How to select which 2FA method users can use on your WordPress site

The WP 2FA plugin supports multiple two-factor authentication (2FA) methods which the users can use. As a site administrator, you can choose which 2FA methods are available to your users.

Selecting the 2FA methods your site users can use

To enable or disable 2FA methods:

1. Log in to your WordPress dashboard.
2. Go to WP 2FA > 2FA policies.
3. Find the Select primary 2FA methods section.
4. Use the toggle next to each method to enable or disable it.
5. Drag and drop the methods to change the order in which they are shown to users.
6. Click Save settings.

The available 2FA methods in the WP 2FA free version include:

• One-time code via email
• One-time code via 2FA app

The available 2FA methods in WP 2FA Premium include:

• Push notification via Authy app
• Link via email
• One-time code via SMS (Twilio)
• One-time code via SMS (Clickatell)
• One-time password via YubiKey
• One-time code via email (zero-setup)

Premium-only methods are marked with a Premium label in the plugin interface.

What happens when you disable a 2FA method?

When you disable one of the 2FA methods:

• Users can no longer select it when setting up 2FA.
• Users already using that method may need to reconfigure 2FA with another available method.

Before disabling a method, make sure at least one suitable 2FA method remains enabled for your users.

Should you disable 2FA methods?

As explained in our two-factor authentication and WordPress guide, there are several different methods available, and some of them have been bypassed in the past. For example, it is not recommended to use the HOTP method over email or SMS. However, it all depends on the website, its users, and the requirements you might have to adhere to. So, analyze the situation and choose the best 2FA methods that fit your requirements.