How to make 2FA mandatory for website users

To be an effective security measure, two-factor authentication (2FA) should ideally be used by every user on your WordPress website. If that is not possible, at least the users who have privileges to make changes on your WordPress website, such as users with administrator, editor, and author roles, should use 2FA.

By default, 2FA is optional. However, you can use 2FA policies to make it mandatory. This article explains how you can enforce 2FA on all your WordPress user accounts, as well as how to enforce 2FA only for specific users/user groups, including individual users, users with a specific role, or users of a specific individual site on a multisite network.

Where to find these settings

All of the settings covered in this guide are located under WP 2FA > 2FA Policies in your WordPress dashboard. This screen is organized into a few clearly labeled sections:

• Enforcement and exclusions – decide who must use 2FA, and who should be excluded from it.
• Sitewide 2FA policies – the default 2FA methods, grace period, and user access settings that apply site-wide, split across a 2FA Method Selection tab and a User Access Settings tab.
• Customize per user role (Premium) – optional overrides for the Administrator, Editor, Author, Contributor, and Subscriber roles, each with the same two tabs as above.

Making 2FA mandatory for all users

To require every user on your website to set up and use 2FA:

1. Go to WP 2FA > 2FA Policies > Enforcement and exclusions.

2. Under 2FA Enforcement, set Enforce 2FA on to All users.

3. Click Save Settings.

Once this is saved, users will see a notification the next time they log in. Depending on your grace period settings (covered below), they will either have a few days to set up 2FA or be asked to configure it immediately.

Making 2FA mandatory for specific users or roles

If you only want to enforce 2FA for certain people, for example, just your administrators and editors, kindly do the following instead:

1. Go to WP 2FA > 2FA Policies > Enforcement and exclusions.

2. Set Enforce 2FA on to Only for specific users and roles. Two additional fields appear: Users and Roles.

3. Start typing in the Users field to search for and select individual usernames, and/or use the Roles field to select entire roles (e.g., Administrator, Editor).

4. Click Save Settings.

As with enforcing 2FA for all users, the selected users will be prompted to configure 2FA the next time they log in, subject to the grace period settings.

Making 2FA mandatory on a multisite network

On a multisite network, WP 2FA also lets you enforce 2FA at network level rather than on each sub-site individually. The settings are managed from the Network Dashboard rather than an individual site’s dashboard.

All users of an individual sub-site

To require 2FA for everyone on one specific sub-site of your network:

1. Switch to the Network Dashboard.
2. Go to WP 2FA > 2FA Policies > Enforcement and exclusions.
3. Select the network-level option to enforce 2FA on specific sub-sites, then specify which sub-site(s) it should apply to.
4. Click Save Settings.

Only the super admins

To require 2FA only for the network’s super admin accounts:

1. Switch to the Network Dashboard.
2. Go to WP 2FA > 2FA Policies > Enforcement and exclusions.
3. Select the option to enforce 2FA on Only super admins.
4. Click Save Settings.

What happens when you enforce 2FA

Enforcement on its own only decides who must use 2FA. How much time they get to set it up, and what happens if they don’t, is controlled separately by the grace period settings. You’ll find these at:

WP 2FA > 2FA Policies > Sitewide 2FA policies > User Access Settings tab > Grace period.

Note: Per-role overrides take priority. If you've enabled custom policies for a specific role (see “Setting different policies per user role” below), that role gets its own Grace period section under its own User Access Settings tab, and those settings take priority over the sitewide ones for that role.

Under Grace period, you can choose between:

• Users have to configure 2FA straight away – no grace period; users must set up 2FA before they can do anything else.
• Give users a grace period to configure 2FA – specify a number of days or hours (up to a maximum of 90 days) before 2FA becomes mandatory.

If you choose a grace period, two further choices control what happens once it runs out, and how users are kept informed in the meantime:

1. What should the plugin do with users who do not configure 2FA within the grace period?

• Do not let them access the dashboard / user page once they log in until they configure 2FA.
• Lock the user (administrators have to manually unlock them).

2. How do you want users to be informed they are enforced to setup 2FA?

• Show an admin notice in the dashboard.
• Show a notification on a page on its own after the user authenticates and before accessing the dashboard.

Once users are notified, they can set up 2FA either from the prompt shown right after login, from a dashboard notice, or at any time from their own profile page by clicking Configure Two-factor authentication (2FA).

For a full walkthrough of this step, kindly see Configuring two-factor authentication for your WordPress user. It only takes a few seconds.

What happens if users don’t configure 2FA in time

Users who are required to configure 2FA straight away simply cannot access the dashboard or their account area until they do so.

Users who are given a grace period but let it run out will, depending on your settings, either be asked to configure 2FA before they can continue, or have their account locked outright.

When an account is locked, an administrator needs to manually unlock the user account. The user can then log back in, and their grace period starts again.

Letting a user log in without 2FA just once

Even with 2FA enforced and fully configured, administrators can still allow a user to log in without it a single time, using the Remove 2FA temporarily option from the Users > Profile screen or a user’s profile page.

This is handy in situations such as:

• A user temporarily cannot access their 2FA device.
• They’re experiencing email or SMS delivery issues.
• They’re having trouble generating or retrieving their one-time code.

For step-by-step instructions, kindly see how to temporarily disable 2FA for a user.

What if I don’t enforce 2FA at all?

Not enforcing 2FA is also an option, and it’s the default: when Enforce 2FA on is set to Do not enforce on any users, nobody is notified or required to do anything. Users can still choose to set up 2FA for themselves at any time from their own profile page.

Note: Choosing Do not enforce on any users does not switch 2FA off, it simply makes it optional; users can still enable it for themselves whenever they like. If you instead want to stop specific users or roles from using 2FA altogether, that's what the exclusion option (below) is for.

Excluding users or roles from 2FA

If you’re enforcing 2FA broadly but need to leave out an individual user or a whole role, you can do that from the same screen used for enforcement:

1. Go to WP 2FA > 2FA Policies > Enforcement and exclusions.
2. Scroll down to 2FA Exclusions.
3. Use Exclude the following users and/or Exclude the following roles to search for and select who should be left out.
4. Click Save Settings.

Excluded users will not be able to configure or use 2FA at all, even if they wanted to – this is different from 2FA simply being optional for them.

Setting different policies per user role (Premium)

WP 2FA Premium lets you go a step further than a single sitewide configuration: you can give each user role its own 2FA methods, grace period, and user access settings. This is useful, for example, if you want administrators to be enforced instantly with no grace period, while giving contributors a more relaxed grace period on a lighter set of methods.

To set this up:

1. Go to WP 2FA > 2FA Policies.
2. Under Customize per user role, click the role you want to customize: Administrator, Editor, Author, Contributor, or Subscriber.
3. Turn on Enable custom policies for this role.
4. Configure 2FA Method Selection and User Access Settings (including that role’s own grace period) exactly as you would on the sitewide policies screen.
5. Click Save Settings.

Any role without custom policies enabled continues to follow the sitewide 2FA policies described earlier in this guide.

If anything is unclear or you run into a snag, our team is happy to help – simply open a support ticket. Many thanks for trusting WP 2FA with your website’s security!