How to manually add the WP 2FA encryption key to wp-config.php

WP 2FA uses a private encryption key to encrypt sensitive 2FA information. By default, WP 2FA stores this encryption key in your website’s wp-config.php file.

If WP 2FA cannot write the key to wp-config.php, it stores it in the WordPress database instead. In this guide, we explain how to find the encryption key in the database and manually add it to your wp-config.php file.

Why does WP 2FA store the encryption key in the database?

WP 2FA stores the encryption key in the database when it cannot write it to the wp-config.php file.

This can happen, for example, if WordPress does not have sufficient permissions to modify the file or if the wp-config.php file is split.

For more information about securing and managing this file, see our guide to securing the WordPress wp-config.php file.

How to check where the WP 2FA encryption key is stored

If WP 2FA cannot save the encryption key to wp-config.php, it displays a notification informing you that the key has been stored in the database.

If you do not see this notification, WP 2FA should already have written the encryption key to wp-config.php.

You can also check the file directly. Open wp-config.php and look for a WP2FA_ENCRYPT_KEY entry.

How to move the WP 2FA encryption key from the database to wp-config.php

Before making any changes, create a backup of your website and database.

Then follow these steps:

1. Disable the WP 2FA plugin.
2. Open your WordPress database and locate the WP 2FA encryption key. The option name is wp_2fa_secret_key.
   • On a single-site WordPress installation, the key is stored in the wp_options table.
   • On a WordPress multisite network, the key is stored in the wp_sitemeta table.
3. Copy the value of the wp_2fa_secret_key entry.Important: You need to copy the encryption key value stored in the database, not the option name wp_2fa_secret_key.
4. Open your wp-config.php file and add the following line:

define( 'WP2FA_ENCRYPT_KEY', 'wp_2fa_secret_key');

Important: Replace your-encryption-key with the actual encryption key value you copied from the database.
Do not enter wp_2fa_secret_key as the value. That is only the name of the database option containing the key.

5. Save the changes to wp-config.php.
6. Return to the WordPress database and delete the wp_2fa_secret_key entry so that the encryption key is no longer stored there.
7. Reactivate the WP 2FA plugin.

Verify the WP 2FA encryption key configuration

After reactivating WP 2FA, open wp-config.php and confirm that the WP2FA_ENCRYPT_KEY entry is present.

The encryption key is now stored in wp-config.php instead of the WordPress database.