“Two-factor authentication” is an additional login security feature that is used by banks, government agencies, and the military worldwide. It is one of the most secure forms of remote system authentication. This method of logging in to your site relies on something you know and something in your possession. That is why it is referred to as “two-factor” because two factors are involved in authenticating you.

In this case, you know your password and you are in possession of your cell phone or another authenticator device. If we can verify both of these, then we know that it is okay to allow you to access your site. Wordfence two-factor authentication is designed to be used mainly by site administrators and with high-level access such as an editor but is now also available for other roles if you choose. Two-factor authentication was previously a Premium feature but is now also available to users running the free version of Wordfence.

Wordfence two-factor authentication now uses an authenticator application, such as Google Authenticator, to generate unique codes for you rather than relying on SMS text messages.

How to enable two-factor authentication

If your site uses the older version of two-factor authentication, see the Legacy Two-Factor Authentication help page.

In Wordfence 7.3 and later, two-factor authentication uses an authenticator application for better security and reliability, instead of SMS text messages.

Please note that our two-factor authentication feature currently only works for the default WordPress login page and WooCommerce, and it may not work on custom login forms or pages generated by other themes or plugins. Note that we do provide compatibility support for our two-factor authentication feature on the WooCommerce plugin account page where you must enable “WooCommerce integration” on our “Login Security” > “Settings” page. We recommend testing your WooCommerce login pages after enabling this option, to be sure there are no conflicts with other plugins that modify login pages.

First, choose an authenticator application to use, if you do not already have one installed on a cell phone or tablet. There are many available for iOS, Android, and other platforms, including:

• Google Authenticator
• Sophos Mobile Security
• FreeOTP Authenticator
• 1Password (mobile and desktop versions) See: 1Password help
• LastPass Authenticator
• Microsoft Authenticator
• Authy 2-Factor Authentication
• Any other authenticator app that supports Time-Based One-Time Passwords (TOTP)

Enabling two-factor authentication:

1. Go to the Wordfence “Login Security” page.
2. For admins, this is on the main Wordfence menu.
3. For other users, this is a separate menu item with a Wordfence logo.
4. Open your authenticator application and add a new entry. Most apps have a plus sign symbol or a tiny QR code symbol.
5. Scan the QR code on the “Login Security” page. Your authenticator application should then display a six-digit code.
6. If you are accessing a site on a phone or tablet and obviously cannot point the camera at its own screen, you can copy the line of letters and numbers below the QR code, and paste that in an application, using the application’s “manual” setup option.
7. In the “Download recovery codes” section, click the “Download” button.
8. Recovery codes can be used if you lose your device.
9. Print or save the file, and store it in a safe place.
10. Enter the six-digit code that appears in your authenticator application.
11. This code changes every 30 seconds.
12. If the code expires, you can enter the next code instead.
13. Click the “Activate” button.

If this is your first time setting up two-factor authentication on a site then you may want to try logging in to the site in a different browser, or in a private or incognito browser window, to check for any compatibility issues before logging out.

How to log in with two-factor authentication

Steps to log in:

1. Enter your username and password and press the “Log In” button.
2. When the “2FA Code” prompt appears, enter the code from your authenticator application.
3. If you use two-factor authentication for multiple sites, be sure to pick the correct site.
4. Press the “Log In” button.

If you use another incompatible plugin or theme that modifies the login page and you cannot see the “2FA Code” prompt, or if you prefer a slightly quicker method, you can also enter a two-factor authentication code directly after your password, in the same field:

1. Enter your username and password, but do not press the “Log In” button yet.
2. Immediately after your password, enter the code from your authenticator application.
3. If you used the old Wordfence two-factor authentication, note that you no longer need to enter a space or letters
4. For example, if your password is w0rdf3nce#! and the code is 233455 then enter w0rdf3nce#!233455.
5. Press the “Log In” button

How to use recovery codes

The recovery codes that you saved or printed during setup can be used if you ever lose your authenticator device, if you remove the application, or you remove your site’s entry by mistake. Make sure that you store these codes in a safe place.

Because they do not expire, recovery codes are longer than normal codes.  They are 16 letters and numbers instead of only 6 numbers, but each code can only be used once. An example recovery code looks like 5199 5c24 77dc 0ed7.

The log in process is the same as using a code from an authenticator application:

1. Enter your username and password and press the “Log In”.
2. When the “2FA Code” prompt appears, enter a recovery code.
3. Remember, recovery codes are longer than regular two-factor authentication codes.
4. In this example, we would enter 5199 5c24 77dc 0ed7.
5. Press the “Log In” button.

Each recovery code can only be used once. You can generate new recovery codes on the “Login Security” page of your site. This is useful if you have used most of your codes, or if you lose the codes you previously saved or printed. Generating new codes will invalidate the previous codes.

How to disable two-factor authentication

You can disable two-factor authentication with a few clicks. This is useful if you want to switch to a new device, use a different authenticator application, or if you need to help another user who is unable to log in. Of course, always confirm that the user you are helping is really who they say they are!

If you need to disable two-factor authentication on your own account:

1. Log in to your site and go to the “Login Security” page
2. Press the “Deactivate” button.

If you need to disable two-factor authentication for another user:

1. Go to the WordPress “Users” page.
2. Hover over the user’s record and click the “2FA” link below their username.
3. This will take you to the “Login Security” page. Near the top of the page, you will see “Editing User: their_username”.
4. Press the “Deactivate” button.

Server Time

When you are logged in as an administrator, the bottom of the “Two-Factor Authentication” page shows “Server Time” and “Browser Time”. Accuracy of the server time is important for “TOTP” authenticator apps.

If you have trouble setting up two-factor authentication, you can check that the server time is correct. Browser time is included for your reference, though if your computer’s time is incorrect, it will only matter if you are generating codes on your computer. The Wordfence Login Security module attempts to correct the time by using a service called “NTP” if possible, but some hosting providers do not allow outbound NTP connections.

Troubleshooting

If you have lost, or don’t have access to your recovery codes, and there is a problem logging in with your authentication application code then do the following to gain access to your site:

1. You will need to rename the Wordfence plugin via FTP/SSH or your hosting control panel file manager. If you are not sure what to do then your hosting provider may be happy to help.

2. Find the Wordfence directory in the file path below and rename the Wordfence directory as below:

~/wp-content/plugins/wordfence-disabled

3. You should now be able to log in to WordPress.

4. You then need to rename the Wordfence directory again to enable Wordfence as below:

~/wp-content/plugins/wordfence

5. At this point you won’t see Wordfence in the WordPress menu. Click the WordPress “Dashboard” menu item and you will then see the Wordfence main menu item appear. However, you may need to reactivate Wordfence on the WordPress “Plugins” page first.

6. You can then open the “Login Security” page and press the “Deactivate” button to deactivate two-factor authentication for your account if you need to.

If there is actually a problem with your authentication application then you can try the following:

1. In the date and time settings on the phone or tablet make sure they are synchronized correctly to the correct date and time in your time zone.

2. Install any pending phone or tablet operating system updates.

3. Make sure the authentication application is using the latest version.

4. Remove the entry for Wordfence in the authentication application.

5. Turn your phone or tablet fully off and on again.

6. Reload the “Login Security” > “Two-Factor Authentication” page again to create a new QR code.

7. Try to set it up again and make sure to test logging in with two-factor authentication in another browser because if it doesn’t work then you can deactivate two-factor authentication in the browser where you are still logged in.

8. If that still fails then you might have to delete the authentication application and start again. If you have many entries in your authentication application that can’t be backed up then you could try a separate, different application just for Wordfence as a test.