What does WordPress two-factor authentication check?
WordPress two-factor authentication asks for the password and then a second code before wp-login.php opens the dashboard. The code changes about every 30 seconds in an authenticator app. A person who only has the password should stop at that second prompt.
WordPress has no switch for this under Settings. On a site you host yourself, including WordPress hosting from WebJi®, you add the check with a plugin on wp-login.php. The WordPress.com Security screen protects a WordPress.com account. It does not add a code to a self-hosted login.
Which second factor should you turn on?
Use one plugin, and use an authenticator app for every administrator. Google Authenticator and Microsoft Authenticator both read the QR code a TOTP plugin shows. If Wordfence Login Security already asks your user for a code, finish that setup and do not install WP 2FA as well. Two prompts on one login will lock a real user out.
| Second factor | Where the code comes from | Use it for |
|---|---|---|
| Authenticator app | A six-digit code on your phone, about every 30 seconds, including offline. | Administrators and anyone who can edit the site. |
| Backup codes | A list saved during setup. Each code works once. | The phone is gone and you still have the list. |
| Email code | A message to the account inbox, the same inbox that can reset the password. | Only a user who cannot install an app. Not the only factor for an administrator. |
| cPanel 2FA | A prompt on the hosting panel. | The cPanel login. It does not protect wp-login.php. |
An email code arrives in the same inbox that can reset the password. If someone else can read that mailbox, both checks fail together. Skip SMS on this checklist. It depends on the mobile network, and most plugins charge extra to send it.
- Stay logged in as an administrator in this browser until the private-window test passes.
- Install Google Authenticator or Microsoft Authenticator on the phone before you start.
- Choose a password manager or a printed page for the backup codes, not a photo on that phone.
- Confirm you can open wp-content/plugins in the hosting file manager, in case you need to rename the plugin.
How do you turn it on with WP 2FA?
Stay in this browser until a private window loads the dashboard only after a fresh code, and refuses a wrong one. The plugin to install is WP 2FA by Melapress. WebJi® does not turn this on with the hosting plan. You install it and pass the test yourself.
- Open Plugins, then Add New. Search for WP 2FA. Install and activate the plugin by Melapress. A setup wizard, or a WP 2FA item in the left menu, means it is on.
- In the wizard, choose the authenticator app. Continue until the screen shows a QR code. Do not choose email as the method for this administrator.
- On the phone, open Google Authenticator or Microsoft Authenticator, add an account, and scan that QR code. The app shows a six-digit code.
- Type the current code into the wizard and continue. If the site rejects it, set the phone clock to automatic time, wait for the next code, and try that one.
- Copy every one-time backup code the wizard shows. Store the list in a password manager or on paper. Each code works once. Do not leave the list only in a photo on the same phone.
- Keep this browser signed in. Open a private window and go to /wp-login.php. Enter the password, then a new code from the app. The dashboard should load. Enter a wrong code once. The login should stay on the code screen. Those two results mean two-factor authentication is on.
If the wizard closes before you see backup codes, open your profile or the WP 2FA user screen and generate them before you close this browser. A test that never asks for a code means the method was not saved for this user. Start the wizard again for your account.
How do you require it for administrators?
A code on your user does not cover other administrator accounts. Open WP 2FA, then 2FA Policies. Require two-factor authentication for the Administrator role and save. If a grace period is shown, leave enough time for every other administrator to scan a code.
After that period, sign in as an administrator who has not configured a code. The site should open the setup screen instead of the dashboard. That redirect means the requirement is in force. If you are the only administrator, your private-window test is the proof, and the policy screen should still list the Administrator role as required.
Do not require a code for Subscriber or Customer accounts unless those people use wp-admin. A shop checkout login is a different form. Forcing a code on every customer blocks people who never installed an authenticator app.
How do you sign in if the phone is gone?
On the code screen, choose the backup-code option and enter one unused code from the list you saved. The dashboard should load. That code will not work again. Generate a new list once you are in, and enrol the replacement phone before you log out.
If the list is gone and no other administrator can get in, turn the plugin off from the files. In the hosting file manager, or over FTP, open wp-content/plugins and rename wp-2fa to wp-2fa-off.
Reload /wp-login.php. The password alone should sign you in. Rename the folder back to wp-2fa, enrol a new device, and save new backup codes before you close the browser. If the code was coming from Wordfence, rename the wordfence folder instead. Do not rename both.
Email support@webji.services if the site is on WebJi® and you cannot find the folder. The inbox is staffed 24/7 in Hindi and English, and the first reply is usually under 60 minutes. Do not call the office number for support.
A missing code is not a password reset. Use Lost your password only after the screen is a password form again. If the password itself is rejected, follow the WordPress login not working checks once that form is back.
What does this code not protect?
The code does not slow a script that posts wrong passwords all day. Limit login attempts still has to stop that volume. Two-factor authentication only helps after a password is already correct.
Two-factor authentication in cPanel protects the hosting panel. It does not add a prompt to wp-login.php. Lock the panel if you want that login covered, and still finish the plugin test on the site.
There is no WordPress setting that adds this code without a plugin. Hiding the login address is a different job. Anyone who finds the new address can still use a stolen password until the code is required.
A Jetpack connection can protect the linked WordPress.com account. It is not a substitute for the private-window test on this site's own wp-login.php.
Frequently Asked Questions
How do I enable two-factor authentication in WordPress?
Install WP 2FA by Melapress, choose the authenticator app, scan the QR code, and save the backup codes. In a private window, the dashboard should load only after a fresh six-digit code, and a wrong code should stay on the login screen.
Can I use Google Authenticator with WordPress?
Yes. Google Authenticator and Microsoft Authenticator both scan the QR code from a TOTP plugin such as WP 2FA. The app then shows a six-digit code that changes about every 30 seconds. Type the current code at login.
What if I lose the phone that generates the codes?
Use one unused backup code at the login prompt. If you have no codes and no other administrator, rename wp-content/plugins/wp-2fa to wp-2fa-off in the file manager, sign in with the password, then rename it back and enrol a new phone. Email support@webji.services if you cannot find the folder. Do not call the office number.
How do I require 2FA for every administrator?
Open WP 2FA, then 2FA Policies. Require two-factor authentication for the Administrator role and save. After any grace period, an administrator who has not scanned a code should land on the setup screen instead of the dashboard.
Does two-factor authentication stop guessing on wp-login.php?
It blocks a correct password from opening the dashboard without the current code. It does not cap how many wrong passwords a script can post. You still need a login-attempt limit for that volume.
Does cPanel two-factor authentication protect WordPress?
No. cPanel two-factor authentication challenges the hosting panel. WordPress still asks only for the password until a plugin on wp-login.php passes the private-window test.