How to Enable Two-Factor Authentication (2FA) in WordPress Using Wordfence Login Security
Passwords alone are no longer enough to protect modern websites. Attackers regularly use stolen passwords, phishing emails, malware and automated login attempts to gain access to WordPress websites.
Two-Factor Authentication (2FA) adds an additional layer of protection by requiring a temporary code from your mobile device before access is granted.
- Applies To: WordPress Websites
- Plugin: Wordfence Login Security
- Difficulty: Easy
- Estimated Time: 5 Minutes
This tutorial assumes that the Wordfence Login Security plugin is already installed and configured on your WordPress website.
If the plugin is not already installed, please contact your website administrator or support provider.
Why Two-Factor Authentication Is Important
Many WordPress website compromises occur because an attacker obtains a valid username and password.
Even if you use a strong password, there are many ways it can become exposed:
- Passwords reused on other websites that later suffer a data breach.
- Phishing emails designed to trick users into revealing login details.
- Malware installed on a computer or mobile device.
- Brute force attacks attempting thousands of password combinations.
- Shared passwords between team members.
Two-Factor Authentication prevents attackers from accessing your website even if they know your password because they would also need physical access to your mobile device.
This significantly reduces the risk of website compromise, content vandalism, spam injections, malware infections and unauthorised administrator access.
Table of Contents
Step 1 - Download Google Authenticator
Download the Google Authenticator app onto your mobile phone.
Tip: Search for Google Authenticator in your device's app store or use the download buttons below.
Step 2 - Open Your WordPress Profile
Log in to your WordPress administration area and navigate to your user profile.
Step 3 - Open Wordfence Login Security
Scroll down until you see the Wordfence Login Security section.
Click the Manage 2FA button.
Step 4 - Scan the QR Code
You will now be presented with a QR code.
This QR code contains the information required to link your WordPress account to the Google Authenticator application.
Step 5 - Open the Authenticator App
Open Google Authenticator on your mobile phone.
Tap the + icon and select Scan QR Code.
Step 6 - Verify the Account
Once the QR code has been scanned, your WordPress website will appear inside the Google Authenticator application.
A six-digit code will be generated automatically and refresh every 30 seconds.
Step 7 - Activate Two-Factor Authentication
Enter the six-digit code displayed within the Google Authenticator app into the verification field.
Click Activate to enable Two-Factor Authentication.
Step 8 - Recovery Codes (Optional)
After activation you may be offered the option to download recovery codes.
Recovery codes can be used to bypass Two-Factor Authentication.
Only download and store them if you understand how to keep them secure. Anyone who gains access to these codes may be able to access your WordPress account.
Step 9 - Logging In With 2FA Enabled
The next time you log in to WordPress you will first enter your username and password as normal.
You will then be prompted to enter the current six-digit code from your Google Authenticator app before access is granted.
That's it. Two-Factor Authentication is now enabled and helping to protect your website.