How to enable 2FA on WordPress

Two-factor authentication on WordPress means the password is not enough. After the usual login, the user enters a short code from an authenticator app or email. Stolen or reused passwords stop being a free ticket into wp-admin.

This is the how-to. Product overview: two-factor authentication. The broader playbook is the WordPress login security guide. Short definition: 2FA.

2FA is a Pro feature. Free still covers tests, vulns, and core integrity.

Enable 2FA in Security Ninja

Do this as an administrator.

1. Open Security Ninja → Firewall.
2. Turn on Enable 2FA.
3. Choose methods: authenticator app (time-based codes), email codes, or both.
4. Select Required roles. Administrator is pre-selected. Leave every role unchecked if you want opt-in only.
5. Set the grace period (default 14 days). 0 means required-role users cannot skip setup.
6. Save. Optionally edit the intro text and “enter code” label users see on the login screen.

Admin field-by-field notes: set up 2FA in Security Ninja.

Test one admin account in a private window before you require the whole team.

What each user does

When 2FA is on (and their role is required, or they opt in), login prompts them to enroll.

Authenticator app

1. Enter username and password as usual.
2. Scan the QR code in Google Authenticator, Authy, or a similar app. There is a manual secret if the camera fails.
3. Enter the 6-digit code to confirm.

Email codes

If you allowed email as a method, the user chooses Email code, sends a message to their inbox, and types that code on the login screen.

When both methods are allowed, the user picks a preference at login. The plugin remembers it.

User-facing steps with screenshots: set up and use 2FA as a user.

Who must enroll

Require 2FA for people who can break the site:

• Administrators
• Anyone who can install plugins, switch themes, or edit files
• Editors on stores or client sites if they can publish unchecked

Skip forcing it on every Subscriber. That creates support tickets without reducing much risk.

Agency rule: if a freelancer still has an administrator account, they enroll or they lose that role.

Grace period and rollout

The grace period is how you avoid locking the office out on a Monday.

• 14 days (default): required roles can skip setup until the window ends
• 0 days: next login for those roles must complete 2FA
• Changing the number after enable recalculates the last day

Tell the team in Slack or email before you drop grace to 0. Keep one extra administrator who already enrolled so you can recover others.

Lost phone, new device, or a lockout

Security Ninja does not print a sheet of recovery codes. Recovery is admin-side:

• Reset 2FA for one user from their WordPress profile so they can enroll again
• Bypass 2FA on that profile for a temporary exception
• Reset all users’ 2FA from Security Ninja → Tools when you need a clean start (how to reset 2FA)
• If email 2FA is allowed, that can be the other method while they replace the app

If you are the only admin and you are locked out, use the secret access URL or hosting/SFTP. Do not turn 2FA off for the whole site as the first move.

Pair 2FA with the rest of login hardening

2FA does not cap brute-force attempts by itself. Add login protection: failed-login limits, optional login URL rename, and fewer administrator accounts. Watch Events so repeated failures are visible.

Related reading

• Two-factor authentication (product)
• WordPress login security guide
• Login protection
• 2FA setup docs
• Bypass 2FA

Bottom line

Turn 2FA on for administrators, enroll one account yourself, then require the rest with a grace period. Authenticator apps are the default. Email codes help people who will not install an app. Keep an admin who can reset a lost phone. A password alone should not open wp-admin.