July 28, 2026

WordPress two-factor authentication: the 10-minute setup that stops brute-force attacks

Your WordPress admin password is probably not as strong as you think. Even if it is, that doesn't matter much when attackers are running through millions of leaked passwords from other breaches, hoping one of them is yours. Two-factor authentication (2FA) is the single cheapest, fastest fix you can make to your site's security, and most owners still haven't done it.

Here's the walkthrough. Ten minutes, no jargon, and I'll tell you exactly what to do if you lock yourself out.

Why your password alone isn't enough

WordPress powers a huge chunk of the web, which means bots hammer /wp-login.php on almost every site, all day, every day. If you've ever looked at your server logs, you've seen it — hundreds or thousands of login attempts a week from IPs all over the world.

Three things make passwords fail:

Credential stuffing. When LinkedIn, Adobe, Canva, or LastPass gets breached, those username/password pairs end up in public dumps. Attackers try those exact combos against every WordPress site they can find. If you reused a password anywhere, you're exposed.

Brute-force attacks. Automated scripts guess common passwords: Password123!, [yourbusinessname]2024, admin, and thousands of variations. If your password is under 12 characters and based on a real word, a modern GPU can chew through it in hours.

Phishing. A convincing fake email sends you to a lookalike login page. You type your password. Done.

2FA breaks all three. Even if an attacker has your password, they still need the six-digit code from your phone. No code, no login.

Which plugin should you use?

Three solid options. Pick one and stop researching — they all work.

WP 2FA (by Melapress) — my default recommendation for most small-business sites. Free version covers everything you need: TOTP apps (Google Authenticator, Authy, 1Password), email-based codes, backup codes, and role enforcement. The setup wizard is genuinely friendly.

Wordfence Login Security — if you already run Wordfence for the firewall, the login security piece is bundled and free. One less plugin to manage. Works well, though the UI is a bit more technical.

Two Factor Authentication (by David Anderson / miniOrange variants) — fine, but I'd only pick these if the first two don't work for your setup for some reason.

Whatever you pick, avoid SMS-only 2FA. SIM-swapping is real, and text messages can be intercepted. Use an authenticator app (TOTP) as your primary method.

The 10-minute setup, step by step

I'll walk through this with WP 2FA since it's the most common choice.

Step 1: Install the plugin. In your WordPress admin, go to Plugins → Add New. Search for "WP 2FA." Install and activate.

Step 2: Run the setup wizard. It launches automatically. When it asks which methods to allow, pick "One-time code via 2FA app (TOTP)" as the primary and "Backup codes" as the fallback. Skip email codes unless you have to — email inboxes get compromised, and that defeats the point.

Step 3: Enroll your own account first. The wizard walks you through scanning a QR code with your authenticator app. I recommend Authy or 1Password if you want cloud sync across devices, or Google Authenticator if you want it to stay on one phone. Scan the code, type in the six-digit number your app shows, and confirm.

Step 4: Generate backup codes immediately. The plugin will offer you a set of one-time-use backup codes. Download them or copy them into a password manager. Print them out and put them in a drawer if you want the belt-and-suspenders approach. We'll come back to why this matters.

Step 5: Enforce 2FA for all admin-role users. This is the step most people skip, and it's the most important one. Go to WP 2FA → Settings → Policies. Set the policy to "Require 2FA for all users" or at minimum "Require for Administrators, Editors, and Shop Managers." Give users a grace period — 3 to 7 days is reasonable — so they can enroll without getting locked out on their next login.

Without enforcement, 2FA is just a suggestion. And I promise you, the person on your team who reuses Summer2023! across five sites is not going to enroll voluntarily.

Step 6: Test it. Log out. Log back in. Confirm you're prompted for the code. Then log out again and try one of your backup codes to make sure those work too.

That's it. You're done.

Backup codes: your "I lost my phone" insurance

This is the part people mess up. Backup codes are single-use codes you can enter instead of the code from your authenticator app. If your phone is lost, stolen, wiped, or dropped in a lake, backup codes are how you get back in.

Where to store them:

Password manager (1Password, Bitwarden) — best option for most people. Attach them to your WordPress login entry.
Printed copy in a locked drawer — old-school but works. Especially good for your primary admin account.
Encrypted note on a second device — fine as long as it's actually encrypted.

Where NOT to store them:

Your email inbox (if your email gets compromised, the codes are gone)
A sticky note on your monitor
The same phone that has your authenticator app on it

Generate a new set anytime you use one, or at least once a year. Old codes stop working when you regenerate.

What to do when you lock yourself out

It'll happen eventually. New phone, factory reset, uninstalled the wrong app. Here's your recovery path, in order.

Option 1: Use a backup code. This is what they're for. Enter one at the login prompt.

Option 2: Disable the 2FA plugin via file access. If you can reach your site's files through your hosting control panel's file manager, FTP, or SSH, you can temporarily disable the plugin. Rename the plugin folder:

/wp-content/plugins/wp-2fa

to something like:

/wp-content/plugins/wp-2fa-DISABLED

WordPress will treat it as inactive on the next page load. You can log in with just your password, re-enroll, and then rename the folder back.

Option 3: Database edit. If you have phpMyAdmin access through your host, you can remove the user meta entries the plugin created for your account. Look in the wp_usermeta table for rows tied to your user_id with meta keys starting with wp_2fa_. Delete those rows, log in, and re-enroll. Back up the database first.

Option 4: WP-CLI. If your host offers SSH and WP-CLI:

wp plugin deactivate wp-2fa

The point: file-system or database access to your site is your ultimate recovery path. If you don't know how to reach either, ask your host's support — most hosts will walk you through it, or do it for you, if you can prove you own the account.

A common mistake: people set up 2FA, lose access, and then panic-buy a new hosting account or restore a week-old backup and lose recent work. Don't. There's always a recovery path.

Combine 2FA with a few other login basics

2FA is the biggest lift, but a couple of small extras take you from "protected" to "actually hardened":

Limit login attempts. Most security plugins (Wordfence, Solid Security, Limit Login Attempts Reloaded) block an IP after a handful of failed tries. This stops brute-force bots cold before they even see the 2FA prompt.
Rename the login URL. Changing /wp-login.php to something like /mysite-login hides the front door from automated bots. It's not a real security control, but it dramatically reduces log noise and bot traffic.
Use unique, strong passwords for every admin. 2FA is your seatbelt. Passwords are your brakes. You want both.
Remove old admin accounts. That developer you worked with three years ago? Their account is still there. Delete it.

On a job earlier this year, I cleaned up a WordPress site for a Southern California contractor where a previous developer had left multiple stale admin accounts and no 2FA. An attacker had gotten in through one of those old accounts and planted a self-healing backdoor that a prior contractor hadn't fully removed. 115+ spam posts, hidden admin users, the works. If 2FA had been enforced across all admin roles from day one, that entire incident wouldn't have happened.

The bottom line

2FA on WordPress is 10 minutes of work that stops the overwhelming majority of automated attacks against your site. Install a plugin, enroll yourself, generate backup codes, and enforce it for every admin. That's the whole job.

If you'd rather not touch any of this yourself — or you want it done as part of a broader lockdown that includes login hardening, file permissions, admin cleanup, and a proper firewall config — that's exactly what my Site Hardening service covers. One-time engagement, and your site stops being the low-hanging fruit that bots and opportunists go after.

Either way: do it this week. The next brute-force wave is already hitting your login page.