WordPress Two-Factor Authentication: Stop Account Takeover
WordPress logins are brute-forced around the clock. A strong password helps, but two-factor authentication (2FA) is what actually stops credential-stuffing and reused-password attacks from reaching your dashboard.
This guide covers the best 2FA options for WordPress, how to protect the endpoints attackers really target, and how to enforce it for every user. Run a free MageArgus scan to check your site's exposure.
- wp-login.php and XML-RPC are the top brute-force targets — Wordfence attack data
- Reused passwords make credential stuffing highly effective — Verizon DBIR
Pick a 2FA method
Reputable plugins — Wordfence Login Security (free), Two-Factor, miniOrange or Solid Security — add TOTP (Google Authenticator/Authy), email or hardware-key second factors. TOTP is the best balance of security and cost. Avoid SMS where you can; it's phishable and SIM-swappable.
Protect the endpoints, not just the form
Attackers bypass the login form by hitting xmlrpc.php and the REST API. Disable XML-RPC if you don't use it, limit REST user enumeration, and rate-limit wp-login.php:
# nginx: block xmlrpc
location = /xmlrpc.php { deny all; }Enforce 2FA for every role
Optional 2FA is weak 2FA. Configure your plugin to require it for administrators and editors, with a short grace period for first setup. Anyone who can publish or install plugins must have a second factor.
- Require 2FA for admin + editor roles
- Add login rate-limiting / lockouts
- Remove unused accounts and default ‘admin’ usernames
Add recovery codes and backups
Generate and store recovery codes when you enrol so a lost phone doesn't lock you out. Keep at least one admin's codes offline. Combined with regular backups, you can always regain access without disabling 2FA site-wide.
Frequently asked questions
Which free WordPress 2FA plugin is best?
Wordfence Login Security and the official Two-Factor plugin are both solid, free TOTP options with no upsell required for core 2FA.
Should I disable XML-RPC?
If you don’t use the WordPress mobile app, Jetpack or pingbacks, yes — disabling it removes a common brute-force and amplification vector.
Does 2FA protect against a compromised plugin?
No. 2FA guards logins; a vulnerable or malicious plugin runs code regardless. Keep plugins updated and scan for injected code too.