---
title: Set up two-factor authentication (2FA)
canonical: https://wpsecurityninja.com/docs/firewall/how-to-set-up-two-factor-authentication-2fa-in-security-ninja/
---
Two-Factor Authentication (2FA) is a security process that requires users to provide two different authentication factors to verify themselves. This enhances security by ensuring that only the verified user can access their account. The two factors typically involve something the user knows (password) and something the user has (authentication app).

Security Ninja offers a straightforward implementation of 2FA to enhance the security of your WordPress site. The 2FA settings can be found under the "Firewall" section of the plugin.

### Configuring 2FA Settings

1.  **Enable 2FA**
    *   _Description:_ Activating this setting allows users to set up 2FA. Selected roles will be required to use it; leave all roles unchecked to make it opt-in only.
    *   _Warning:_ Turning this on prompts users with a required role to set up and then use 2FA to log in.
2.  **Grace Period**
    *   _Description:_ This setting determines the number of days users with a required role can skip setting up 2FA.
    *   _Default Value:_ 14 days
    *   _Note:_ Changing the number of days after enabling 2FA will recalculate the last day. Setting the value to 0 means required-role users cannot skip setup.
3.  **Required Roles**
    *   _Description:_ Only the selected roles will be required to use 2FA when logging in.
    *   _Options:_ This list changes based on what user roles are available on your website. Administrator is pre-selected when 2FA is not yet enabled. Leave all unchecked for opt-in only.
4.  **2FA Methods**
    *   _Description:_ Specifies the allowed login methods for 2FA.
    *   _Available:_ Authenticator app (time-based codes via QR or manual secret) and email codes. When both are enabled, users choose their preferred method at login and that preference is remembered.
5.  **2FA Introduction**
    *   _Description:_ This text will be displayed to users when they are prompted to set up 2FA.
    *   _Default Text:_ Secure your account with two-factor authentication.
6.  **2FA Enter Code**
    *   _Description:_ Shown next to the input field where the user enters their code.
    *   _Default Text:_ Enter the code from your 2FA app to continue logging in.

Turn on **Enable 2FA** in **Security Ninja → Firewall**, then configure grace period, required roles, allowed methods, and the login screen text on the same page.

![2FA settings in Security Ninja Firewall](https://wpsecurityninja.com/media/2026/07/2fa/all-2fa-settings.jpg)