Protect Your Admin Login and Understand Its Limits
A leaked password should not be enough to give someone control of your WordPress website. Two-factor authentication, usually shortened to 2FA, adds another check before a user can log in. At Eirhost, we recommend enabling 2FA for every WordPress administrator account. It is a practical security measure, and free plugins make it accessible to most website owners. However, 2FA protects the login process. It does not fix vulnerable plugins, remove malware or prevent every type of website attack.
How does WordPress 2FA work?
With a standard WordPress login, you enter a username and password. With 2FA enabled, you must also provide a second form of verification. A common method is a short-lived code generated by an authenticator app on your phone. After entering your password, you enter the current code to complete the login. This means someone who discovers your password would normally still need access to your
second factor before they could sign in. WordPress requires a plugin or a suitable external authentication service to add this protection. Each administrator should set it up for their own account rather than sharing one administrator login.
What does 2FA protect against?
The main purpose of 2FA is to reduce the risk of account takeover through compromised passwords. These might include:
- Weak passwords that an attacker can guess.
- Passwords exposed in a data breach.
- Passwords reused across several websites.
- Passwords stolen through phishing or malicious software.
A strong, unique password remains necessary. Two-factor authentication adds protection if that password becomes known to someone else. It is not an absolute guarantee. For example, a fraudulent login page may trick someone into supplying both their password and a live authentication code. An attacker who steals an already authenticated session may also avoid a fresh login challenge.
Can a vulnerable plugin bypass 2FA?
Yes. Depending on the vulnerability, an attacker may compromise a website without using the normal WordPress login. For example, a vulnerable plugin could allow an attacker to upload malicious files, run code or
make unauthorised changes to the database. Some flaws can allow the creation of an administrator account or bypass normal authentication checks.
In these situations, the attacker may never reach the screen where your 2FA plugin asks for a code.
A website can therefore have strong passwords and 2FA enabled and still be compromised through an insecure plugin. WordPress security guidance addresses software vulnerabilities, updates and access controls alongside login protection.
This is why enabling 2FA should accompany regular maintenance rather than replace it.
Free WordPress 2FA plugins
Wordfence Login Security
For websites that need a dedicated login security plugin, Wordfence Login Security is our first choice. It includes authenticator-app 2FA, recovery codes and settings for controlling which user roles
must use two-factor authentication.
It also includes XML-RPC authentication controls and optional login CAPTCHA protection. The standalone plugin does not include Wordfence’s firewall or malware scanner. It is a suitable
option when you want login protection without installing the full security suite. Find out more about Wordfence Login Security.
Two Factor
Two Factor is another free option for adding a second authentication step to WordPress logins. It is worth considering for a straightforward website where users need basic additional login
protection. Check its current settings against your requirements, particularly if you need to enforce enrolment across several administrators. View Two Factor on WordPress.org.
WP 2FA — free edition
WP 2FA by Melapress offers a free edition with authenticator-app and email-code verification. It is another option for website owners who want a dedicated 2FA plugin. Compare its current
free and paid features before choosing, especially if your website uses custom login forms or has more complex user requirements. View WP 2FA on WordPress.org.
Paid WordPress security options
WP 2FA Premium
WP 2FA Premium is worth considering when you need additional authentication methods or dedicated support. The premium edition offers methods beyond those in the free version, including YubiKey
support. Available features and licence terms can change, so check the developer’s current comparison before purchasing. You do not need a paid licence simply to add authenticator-app 2FA.
Compare WP 2FA plans.
Wordfence Premium
Wordfence Premium is an option when you want broader website protection alongside 2FA. Two-factor authentication is already included in the free full Wordfence plugin. The reason to upgrade is its additional security services, including newly released firewall rules and malware signatures without the free edition’s 30-day delay, plus its real-time IP blocklist. If the full Wordfence plugin is already installed, use its existing 2FA feature rather than adding Wordfence Login Security separately. Find out more about Wordfence Premium.
How to introduce 2FA safely
Start with every administrator account. These users have extensive control over your website, so protecting their logins should be a priority.
1. Choose one compatible 2FA plugin and keep it updated.
2. Have each administrator connect their own authenticator app.
3. Save recovery codes securely, away from the website itself.
4. Test the login process before requiring everyone to use it.
5. Test any custom login forms, shop accounts or integrations your website relies on.
Avoid installing several plugins that perform the same login security function. Check whether your existing security plugin already includes 2FA.
Keep the rest of your WordPress security covered
Two-factor authentication addresses password-based account attacks. Protecting against vulnerable software requires other measures:
- Update WordPress, plugins and themes promptly.
- Remove unused plugins and themes.
- Replace abandoned software.
- Give users only the access they need.
- Monitor vulnerability alerts.
- Use a properly configured web application firewall.
- Maintain independent backups and test that they can be restored.
Eirhost recommends 2FA for WordPress administrator logins as part of regular website security and maintenance. It makes a stolen password less useful to an attacker, but a vulnerable plugin can still provide another route into the site.
If you need help deciding how to protect your WordPress website, contact Eirhost to discuss your hosting and security requirements.