# Setting up two-factor authentication (2FA) in WordPress

> Add two-factor authentication to WordPress logins with the Two Factor plugin so users need a second code as well as a password.

Source: https://helpcenter.ruachost.com/wordpress/guides/implementing-two-factor-authentication-2fa-in-wordpress/

Two‑Factor Authentication (2FA) adds an extra layer of security to your WordPress site. Instead of relying only on a password, users must also provide a second verification method (such as a code sent to their phone or email). On **ruachost.com**, you can enable 2FA using the **Two Factor plugin**.

## Why Use 2FA?

- Protects against stolen or weak passwords.
- Prevents unauthorized access to your WordPress admin.
- Enhances overall site security.
- Recommended for all administrator and editor accounts.

## Steps to Install and Configure the Two Factor Plugin

1. **Log in to WordPress** with an administrator account.
2. In the dashboard, go to **Plugins → Add New**.
3. Search for **Two Factor**.
4. Click **Install Now**, then **Activate**.
5. Go to **Users → Profile** (or edit a specific user).
6. Scroll down to the **Two‑Factor Options** section.
7. Select your preferred authentication method:

   - ### Email codes
   - **Time‑based One‑Time Password (TOTP)** via apps like Google Authenticator or Authy
   - **Backup codes** (for emergency access)
8. Choose a **primary method** if multiple are enabled.
9. Click **Update User** to save settings.

✅ The selected user will now be required to use 2FA when logging in.

## Important Notes

- Always set up **backup codes** in case you lose access to your primary method.
- Encourage all administrators and editors to enable 2FA.
- Test login after enabling to confirm configuration.
- If you use a caching plugin or CDN, ensure login pages are excluded from caching.