2FA for WordPress websites

2FA is a pain in the arse. You were all thinking it, and I was as well. But it’s more of a pain when your site get’s hacked, so like almost all security, it’s one of things you just have to do to avoid pain in the future.

Anyways – if you aren’t getting your web team to do it – then here’s a handy guide to doing it yourself.

Step 1: Choose a 2FA Plugin

While there are several plugins available for implementing 2FA on WordPress, some of the most popular and reliable ones include:

1. Wordfence Security: Offers comprehensive security features, including 2FA.
2. Google Authenticator – Two Factor Authentication (by Henrik Schack): Simple and effective.
3. Two Factor Authentication (by David Anderson): Developed by the authors of the popular plugins like iThemes Security and WP Security Audit Log.
4. Duo Two-Factor Authentication: Enterprise-level security features.
5. Authy – Two Factor Authentication: User-friendly with multiple device support.

For this guide, we’ll use Wordfence Security due to its robust feature set and ease of use.

Step 2: Install and Activate the Wordfence Security Plugin

1. Log in to Your WordPress Admin Dashboard
   • Navigate to https://yourwebsite.com/wp-admin and log in with your administrator credentials.
2. Navigate to the Plugins Section
   • From the left-hand menu, click on Plugins > Add New.
3. Search for Wordfence Security
   • In the search bar, type “Wordfence Security”.
   • Locate the plugin developed by Wordfence.
4. Install the Plugin
   • Click the Install Now button next to the Wordfence Security plugin.
5. Activate the Plugin
   • Once installed, the Install Now button will change to Activate. Click it to activate the plugin.

Step 3: Configure Wordfence Security

1. Initial Setup
   • Upon activation, you might be prompted to start the setup wizard. Follow the on-screen instructions to configure basic settings.
2. Access Wordfence Settings
   • From the left-hand menu, click on Wordfence > Login Security.
3. Enable Two-Factor Authentication
   • In the Login Security section, look for the Two-Factor Authentication option.
   • Toggle the switch to Enable.
4. Choose the Authentication Method
   • Wordfence offers several 2FA methods, including:
     • Email-Based Authentication: Sends a code to the user’s email.
     • Authentication App: Use apps like Google Authenticator, Authy, or Duo.
     • U2F/WebAuthn: Use hardware keys like YubiKey.
   • For most users, Authentication App is recommended for its balance of security and convenience.
5. Set Up Authentication App
   • Download an Authenticator App: If you haven’t already, install an authenticator app on your smartphone. Popular options include:
     • Google Authenticator
     • Authy
     • Duo Mobile
   • Scan the QR Code:
     • In the Wordfence settings, click Enable next to the Authentication App option.
     • A QR code will appear. Open your authenticator app, choose to add a new account, and scan the QR code.
   • Enter the Verification Code:
     • After scanning, the authenticator app will generate a 6-digit code.
     • Enter this code into the Wordfence setup to verify the connection.
6. Enforce 2FA for Users
   • Decide which user roles should be required to use 2FA. It’s recommended to enforce 2FA for all users with login access, especially administrators.
   • In the Login Security settings, under Two-Factor Authentication, specify the roles that must use 2FA.

Step 4: Enroll Users in 2FA

1. User Login
   • Each user with a role that requires 2FA will need to set it up upon their next login.
2. Prompt to Set Up 2FA
   • Upon logging in, users will be prompted to set up 2FA if they haven’t already.
   • They should follow the on-screen instructions to link their authenticator app.
3. Backup Codes
   • Encourage users to generate and securely store backup codes. These codes can be used to access their accounts if they lose access to their authenticator device.

Step 5: Test the 2FA Setup

1. Log Out of WordPress
   • Click on your profile picture in the top-right corner and select Log Out.
2. Attempt to Log In Again
   • Navigate to your WordPress login page and enter your credentials.
3. Enter the 2FA Code
   • After entering your username and password, you will be prompted to enter the 2FA code from your authenticator app.
4. Successful Login
   • If everything is set up correctly, entering the correct 2FA code should grant you access to the dashboard.