---
title: Two-factor authentication (2FA)
canonical: https://wpsecurityninja.com/dictionary/two-factor-authentication/
---
# Two-factor authentication (2FA)

Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.

Last updated: 2026-08-26

Also called: 2FA, two-factor authentication, two factor authentication, MFA, multi-factor authentication

## Related terms

- [Brute force](https://wpsecurityninja.com/dictionary/brute-force/): A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- [Credential stuffing](https://wpsecurityninja.com/dictionary/credential-stuffing/): Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- [Phishing](https://wpsecurityninja.com/dictionary/phishing/): Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
- [Login protection](https://wpsecurityninja.com/dictionary/login-protection/): Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
- [Account takeover](https://wpsecurityninja.com/dictionary/account-takeover/): Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
- [Application passwords](https://wpsecurityninja.com/dictionary/application-passwords/): Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.

[Full guide](https://wpsecurityninja.com/how-to-enable-two-factor-authentication-wordpress/)

## Why it matters for WordPress

Passwords leak from other sites, phishing, and shared agency logins. 2FA means the password alone should not open `wp-admin`. For site owners and agencies, it is one of the highest-value controls you can turn on in an afternoon.

## How it shows up in practice

- An authenticator prompt after the password on Administrator (and ideally Editor)
- Recovery codes stored offline for a lost phone
- Stuffing attempts that succeed on the password step, then fail without the code
- Support tickets from staff who need a recovery path after a device change

## What to do

1. Require 2FA for all privileged roles, not only your personal admin.
2. Prefer app-based TOTP over SMS when you have the choice.
3. Keep login rate limits on so stuffing still costs the attacker time.
4. Have a recovery path: an admin who can reset 2FA, or a second method such as email codes.

## In WP Security Ninja

[Two-factor authentication](https://wpsecurityninja.com/two-factor-authentication-2fa/) adds app or email codes for key roles. Rollout steps: [how to enable 2FA on WordPress](https://wpsecurityninja.com/how-to-enable-two-factor-authentication-wordpress/). Use it with [login protection](https://wpsecurityninja.com/login-protection/) so bots cannot spray forever while someone without 2FA still sits on Administrator. Broader login hardening: [WordPress login security guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/).