Two factor authentication set up – Wordfence

How to enable Wordfence two-factor authentication

Download Google Authenticator iOS – Android

In Wordfence 7.3 and later, two-factor authentication uses an authenticator application for better security and reliability, instead of SMS text messages.

First, choose an authenticator application to use, if you do not already have one installed on a cell phone or tablet. There are many available for iOS, Android, and other platforms, including:

  • Google Authenticator
  • Sophos Mobile Security
  • FreeOTP Authenticator
  • 1Password (mobile and desktop versions) See: 1Password help
  • LastPass Authenticator
  • Microsoft Authenticator
  • Authy 2-Factor Authentication
  • Any other authenticator app that supports Time-Based One-Time Passwords (TOTP)

Enabling two-factor authentication:

  1. Go to the Wordfence “Login Security” page.
  2. For admins, this is on the main Wordfence menu.
  3. For other users, this is a separate menu item with a Wordfence logo.
  4. Open your authenticator application and add a new entry. Most apps have a plus sign symbol or a tiny QR code symbol.
  5. Scan the QR code on the “Login Security” page. Your authenticator application should then display a six-digit code.
  6. If you are accessing a site on a phone or tablet and obviously cannot point the camera at its own screen, you can copy the line of letters and numbers below the QR code, and paste that in an application, using the application’s “manual” setup option.
  7. In the “Download recovery codes” section, click the “Download” button.
  8. Recovery codes can be used if you lose your device.
  9. Print or save the file, and store it in a safe place.
  10. Enter the six-digit code that appears in your authenticator application.
  11. This code changes every 30 seconds.
  12. If the code expires, you can enter the next code instead.
  13. Click the “Activate” button.

If this is your first time setting up two-factor authentication on a site then you may want to try logging in to the site in a different browser, or in a private or incognito browser window, to check for any compatibility issues before logging out.

How to log in with two-factor authentication

Steps to log in:

  1. Enter your username and password and press the “Log In” button.
  2. When the “2FA Code” prompt appears, enter the code from your authenticator application.
  3. If you use two-factor authentication for multiple sites, be sure to pick the correct site.
  4. Press the “Log In” button.

If you use another incompatible plugin or theme that modifies the login page and you cannot see the “2FA Code” prompt, or if you prefer a slightly quicker method, you can also enter a two-factor authentication code directly after your password, in the same field:

  1. Enter your username and password, but do not press the “Log In” button yet.
  2. Immediately after your password, enter the code from your authenticator application.
  3. If you used the old Wordfence two-factor authentication, note that you no longer need to enter a space or letters
  4. For example, if your password is w0rdf3nce#! and the code is 233455 then enter w0rdf3nce#!233455.
  5. Press the “Log In” button

How to use recovery codes

The recovery codes that you saved or printed during setup can be used if you ever lose your authenticator device, if you remove the application, or you remove your site’s entry by mistake. Make sure that you store these codes in a safe place.

Because they do not expire, recovery codes are longer than normal codes.  They are 16 letters and numbers instead of only 6 numbers, but each code can only be used once. An example recovery code looks like 5199 5c24 77dc 0ed7.

The log in process is the same as using a code from an authenticator application:

  1. Enter your username and password and press the “Log In”.
  2. When the “2FA Code” prompt appears, enter a recovery code.
  3. Remember, recovery codes are longer than regular two-factor authentication codes.
  4. In this example, we would enter 5199 5c24 77dc 0ed7.
  5. Press the “Log In” button.

Each recovery code can only be used once. You can generate new recovery codes on the “Login Security” page of your site. This is useful if you have used most of your codes, or if you lose the codes you previously saved or printed. Generating new codes will invalidate the previous codes.