What is Multi-factor authentication?
Multi-factor authentication (MFA) is a broad term that brings together all forms of authentication in which more than one factor is required. An authentication factor is a mechanism through which a user can authenticate themselves. A username and password combination is one authentication factor many are familiar with. In multi-factor authentication, users must use two or more authentication methods.
The most common MFA implementation on WordPress is 2FA – two-factor authentication. In this implementation, two factors of authentication are used, essentially securing WordPress with multiple factors of authentication.
Why is multi-factor authentication important on a WordPress website?
Multi-factor authentication can stop most attacks on a WordPress website. It makes accounts much more secure, since an attacker would need a valid username and password and access to the other authentication methods. In most cases, the authentication methods over and above the username and password combination require access to a physical device such as the user’s phone, which an attacker will find very difficult to steal. According to a study carried out by Microsoft, this stops some 99.9% of account compromise attacks.
How multi-factor authentication works
Multi-factor authentication adds one or more additional authentication layers after the primary authentication method. The user must clear the first authentication method before moving on to the next one, of which there can be as many as five different ones.
The five different types of authentication factors are:
- What you know – Through this factor, users must prove they know something, such as a password, before they are verified
- What you have – Through this factor, users must prove they have something, such as a phone, before they are verified
- What you are – Through this factor, users must prove they are someone, such as through a fingerprint, before they are verified
- What you do – Through this factor, users must do something such as draw a specific pattern or gesture before they are verified
- Where you are – Through this factor, users must be located in a specific place to be verified
Multi-factor authentication process
To better illustrate how MFA works, we will go through a typical authentication process that uses MFA.
- The user accesses the login page, where they need to enter their username and password. This is the 1st authentication factor known as What you know
- Once the username and password have been entered correctly, the user is asked for their OTP (One Time Password)
- The user opens their authenticator app, which requires them to log in with their fingerprint or Face ID before accessing the OTP. This is the 2nd authentication factor known as What you are
- Having successfully logged in to the authenticator app, the user will be able to find the corresponding OTP which they need to enter on the website. This is the 3rd authentication factor, known as What you have (since it proves the user has the phone)
- The user successfully logs in to the system
As the above scenario illustrates, if an attacker were to steal someone’s password, this would not be enough to access their account. They would also need to steal their phone as well as their face or finger – something that’s not easy to pull off (unless you’re Nicolas Cage).
Getting started with multi-factor authentication on WordPress
WordPress does not support multi-factor authentication straight out of the box; instead, it relies on 3rd party plugins. In most use cases, two-factor authentication (an MFA implementation that uses exactly two authentication factors) provides adequate protection, with the OTP implementation of 2FA offering the best balance between security and usability.
To add 2FA to your website, use WP 2FA, a 2FA plugin for WordPress that makes deploying MFA easy and seamless. Everything is managed through the WordPress admin area and offers a fine degree of control over the implementation of MFA/2FA.
