Two-factor authentication for WordPress

What it does

A stolen or guessed password stops being enough to get into your site. After entering their password, users confirm the login with a one-time code, from an email or from an authenticator app on their phone.

You decide who has to use it. Enforcement is per role, so you can require 2FA for administrators and editors while leaving subscribers untouched.

How it works

The free plugin ships three verification methods. Email one-time codes work with zero setup for any user with a working inbox. Authenticator apps use the open TOTP and HOTP standards, so Google Authenticator, Authy, 1Password, Bitwarden and any other standards-based app all work.

Code entry is rate-limited: five failed attempts trigger a 15-minute lockout, so 2FA codes cannot be brute-forced. Authenticator secrets are stored encrypted in your database, and XML-RPC logins can be restricted so the second factor cannot be bypassed through the older API.

• Email one-time codes, no app required
• TOTP and HOTP authenticator apps
• Per-role enforcement
• 5-attempt limit with a 15-minute lockout
• Encrypted secret storage
• XML-RPC login restriction option

Free today, deeper with Pro

Everything above ships in the free plugin on WordPress.org. Pro extends the same module for teams: SMS codes through your own Twilio account, backup codes for when a phone is lost, trusted devices that skip the second step on hardware you approve, and a 2FA audit log of enrollments and verifications.

If you ever lock yourself out, recovery does not require touching the database: renaming the plugin folder over SFTP disables the plugin and restores standard logins.