---
title: Two-Factor Authentication (2FA) for WordPress
canonical: https://wpsecurityninja.com/two-factor-authentication-2fa/
---
# Make stolen passwords much less useful

Two-factor authentication is built into Security Ninja Pro, so you do not need another plugin. Require an authenticator app or email code for the roles you choose, with time for your team to enroll.

- [Get Pro](https://wpsecurityninja.com/pricing/)
- [Login protection](https://wpsecurityninja.com/login-protection/)

## Roll out 2FA at your own pace

Force 2FA for selected roles, or leave roles unchecked for opt-in only. Users can enable 2FA from their profile when you allow it.

- Required roles with optional grace period (default 14 days)
- Opt-in mode when you are not ready to require everyone
- Set grace period to 0 when required roles must enroll immediately

[How to enable 2FA](https://wpsecurityninja.com/how-to-enable-two-factor-authentication-wordpress/)

## Authenticator app or email

App setup includes a QR code and a manual secret key. You can also allow email codes when that is easier for your users.

- Time-based authenticator apps (Google Authenticator, Authy, and similar)
- Email verification codes when you allow that method
- Users pick app or email when both are allowed, and the preference is remembered

[User setup docs](https://wpsecurityninja.com/docs/firewall/setting-up-and-using-two-factor-authentication-2fa-for-users/)

## Admin control when someone gets stuck

Lost phone, new device, or a temporary exception? Admins can help without turning 2FA off for the whole site.

- Let one user bypass 2FA from their WordPress profile when needed
- Reset 2FA for one user from their profile
- Reset 2FA for everyone from Security Ninja Tools when you need a fresh start

[Bypass and recovery docs](https://wpsecurityninja.com/docs/firewall/how-to-allow-users-to-bypass-2fa-in-security-ninja/)

## Part of complete login hardening

Use 2FA with failed-login limits and a custom login URL for stronger sign-in protection.

- Brute-force limits
- Custom login URL
- Customize the message and code prompt on the 2FA screen

[Login protection overview](https://wpsecurityninja.com/login-protection/)

## FAQ

### How do I add two-factor authentication to WordPress?

Install Security Ninja Pro, open the 2FA settings, choose authenticator app and/or email codes, pick which roles must enroll, set a grace period if you need one, then have each user complete setup from their profile. Full walkthrough: [how to enable 2FA on WordPress](https://wpsecurityninja.com/how-to-enable-two-factor-authentication-wordpress/). Test one admin login before you require everyone.

### What is two-factor authentication (2FA)?

2FA adds a second step after the password. Even if someone steals or guesses a password, they still need a short code from an authenticator app or email before they can sign in.

### Why should WordPress sites use 2FA?

WordPress logins are a common target for password stuffing and brute-force attempts. A second factor makes stolen passwords much less useful, especially for administrators and editors.

### Is 2FA included in Free?

No. Two-factor authentication is a Security Ninja Pro feature.

### Which 2FA methods does Security Ninja support?

Authenticator apps (time-based one-time codes) and email codes. You choose which methods are allowed. When both are enabled, users pick one at login and that preference is remembered.

### Can I require 2FA only for administrators?

Yes. Choose which roles are required. Leave all roles unchecked if you want opt-in only, with no one forced to enroll.

### What if a user loses their phone or authenticator app?

An administrator can reset that user’s 2FA from their WordPress profile so they can enroll again. For special cases, admins can also enable Bypass 2FA on the profile. If email 2FA is allowed, that can be an alternate method.

### Will my team get locked out the day I turn it on?

Not if you use the grace period. Required-role users can skip setup for a set number of days (14 by default). Set it to 0 only when you want immediate enrollment.

## Add 2FA to your WordPress logins

Pro includes 2FA, login limits, rename login, Cloud Firewall, and malware scanning.

[Get Pro](https://wpsecurityninja.com/pricing/)