Two-factor authentication on WordPress and hosting: how to turn it on right without locking yourself out

To enable two-factor authentication on WordPress, install a 2FA plugin (WordPress still has no built-in option), scan the QR code with an authenticator app, save the recovery codes, and test the login in a private browser window before you log out. Then switch on 2FA for your hosting panel and for the email account that receives your password resets.

Lockouts usually come from two mistakes: skipping the recovery codes, or making 2FA mandatory for a whole team before anyone has set it up. Below is the order we follow, which plugins make sense in 2026, how to roll 2FA out to a team, and exactly what to do if you get stuck anyway.

What 2FA is and why it matters, even for a small site

2FA means that on top of your password (something you know) you need a second factor (something you have) to log in. Usually that's a six-digit code from an app on your phone that changes every 30 seconds.

Why bother on a small brochure site? Because WordPress login attacks are almost always automated. Bots try password lists against /wp-login.php around the clock; nobody is targeting you personally, you're just an address on a list. With 2FA on, a guessed or leaked password is no longer enough, because the bot doesn't have your phone.

It's worth doing on three fronts: your WordPress accounts, your hosting account (cPanel, Plesk or your provider's own panel), and the email inbox that receives password resets. The last two often matter more, because from there someone can reset everything else or wipe the site along with its backups.

2FA isn't the whole job, though. It works alongside unique passwords, up-to-date plugins, regular backups and a limit on login attempts.

SMS, email, app or passkey: which 2FA method to pick

Not all second factors are equal. For a small business site, they compare like this:

For most businesses we recommend an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 2FAS, or a password manager that handles one-time codes, such as 1Password) plus saved recovery codes. If your plugin supports passkeys, add one as well. The US Cybersecurity and Infrastructure Security Agency recommends phishing-resistant MFA based on FIDO/WebAuthn, the standard behind passkeys and security keys, and warns that SMS codes are exposed to SIM swapping.

One detail that trips people up: app codes depend on the clock. Keep your phone's date and time set to automatic. If every code gets rejected, a wrong clock on the phone or on the server is the usual cause.

Which WordPress 2FA plugin to use in 2026

WordPress core still doesn't include two-factor login, so you need a plugin. These free options are actively maintained:

Pick one. Two 2FA plugins on the same login form tend to get in each other's way.

Two-Factor is the lightest choice for a site with a single owner (passkeys there need a separate add-on plugin). If you have a team and want to force 2FA on certain roles, use WP 2FA, Wordfence or Kadence Security, because Two-Factor has no enforcement setting of its own.

If you relied on the standalone Wordfence Login Security plugin: it was closed on WordPress.org on 17 August 2026 at its author's request and can no longer be downloaded. The same 2FA, now with passkeys, is part of the main Wordfence Security plugin, so move to that instead of building on the old one.

How to enable 2FA on WordPress, step by step

The flow is almost identical in every plugin:

• Install and activate the plugin. In Wordfence, 2FA is switched off on new installs, so first turn on Enable 2FA in the Login Security settings.
• Open your own 2FA screen. In Two-Factor it's the Two-Factor Options section under Users > Profile; WP 2FA starts a setup wizard (later you manage it from the same profile page); in Wordfence it's Wordfence > Login Security > My 2FA.
• Open your authenticator app, add a new account and scan the QR code. If you can't scan because you're on that same phone, type in the setup key the plugin shows next to the QR code instead.
• Save the recovery codes now, before anything else. Download or print them. Two-Factor gives you 10 backup codes by default; Wordfence's recovery codes are 16 characters long, and each one works only once.
• Enter the current six-digit code to confirm, then save or activate.
• Keep this tab open and test the login in a private (incognito) window. Only log out of your original session once the test works.

That last step is the one most people skip, and it's the one that saves you: if something is off, you can still switch 2FA back off from the session that's still open.

Rolling 2FA out to a team without locking anyone out

If several people log in to the site (you, a colleague, the client, a developer), 2FA needs a small plan, not just a switch:

• One person, one account. Never share an admin login: the 2FA secret lives on one phone, so either only that person can get in, or the setup key ends up pasted in a group chat.
• Keep two administrator accounts with 2FA, held by two different people (the owner and the developer, for example), so one can reset the other. Everyone else gets the lowest role that does the job; our guide to WordPress roles and permissions helps you decide.
• Set up and test your own 2FA first. Only then make it mandatory for others.
• Require 2FA for Administrators and Editors (and Shop Managers on a WooCommerce site). Keep it optional for shop customers; Wordfence itself advises against forcing it on them.
• Use a grace period. In Wordfence the default is 10 days, but administrators get no grace period by default, so a new admin either sets up 2FA straight away or gets a grace period when you create the account. With the grace period at 0, anyone in a required role who hasn't set up 2FA can't log in at all.
• Tell people before you switch it on, with a two-line how-to. Wordfence can also email reminders to users who are still in their grace period.
• Before you reset someone's 2FA, call them to confirm it's really them. "I lost my phone, can you turn off my 2FA?" is a classic way to take over an account.
• When someone leaves, delete or downgrade their account the same day.

A useful safeguard: in Wordfence, requiring 2FA for administrators only kicks in once at least one admin has set it up, precisely so you can't lock every admin out at once.

Don't forget hosting, domain and email

Many people secure only WordPress and leave the back door open. The hosting account is the master key: from there someone can reset the WordPress password, reach the database, and delete files and backups.

Turn on 2FA in this order, from the most powerful account down:

• The email inbox that receives password resets (Google Workspace, Microsoft 365 or your mail provider). Whoever controls it can reset everything else, and it's the most overlooked link.
• Your provider or domain registrar account, where you pay and manage the domain. A takeover here can mean losing the domain.
• The hosting panel. In cPanel, go to Security > Two-Factor Authentication and click Set Up Two-Factor Authentication; if the option is missing, your host hasn't enabled it, so ask them. In Plesk it's in My Profile, under Multi-Factor Authentication (MFA). Other providers usually keep it in the account's security settings.
• WordPress, as described above.

cPanel's documentation doesn't mention backup codes: if you lose the phone, your host has to switch 2FA off for you. That's why, for the hosting account, it pays to use an authenticator that syncs or to scan the same QR code on a second device during setup.

Close the side doors: XML-RPC and application passwords

2FA protects the normal login form. Two other ways in can bypass it if nobody checks them:

• XML-RPC (xmlrpc.php) is an older remote-login route used by the WordPress mobile app and some Jetpack features, and a favorite target for password-guessing bots. Wordfence requires 2FA for XML-RPC logins by default. If your plugin doesn't cover it and you don't use the app or services that need it, turn off XML-RPC authentication.
• Application passwords are a WordPress feature for apps and integrations. They work over the REST API and XML-RPC without any 2FA prompt. You can see and revoke them on each user's profile page under Application Passwords, and the Last Used column shows which ones are still in use. Revoke any you don't recognize.

The safety net: how not to lock yourself out

This is where most people slip. A few rules that save you:

• Save the recovery codes before you close the setup screen. Keep them in a password manager or printed somewhere safe, but not only on the phone that holds the authenticator. Without them, a lost phone can mean a lost account.
• Use an authenticator that can move with you. Google Authenticator can sync codes to your Google Account; Authy has encrypted backups (its desktop apps ended in March 2024, so it's mobile-only now). Or scan the same QR code on a second device during setup.
• Changing phones? Move the codes to the new phone and check they work before you reset the old one.
• Keep hosting access working, with its own 2FA and recovery. It's your way back into WordPress if the plugin ever misbehaves.
• Make sure one trusted person knows where the recovery codes are kept.
• "Remember this device" options (Wordfence has an optional 30-day setting, off by default) are a convenience, not a backup plan.

Locked out anyway? Try these in order

• Use a recovery code. At the 2FA prompt, enter one of the codes you saved instead of the app code; some plugins show a separate "use a backup code" link.
• Ask another administrator. In Wordfence they go to Users > All Users, hover over your name, click Login Security and press Deactivate. In Two-Factor they open your profile from Users > All Users, untick your methods under Two-Factor Options and click Update User. In WP 2FA, Remove 2FA under Users > All Users allows one login without 2FA within the next hour.
• Check the clock. Set your phone's date and time to automatic. If codes fail for every user, the server clock may be wrong, and your host can fix that.
• Rename the plugin folder. In your hosting File Manager or over SFTP, open wp-content/plugins and rename the 2FA plugin's folder (for example wordfence to wordfence-disabled). WordPress deactivates it and you can log in with just your password. Then rename the folder back, reactivate the plugin on the Plugins page if needed, reset your 2FA and save new recovery codes. While the folder is renamed, everything that plugin protects is switched off, so do this in minutes, not days.
• Use WP-CLI if you have SSH access. With the Two-Factor plugin, the command wp two-factor disable followed by your username switches off all of your 2FA methods so you can set them up again.
• Locked out of hosting? There's no file trick there: contact your provider's support and be ready to prove the account is yours.

If the problem is the password itself rather than the code, see our guide on how to recover access to wp-admin.

How we approach this at MPO Web Studio

When we deliver a site, we don't hand it over with a single password scribbled on a note. We set up 2FA on WordPress and on hosting from the start, keep a second admin account for recovery, store the recovery codes somewhere safe, and show you exactly how to log in yourself so you don't depend on anyone.

We're a small web studio in Cluj-Napoca and we work remotely. It's far simpler to put these safety nets in place on day one than to dig a site out of a lockout or a hack later.

If you'd like us to check together how exposed your site is and switch on 2FA properly, without risking a lockout, send us a message on WhatsApp. We'll tell you honestly what's fine and what's worth fixing, with no empty promises.