Home Blog WordPress Security WordPress Two-Factor Authentication (2FA): what is it & using it on your site

Two-Factor Authentication for WordPress

WordPress Two-Factor Authentication (2FA): what is it & using it on your site

The security of your WordPress website depends on the systems you put in place to protect it and harden its security. With the sharp increase of automated password guessing, your users’ sensitive information and access to your site are more at risk than ever.

This is why it’s so important to protect your WordPress site further by adding two-factor authentication. Because your site is only as strong as its weakest password.

In this article, we’ll illustrate what WordPress two-factor authentication is, why it’s so important, and how to implement it on your website with an easy to use two-factor authentication plugin.

What is two-factor authentication?

Two-factor authentication (2FA) is a type of multi-factor authentication (MFA) and is an extra layer of protection for your website. It acts as an additional user verification tool for when someone logs into their account on your WordPress site. In a standard WordPress setup, a user only has to specify a username and password to login. Both of these can be guessed through dictionary attacks, or if they are very weak.

When you add two-factor authentication on your WordPress site, first, a user will need to enter their username and password like normal. Then, they’ll need to provide another piece of information that proves it’s really them logging in. Including the password, these pieces of information can be any of the following:

  • Something only the user knows, usually a password or a PIN code.
  • Something only the user has like a physical device, phone or hardware key.
  • Something to prove it’s you, such as biometrics like a fingerprint or face scan.

These can then be presented in a variety of different forms, including:

  • A text message or phone call which gives you a unique code to enter.
  • Biometric proof like the fingerprint sensor on your phone.
  • A separate app that users can download which gives them time-based codes they can enter.

For example, if a user wants to log into a WordPress website they’d first need to enter their username and password (something only you know). Next, two-factor authentication comes in, either asking them to verify their identity with a unique code sent via text, or a time-based code on an authentication app (something only you have).

Or a higher-security site like a bank might require your username and password (something only you know) first. Then they might ask for a time-sensitive PIN code using your card (something only you have) in a card reader and as a bonus, your fingerprint scan if you’re logging in via your phone (something to prove it’s you).

Why you should add two-factor authentication to your WordPress site

It’s easier than you think for someone to steal your password. Also, the majority of your site users and team members use very weak passwords.

In fact, it probably won’t be news to you that cyber crime is on the rise. After all, in recent years personal details breaches, loss of data, and yes, password hacking have been on the rise and are predicted to cost the world $6 trillion annually by 2021.

No matter the size of your website, the uprise in automated password hacking means that your site could benefit from a few extra layers of security.

Enforcing strong passwords on your WordPress for your users is incredibly important for the security of your website. However, a strong password alone is not enough. One user error slip up could result in a hacker gaining access to your site and could put your customer or user data at risk.

The good news is, this can be stopped by implementing WordPress two-factor authentication. In fact, even if one of your passwords were breached, the hacker would be halted at the next stage. Effectively, the 2nd factor would be its last.

Not convinced? Here are the benefits of two-factor authentication broken down:

  • Your data will be more secure – a weak password won’t be the reason your site is breached.
  • You’ll protect against fraud – 2FA decreases the probability that an attacker can impersonate a user.
  • Your team will have more freedom – employees can securely access documents and data without putting information at risk.
  • You’ll increase trust with your users – your customers will appreciate that you’re taking extra steps to make sure their data is secure.
  • You’ll reduce costs down the line – it goes without saying, if your site is protected, you won’t have to spend money fixing it.

So now we know the benefits of 2FA for your website and business, it’s time to get it installed on your site.

How to add WordPress two-factor authentication to your site

The easiest and quickest way to get WordPress two-factor authentication set up is to install a plugin. The WP 2FA plugin does all the heavy lifting for you and is quick and easy to setup.

How to install the WP 2FA for WordPress

Installing the free WP 2FA plugin takes just a few minutes and is as simple as adding any other plugin. To get started, follow these steps:

  1. Go to Plugins > Add New
  2. Search for WP 2FA in the Search plugins… box on the right and press enter
  3. Click Install Now and then Activate

Next, you’ll see the WP 2FA setup wizard pop up on your screen. Click Let’s get started! to begin setting up your site’s two-factor authentication.

The next screen of the wizard will require you to pick a two-factor authentication method, like a one-time code generated by a 2FA app such as Google authenticator app, or a one-time code sent via email.

IMPORTANT: The WP 2FA plugin works with several 2FA apps, so you do not have to use Google Authenticator specifically. We are only using the Google Authenticator app for this example.

  • The 2FA app method is the most secure method you can use for your site. For more information on this method, see our Google Authenticator guide.
  • The one-time code via email works for ease of use. However, we recommend you opt for the former. This is because it’s much easier nowadays to gain access to someone’s mailbox. If your email is hacked, the hacker can access your site with 2FA.

Once selected (for the purpose of this post we’ve selected Google authentication), you’ll need to download the Google Authenticator app and follow the instructions in the wizard to get it synced with your site.

Once done, you’ll be given the option to amend your authentication settings, or go back to managing your WordPress site as normal.

How to make WordPress two-factor authentication mandatory for all or some site users

Enabling 2FA on your user alone is not enough. You’ll also need to enable policies to make 2FA mandatory for all users. To do this, you can either follow along with the setup wizard or go directly into the 2FA plugin settings to make the changes:

  1. Go to Settings > Two-factor authentication.
  2. Scroll down to the ‘Do you want to enforce 2FA for some, or all the users?’ section
  3. Click the All users checkbox in the ‘Enforce 2FA on’ section.
  1. Then, scroll down to the ‘How long should the grace period for your users be?’ section.

This will determine how long users have to configure their two-factor authentication. If they don’t set it up within the grace period, they’ll be locked out of your site and only someone with admin access can let them back in.

  1. Input the number of days you’d like to give users to respond and click Save Changes at the bottom of the page.

Once done, your site users will be sent an email inviting them to set up 2FA for their site user. They’ll also get a notification when they log in. For more information on the specifics, read our ‘How do the two-factor authentication (2FA) policies work?’ post.

How to login if you don’t have access to email or your device

If you’re in a position where you need to gain access to your site but aren’t able to sign in to emails or use the app, WP 2FA has you covered. The plugin gives you the option to generate ten backup codes.

These 10 codes are one-time use but give you the opportunity to login when you need to the most. So once you setup 2FA on your account, generate the backup codes from your profile page, print them on a piece of paper, and keep them in a safe place.

To use one of the backup codes when logging in, do the following:

  1. Head to your site’s login page and enter your Username and Password
  2. You’ll then be asked to insert a code either sent to you via email or via the authentication app. Because you can’t do either, click Or, use a backup code. At the bottom of the login area.
  3. Enter one of the 10 codes you generated earlier and you’ll be able to log in without a problem.

Boost your WordPress site security, add two-factor authentication (2FA)

The difference between a secure site and a hacked one is just a username and a password away. So by implementing WordPress two-factor authentication with the WP 2FA plugin, you’re ensuring your site is as secure as it can be.

By installing WP 2FA, you’ll be able to:

  • Upgrade your site’s security
  • Protect your user data
  • Increase trust with your users and customers
  • Save yourself time and money in the long-run

Download the WP 2FA plugin and get started now!


Leave a Reply

Your email address will not be published. Required fields are marked *

Stay in the loop

Subscribe to the Melapress newsletter and receive curated WordPress management and security tips and content.

Newsletter icon

It’s free and you can unsubscribe whenever you want. Check our blog for a taste.

Envelope icon

Gain insights into your WordPress sites like a pro with our comprehensive guide to WordPress oversight

Close
The Ultimate Guide to WordPress Oversight

 Boost your sites’ security and management! Download our free eBook on WordPress oversight.

Uploading WP 2FA as a zip file in WordPress
WP 2FA in the WordPress plugin repository
Close

Installing WP 2FA Free

Congratulations on taking the first step towards enhancing your WordPress site's security with WP 2FA Free! You're now on your way to protecting your valuable data and ensuring peace of mind. No coding or technical knowledge is required.

 

Below are two ways to install WP 2FA on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for WP 2FA.

Download the WP 2FA plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading CAPTCHA 4WP as a zip file in WordPress
CAPTCHA 4WP in the WordPress plugin repository
Close

Installing CAPTCHA 4WP Free

Well done you. You're one step closer to safeguarding your WordPress website from spam and automated attacks with CAPTCHA 4WP. You'll be able to effortlessly integrate CAPTCHA into your forms and enjoy a website with enhanced security.

 

Below are two ways to install CAPTCHA 4WP on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for CAPTCHA 4WP.

Download the CAPTCHA 4WP plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading WP Activity Log as a zip file in WordPress
WP Activity Log in the WordPress plugin repository
Close

Installing WP Activity Log Free on your website

You deserve a pat on the back for choosing to record user actions and changes on your website. That is the first step towards better user accountability, easier troubleshooting of website security, and many other benefits of issues.

 

Below are the two ways to install WP Activity Log on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for WP Activity Log.

Download the WP Activity Log plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading Melapress Login Security as a zip file in WordPress
Melapress Login Security in the WordPress plugin repository
Close

Installing Melapress Login Security Free

Congratulations on taking control of your WordPress website's security by implementing robust login and password policies with Melapress Login Security. You can change your login page URL, limit failed login attempts, and reset passwords.

 

Below are two ways to install Melapress Login Security on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for Melapress Login Security.

Download the Melapress Login Security plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2