up for accounts that can change posts or site settings, such as administrators and editors.

This article uses the Two Factor plugin (slug two-factor), developed by the WordPress contributor team. The steps were checked in November 2026 with Two Factor 0.17.0 (WordPress 7.1).

Authentication methods in Two Factor

Method	Label on screen	What it does
Authenticator app (TOTP)	Authenticator App	Enter the six-digit code shown in an app such as Google Authenticator, Microsoft Authenticator or 1Password. Recommended
Recovery codes	Recovery Codes	Backup codes that can each be used once, for when you lose your phone
Email	Email	Enter a code sent to the user's email address at each login

FIDO U2F (physical security keys), which used to be available, has been removed because browsers dropped support for it.

The email method offers no protection if the email address or inbox is taken over. On a site whose emails don't get delivered, it also locks you out. Use the authenticator app wherever possible and keep email as a backup.

1. Install the plugin

In the admin, go to "Plugins" → "Add Plugin" and search for "Two Factor". Choose the one whose author is "WordPress.org", install it and activate it. If you have WP-CLI, this command does the same.

wp plugin install two-factor --activate

Activating the plugin doesn't change the login process by itself. Two-factor authentication is required only after a user turns it on in their own profile.

2. Register an authenticator app for your account

Before you start, stay logged in to the admin in another browser (or a private window) so you can undo a mistake.

Install an authenticator app on your phone.
In the admin, open "Users" → "Profile" and scroll down to "Two-Factor Options".
Tick "Enable Authenticator App" and scan the QR code that appears with your authenticator app.
Enter the six-digit code shown in the app and click "Verify".
Tick "Enable Recovery Codes" and click "Generate new recovery codes". Save the codes with "Download Codes" or "Copy Codes" and keep them somewhere other than your phone, such as a password manager or on paper. The codes are shown only on this screen.
Under "Primary Method", choose "Authenticator App" and click "Update Profile".

3. Log in to check it

Log out and log in again. If a code entry screen appears after your username and password, and entering the six digits from the authenticator app logs you in, the setup is complete.

The code entry screen also shows links to switch to other methods (recovery codes or email). If your phone isn't at hand, enter one recovery code to log in. A used code can't be used again, so generate a new set in your profile when you are running low.

Authenticator app codes are based on the time. If a correct code is rejected, check that your phone's clock is set automatically.

Other users’ settings and limiting the available methods

Having other users set it up. Each user sets up two-factor authentication in their own profile. Registering an authenticator app has to be done with the user's own phone, so an administrator can't do it for them. Send editors and other users the steps and have them set it up themselves.
What administrators can do. Administrators can open each user's edit screen from "Users" → "All Users", check the status under "Two-Factor Options", and turn on the email method.
Limiting methods site-wide. On the "Settings" → "Two-Factor" screen, you can choose methods that can't be used anywhere on the site. For example, you can disable the email method and allow only the authenticator app.

Check and reset with WP-CLI

Two Factor provides the wp two-factor command. You can specify a user by ID, username or email address.

# List the available methods
wp two-factor list-providers

# Status of user editor1 (whether 2FA is on, primary method, recovery codes left)
wp two-factor status editor1

# Turn on the email method for user editor1
wp two-factor enable editor1 Two_Factor_Email

# Regenerate recovery codes (old codes stop working)
wp two-factor backup-codes generate editor1

# Turn off all two-factor authentication for user editor1
wp two-factor disable editor1 --yes

# Clear only the login attempt limit (settings stay unchanged)
wp two-factor unlock editor1

The authenticator app (Two_Factor_Totp) needs a secret shared with the user's app, so it can't be enabled from the command line. Register it on the profile screen.

Getting back in when you are locked out

If you lost your phone and can't find your recovery codes, remove two-factor authentication in one of these ways.

Ask another administrator. If there is another administrator, have them open your profile from the user list and disable each method under "Two-Factor Options".
Use WP-CLI. If you have SSH, run wp two-factor disable username --yes.
Turn off the plugin. Use FTP or your hosting file manager to rename the wp-content/plugins/two-factor folder to something like two-factor-off. The plugin is deactivated and you can log in with just your password. After logging in, rename the folder back, activate it under "Plugins", and set it up again in your profile.

The third method also means that anyone who can get into the server can remove two-factor authentication. Use strong, unique passwords for FTP and your hosting control panel as well.

What to know when running it

REST API and XML-RPC. Users with two-factor authentication enabled can't log in to the REST API or XML-RPC with their regular password. If you post from external apps or services, create a dedicated password under "Application Passwords" in "Users" → "Profile" and use that.
Requiring it for everyone. Two Factor has no setting to require two-factor authentication for specific roles (its official description also says enforcement isn't available from the admin). If you want to make it mandatory for administrators and editors, consider a plugin such as WP 2FA (slug wp-2fa), which can enforce it with a grace period.
Back up before installing. Because this plugin affects how login works, back up the site before installing it and make sure you can work with files over FTP or similar.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)