---
title: Set up and use 2FA as a user
canonical: https://wpsecurityninja.com/docs/firewall/setting-up-and-using-two-factor-authentication-2fa-for-users/
---
Two-factor authentication (2FA) requires a second step after your password. Your site admin chooses which methods are allowed: an authenticator app (time-based codes) and/or email codes.

Admin setup: [Enable 2FA in Security Ninja](https://wpsecurityninja.com/docs/firewall/how-to-set-up-two-factor-authentication-2fa-in-security-ninja/).

## First-time setup

When 2FA is enabled (and your role requires it, or you opt in), you are prompted on login.

![Set up 2FA with an authenticator app or email code](https://wpsecurityninja.com/media/2026/07/2fa/logging-in-scan-via-authenticator-app.jpg)

1. Enter your username and password as usual.
2. **Authenticator app:** Scan the QR code (or enter the secret manually) in an app such as Google Authenticator or Authy, then enter the 6-digit code to confirm.
3. **Email codes:** If the admin enabled email as a method, choose **Email code**, send a verification code to your inbox, and enter it on the login screen.

![Email verification for 2FA login](https://wpsecurityninja.com/media/2026/07/2fa/get-email-2fa.jpg)

When both methods are enabled, you choose a preferred method at login. That preference is remembered.

4. After a successful code, you are logged in.

If the admin set a grace period (default 14 days), you may see a link to skip setup for that period. A grace of 0 means required-role users cannot skip.

## Logging in after setup

1. Enter username and password.
2. Enter the code from your authenticator app, or the email code if that is your method.

![Enter your 2FA code at login](https://wpsecurityninja.com/media/2026/07/2fa/entering-2fa-code.jpg)

3. When the code is valid, you see a confirmation and are signed in.

![Verified 2FA login](https://wpsecurityninja.com/media/2026/07/2fa/verified-logging-in.jpg)

## Resetting 2FA

Admins can reset 2FA for users from the tools/settings described in [How to reset 2FA](https://wpsecurityninja.com/docs/firewall/how-to-reset-2fa/). If you are locked out, use the [secret access URL](https://wpsecurityninja.com/docs/firewall/secret-access-url/) or ask an admin to reset your 2FA.