Two-factor authentication (2FA) asks for a second step after the password, usually a code from an authenticator app or email. Security Ninja Pro adds 2FA under Security Ninja → Firewall.
Site-owner walkthrough: how to enable 2FA on WordPress. End-user steps: set up and use 2FA.
Settings
Enable 2FA
Turns the feature on. Selected roles must use 2FA. Leave all roles unchecked to make enrollment opt-in only.
When you enable it, users in a required role are prompted to set up 2FA (after any grace period).
Backup codes
Off until you turn it on. A user who has finished 2FA setup can create a set of 8 codes from their WordPress profile. Each code is shown once and works once. Creating a new set replaces the old codes. A password change, or resetting 2FA, deletes them.
Remember this browser
How many days one browser can skip 2FA after a successful app or email code. It stays off at 0. The highest value is 90. The person still has to tick the box on the code screen. A backup code does not remember the browser. A password change, or resetting 2FA, asks for a code again. Lowering the number cuts short a browser that was remembered for longer.
Grace Period
Number of days a required-role user can skip setup. Default: 14. Set to 0 to require setup immediately. Changing the value after enable recalculates the last allowed day.
Required Roles
Only checked roles must use 2FA. The list matches roles on your site. Administrator is pre-selected when 2FA is not yet enabled. Leave all unchecked for opt-in only.
2FA Methods
- Authenticator app (time-based codes via QR or manual secret)
- Email codes
When both are enabled, the user picks a preferred method at login and that choice is remembered.
2FA Introduction
Text shown when a user is prompted to set up 2FA. Default: “Secure your account with two-factor authentication.”
2FA Enter Code
Text next to the code field at login. Default: “Enter the code from your 2FA app to continue logging in.”
Configure
- Go to Security Ninja → Firewall.
- Turn on Enable 2FA.
- Set grace period, required roles, methods, and login copy.
- Save settings.
- Confirm you can log in with a test account before requiring 2FA for all admins.
Save the secret access URL so you can recover if you lock yourself out.
Wrong codes
A wrong authenticator or email code uses the same limit as failed logins: 5 tries in 5 minutes, unless you changed those numbers. The wait lasts until that window ends. It does not use the longer IP-ban time by itself.
If the firewall is on, those wrong codes also count as failed logins for that IP, the same way a wrong password does. Security Ninja → Events stores the incorrect code attempt with the account name. With the firewall on, the same try is also listed as a failed login.
Authenticator secrets and WordPress salts
Authenticator app secrets are encrypted with your WordPress salts, AUTH_KEY and SECURE_AUTH_KEY in wp-config.php. Email codes are not.
The next time someone opens wp-admin, existing app secrets are re-encrypted with those salts. If you later change AUTH_KEY or SECURE_AUTH_KEY, people who use an authenticator app need to scan the QR code again. Email codes keep working.
More on salts: WordPress salts.
