Two-Factor on WordPress, Set Up So You Cannot Lock Yourself Out
Two-factor authentication defeats the most common successful attack on WordPress: valid credentials obtained from a breach elsewhere and reused. It is also the change most likely to lock someone out, so the order below matters.
The short version
- Use an authenticator app, not SMS.
- Store backup codes outside the site before enforcing anything.
- Test in a private window before enforcing for others.
- Know how to disable it from the filesystem.
Why app codes rather than SMS
SMS can be intercepted through SIM swapping, depends on network coverage, and fails when travelling. Time-based codes from an authenticator app work offline, are not transferable by a phone company, and take about five seconds to use.
The setup order
1. Confirm filesystem access
You need to be able to rename a plugin folder over SFTP. This is your emergency exit.
2. Install a two-factor plugin
Choose one that supports time-based codes and generates backup codes.
3. Enable it on your own account only
Do not enforce for any role yet.
4. Scan the code and save backup codes
Store the backup codes in a password manager, never in the site itself.
5. Log out completely and log back in
Use a private window so you are testing the real flow, not a cached session.
6. Test one backup code
Confirm it works and then regenerate the set.
7. Tell your other administrators
Before you enforce it, with instructions and a deadline.
8. Enforce for the administrator role
Editors and authors can follow later.
Watch out
Never enforce two-factor for all roles on a site with users you cannot contact. You will create a support queue of people locked out of accounts they need.
If you lock yourself out
Rename the plugin’s folder over SFTP. WordPress deactivates a plugin whose files are missing, and you can log in normally. Rename it back afterwards and fix the underlying problem.
mv wp-content/plugins/two-factor wp-content/plugins/two-factor-disabled
# log in, fix the issue, then
mv wp-content/plugins/two-factor-disabled wp-content/plugins/two-factorApplication passwords
Services that connect to your site through the REST API cannot complete a two-factor prompt. WordPress includes application passwords for this: a separate credential per service, revocable individually, that bypasses the interactive login.
Create one per service rather than sharing one, name them clearly, and revoke any that belongs to a service you stopped using.
What two-factor does not cover
- XML-RPC, which authenticates separately. Disable or restrict it.
- Application passwords, which are a deliberate bypass. Audit them periodically.
- FTP, SSH and database access, each of which needs its own protection.
- Hosting account access, which should also have two-factor and usually does not.
Common questions
Which plugin?
Any well-maintained option supporting time-based codes and backup codes. The feature set matters less than the plugin being actively updated.
Do I need it on a small site?
Credential reuse attacks are automated and indiscriminate. A small site is no less likely to be hit; it is simply less likely to be targeted deliberately.
What about hardware keys?
Excellent if your users will carry them. For most small teams, app codes are the realistic choice.
Sumit
Writes everything on TechMozz.