Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
Two Factor
Enable Two-Factor Authentication (2FA) using time-based one-time passwords (TOTP), email, and backup verification codes.
- Active installs
- 100,000+
- #312 of 1,000
- Downloads, all time
- 2M
- 1,985,266
- Downloads, 30 days
- 128.7K
- 30K in the last 7
- Rating
- 4.7 / 5
- 209 reviews
- Last updated
- 33 days ago
- Sep 28, 2026
- Version
- 0.17.0
- 31 releases
Upkeep and compatibility
| Last updated | September 28, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 7.0 or newer |
| Needs PHP | 7.4 or newer |
| First published | August 10, 2015 |
| Support, last two months | 3 of 6 threads resolved (50%) |
Reviews
4.7 / 5 from 209 reviews
| 5 stars | 184 |
|---|---|
| 4 stars | 15 |
| 3 stars | 0 |
| 2 stars | 2 |
| 1 star | 8 |
Downloads, last 30 days
What the author says it does
The Two-Factor plugin adds an extra layer of security to your WordPress login by requiring users to provide a second form of authentication in addition to their password. This helps protect against unauthorized access even if passwords are compromised.
Setup Instructions
Important: Each user must individually configure their two-factor authentication settings.
For Individual Users
- Navigate to your profile: Go to “Users” → “Your Profile” in the WordPress admin
- Find Two-Factor Options: Scroll down to the “Two-Factor Options” section
- Choose your methods: Enable one or more authentication providers (noting a site admin may have hidden one or more so what is available could vary):
- Authenticator App (TOTP) – Use apps like Google Authenticator, Authy, or 1Password
- Email Codes – Receive one-time codes via email
- Backup Codes – Generate one-time backup codes for emergencies
- Dummy Method – For testing purposes only (requires WP_DEBUG)
- Configure each method: Follow the setup instructions for each enabled provider
- Set primary method: Choose which method to use as your default authentication
- Save changes: Click “Update Profile” to save your settings
For Site Administrators
- Plugin settings: The plugin provides a settings page under “Settings → Two-Factor” to configure which providers should be disabled site-wide.
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
What PHP and WordPress versions does the Two-Factor plugin support?
This plugin supports the last two major versions of WordPress and the minimum PHP version supported by those WordPress versions.
How can I send feedback or get help with a bug?
The best place to report bugs, feature suggestions, or any other (non-security) feedback is at the Two Factor GitHub issues page. Before submitting a new issue, please search the existing issues to check if someone else has reported the same feedback.
Where can I report security bugs?
The plugin contributors and WordPress community take security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
To report a security issue, please visit the WordPress HackerOne program.
What if I lose access to all my authentication methods?
If you have backup codes enabled, you can use one of those to regain access. If you don’t have backup codes or have used them all, you’ll need to contact your site administrator to reset your account. This is why it’s important to always enable backup codes and keep them in a secure location.
Can I use this plugin with WebAuthn?
The plugin previously supported FIDO U2F, which was a predecessor to WebAuthn. There is an open issue to add WebAuthn support here.
Is there a recommended way to use passkeys or hardware security keys with Two-Factor?
Yes. For passkeys and hardware security keys, you can install the Two-Factor Provider: WebAuthn plugin. It integrates directly with Two-Factor and adds WebAuthn-based authentication as an additional two-factor option for users.
Latest changelog entry
- Security Fixes: Ensure that regular passwords can’t bypass the two-factor requirement for REST API and XML-RPC requests by @faisalahammad in #989. Thanks mqrble for responsibly reporting the issue.
- Security Fixes: Add diagnostics for failed login nonce verification by @georgestephanis in #973. Thanks Ananda Dhakal (Patchstack) for responsibly reporting the issue.
- New Features: Add WP-CLI support with wp two-factor commands by @masteradhoc in #905
- New Features: Respect intentional bypass via the two_factor_is_required_for_user filter by @masteradhoc in #882
Screenshots
Two-factor options under User Profile - Shows the main configuration area where users can enable different authentication methods. 
Email Code Authentication during WordPress Login - Shows the email verification screen that appears during login. 
Authenticator App (TOTP) setup with QR code - Demonstrates the QR code generation and manual key entry for TOTP setup. 
Backup codes generation and management - Shows the backup codes interface for generating and managing emergency access codes.
Tagged
Plugins that share its tags
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
- Installs
- 3+ million
- Rating
- 4.9 (8.9K)
- Updated
- 5 days ago
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
#199 by installs
Limit Login Attempts
Limit rate of login attempts, including by way of cookies, for each IP. Fully customizable.
- Installs
- 300,000+
- Rating
- 4.6 (202)
- Updated
- 4 years ago
#314 by installs
WPS Limit Login
WPS Limit login limit connection attempts by IP address
- Installs
- 100,000+
- Rating
- 4.9 (83)
- Updated
- 43 days ago
#756 by installs
WP Hide & Security Enhancer
Protect your website by concealing vulnerable WordPress traces, plugins, themes, login/admin url. 2FA, Captcha, Firewall, Security Headers etc.
- Installs
- 50,000+
- Rating
- 4.3 (275)
- Updated
- 38 days ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.