Best Free WordPress 2FA Plugin & Setup Guide

Originally published on the Bug Circuit blog.

The best way to add 2FA to WordPress is a free, purpose-built plugin — the community-maintained "Two-Factor" plugin or Melapress's "WP 2FA" — set up to offer both an authenticator app and a no-app fallback like email codes or printed backup codes, so every staff member can actually use it.

This is for you if someone (a client, a security audit, or your own gut) told you to "just turn on 2FA" and you're not sure which plugin to trust, whether you need a fancy authenticator app, or how to set it up without locking your bookkeeper or shop manager out of the site. By the end you'll have a plugin picked, a login protected in under 10 minutes, and a backup option for people who don't want to install anything on their phone.

What 2FA actually does (in plain English)

Two-factor authentication (2FA) means logging in needs two things: something you know (your password) and something you have (a code from your phone, an email, or a physical key). If a hacker steals or guesses your password — which happens constantly through phishing emails and reused passwords from other data breaches — 2FA stops them cold because they don't have the second piece.

CISA, the U.S. government's cybersecurity agency, and OWASP, the nonprofit that writes the standard reference guides for web security, both list multi-factor authentication as one of the highest-value, lowest-cost defenses any website can add. Neither claims it makes a site "unhackable" — it doesn't stop a vulnerable plugin from being exploited or a server from being misconfigured — but it closes off the single most common way WordPress admin accounts get taken over: a stolen or guessed password.

The best free WordPress 2FA plugins

You don't need a paid tool to do this properly. Here's how the three most-installed free options compare:

All three are actively maintained, have no ads, and are available directly from the official WordPress plugin directory — always install from there or your dashboard's Plugins → Add New search, never from a random download link.

If you're picking one thing: install Two-Factor for a single-admin site, or WP 2FA if you have several staff accounts and want to force everyone to set it up rather than hoping they will.

How to add two-factor authentication to WordPress (step by step)

Using the Two-Factor plugin as the example — the steps are nearly identical in WP 2FA and Wordfence Login Security:

1. In your WordPress dashboard, go to Plugins → Add New Plugin, search "Two-Factor," and click Install Now, then Activate.
2. Go to Users → Profile (or Users → All Users and edit a specific person's account).
3. Scroll to the Two-Factor Options section.
4. Pick a primary method:
   • Authenticator App (TOTP) — scan the QR code with Google Authenticator, Authy, or Apple's built-in Passwords app, then enter the 6-digit code it shows to confirm.
   • Email — codes are sent to the account's email address at login; no app needed.
   • Backup Verification Codes — a set of one-time codes you print or save somewhere safe, for when you're offline or your phone is dead.
5. Click Update Profile to save.
6. Log out and log back in to confirm the second step actually appears — don't skip this test.
7. Repeat for every account with Administrator or Editor access. A site is only as protected as its least-secured login.
8. If you're using WP 2FA instead, go to WP 2FA → Settings → 2FA Policy and set which roles must enable it and how many days they have (7 is reasonable) — the plugin will nag them with an on-screen notice until they comply.

Want to check your login page's other defenses at the same time? Run it through our free website security check — it flags exposed login pages, missing security headers, and other quick wins alongside 2FA.

2FA without an authenticator app: real options for non-technical staff

Not everyone wants to install Google Authenticator, and that's fine — it isn't the only valid form of 2FA:

• Email one-time codes. The plugin emails a 6-digit code at login. Nothing to install; works on any device that can check email. Slightly weaker than an app (if someone's email is also compromised, this layer is bypassed too), but far better than a password alone.
• Backup/recovery codes. A printed list of one-time-use codes, generated once and kept in a drawer or password manager. Good as a fallback for anyone, not just a primary method.
• Passkeys or security keys (WebAuthn). Newer and app-free — the person taps a fingerprint reader, Face ID, or a physical USB key (like a YubiKey) instead of typing a code. The Two-Factor plugin supports FIDO U2F/WebAuthn keys if you want to go this route later.
• SMS text codes. Some paid add-ons offer this. It works without an app, but SMS can be intercepted via SIM-swapping, so OWASP specifically recommends against relying on it as your only method — treat it as a last resort, not a first choice.

For a small team where one person genuinely won't use an app, email-based 2FA on the Two-Factor plugin is the pragmatic answer: it takes zero setup on their end beyond clicking "yes, that's my code."

Checklist: is your 2FA setup actually protecting you?

• [ ] 2FA is enabled on every Administrator and Editor account, not just the main owner login
• [ ] At least one backup method (backup codes or email) is set up per person, so nobody gets permanently locked out
• [ ] You tested logging out and back in to confirm the code prompt actually shows up
• [ ] Your WordPress admin username isn't literally "admin" (a leftover default that pairs badly with any login weakness)
• [ ] You're still using unique, strong passwords — 2FA is a second layer, not a replacement for good password hygiene
• [ ] Security headers and other basic hardening are in place — check with our security headers tool

What 2FA won't fix

2FA protects the login form. It does nothing for a vulnerable plugin, an outdated theme, a leaked database, or a misconfigured file permission — the kinds of issues that show up in most real WordPress compromises. If an audit or a client security questionnaire told you to "add 2FA," treat it as one item on a longer list, not the whole job. A proper site review looks at plugins, user roles, backups, and server configuration too — the difference between that kind of manual check and an automated scanner is explained in our guide to manual vs. automated penetration testing.

Key takeaways

• Install a free, official plugin — Two-Factor for simplicity, WP 2FA if you need to enforce it across staff — directly from the WordPress plugin directory.
• You don't need an authenticator app: email codes and printed backup codes are legitimate no-app 2FA options for less technical team members.
• Turn it on for every Admin and Editor account, not just yours, and always set up a backup method so no one gets locked out.
• 2FA stops stolen or guessed passwords from being enough to break in, but it doesn't patch vulnerable plugins or fix server misconfigurations — it's one layer, not the whole defense.
• Avoid SMS-only 2FA as your primary method if you have a choice; it's better than nothing but weaker than an app, email, or security key.

2FA is a genuinely good half-hour of work, and now you can do it yourself for free. If you want to know what else on your site actually needs fixing — plugins, headers, exposed files, the stuff a checklist alone won't catch — a real person can manually audit your whole site for $49 and hand you a plain-English report with exact fixes. See what's included on our pricing page, no pressure either way.