WordPress two-factor authentication that people actually use

Why WordPress two-factor authentication matters

Passwords leak. People reuse them, and when another site is breached, those passwords end up in lists that attackers try against WordPress sites. An administrator account can change everything on your site, so one reused password can be enough.

Two-factor authentication adds a second proof that only the real person has. After the password, the user enters a code from their phone or email. A stolen password alone no longer opens the door.

It matters most for administrators, but it is worth asking for from anyone who can publish, manage a shop or change settings.

How WordPress two-factor authentication works in Stack Guard

When a user who has two-factor set up signs in, Stack Guard accepts the password and then sends the browser to a second step on your sign-in address. The sign-in session is only created once the second step passes.

• Authenticator app: Google Authenticator, Microsoft Authenticator, 1Password and similar apps show a 6-digit code that changes every 30 seconds. This is the strongest method and works on Free.
• Email code: a code is emailed each time the person signs in. Free.
• Email magic link: a one-click sign-in link instead of a code. Pro.
• Backup codes: every user gets 8, and each works once, for the day a phone is lost. Free.
• Secrets are encrypted with AES-256-GCM before they are stored, using a key derived from your site's own AUTH_KEY. Nothing is sent to an outside service.

Set up two-factor for your whole team

On the Login tab, open Sign-in security and switch on Two-Factor Authentication. Tick the methods people may choose and set how many minutes an emailed code or link stays valid (10 is a good start). Then choose who must use it under Require 2FA.

Administrators is the sensible first step and is available on every plan. Pro lets you require it for all users, chosen roles or named users, which is how you cover editors and shop managers.

Each person then opens their WordPress profile, clicks Set Up Two-Factor Authentication, scans the QR code or types the emailed code, confirms with their password and saves their backup codes in a password manager. Anyone who must use two-factor and has not set it up is taken to their profile until they do.

Who needs it, and what to plan for

Any site with more than one person signing in, a shop, a membership area or a client site is a good fit. Agencies can require it on every client site as a baseline.

Plan for lost phones. A backup code gets the person in, an administrator can reset their two-factor, and if you are the only administrator and locked out, the SMG_DISABLE_2FA switch in wp-config.php turns the step off until you remove the line.

One gap to close: apps that sign in with an application password skip the second step. If nothing needs them, switch application passwords off on the Hardening tab (Pro). XML-RPC sign-in is refused for users who have two-factor on.