Few people think about two-factor authentication for WordPress, yet it’s one of the most effective security measures I know. WordPress has plenty of plugins that can turn on two-factor authentication, so we just need to pick the right one. In this article, Lucid Gen will show you how to secure WordPress with two-factor authentication using SMS and Google Authenticator.
Consequences of not securing WordPress
- Your site gets infected with malware that steals your users’ information or stuffs your pages with spammy backlinks.
- Your site shows up on Google with injected Chinese spam text.
- Google Chrome blocks visitors from accessing your site.
- You lose control of your site, and attackers may even wipe out your hosting data.
Benefits of two-factor authentication for WordPress
Some benefits you might not expect when you turn on two-factor authentication…
- A healthy site and a calm mind.
- Better sleep at night.
- More trust from your customers.
- More confidence when you build websites for clients.
In short, it strengthens the security of your WordPress site and your clients’ sites.
Two-factor authentication for WordPress with Google Authenticator
Google Authenticator is a very popular two-factor authentication app, and many other platforms rely on it because it’s quick and simple. Instead of waiting for a text message, you just open the Google Authenticator app on your phone to get a code. Best of all, it works even when your phone is offline.
In your WordPress dashboard, go to Plugins and select Add New. Then search for the Two-Factor plugin and install it.
After installing and activating the Two-Factor plugin, go to your Profile. Scroll down to the Two-Factor Options section and configure it as follows.
- Tick both boxes in the Time Based One-Time Password (Google Authenticator) row.
- On your phone, open the Google Authenticator app, tap the plus sign, and choose to scan a QR code. Scan the code on your computer screen, then enter the verification code generated by the app. When you’re done, click Submit.
You can also use Google Authenticator on your computer instead of your phone.
Once the settings are saved, every time you log in with your password, WordPress will ask for a second verification code. Just open the app and enter the code it shows.
Quick and simple, right? The 2FA feature is also available in the Wordfence plugin, so you can check out the Wordfence user guide. However, if you prefer receiving codes by SMS, see the method below.
Two-factor authentication for WordPress with Jetpack SMS
WordPress.com supports two-step authentication via SMS (alongside authenticator apps and security keys). We don’t build our sites on WordPress.com, but we can borrow this feature through the Secure Sign On feature (log in with a WordPress.com account) of the Jetpack plugin. Jetpack also protects your site against brute-force login attacks.
Note (10/2026): The screenshots in this section show the WordPress.com and Jetpack interface from 2019, which has changed quite a bit. I have updated the menu paths in the steps based on the current WordPress.com and Jetpack support docs, so follow the text rather than the pictures.
If you don’t have a WordPress.com account yet, go to wordpress.com/start/user and create one.
Log in to your WordPress.com account, hover over your name in the top right corner, select My WordPress.com account, go to Security, then click Two-Step Authentication to get started.
(You can quickly open it with wordpress.com/me/security/two-step ) .
Enter your phone number and click Verify via SMS to receive a verification code. Note: drop the leading zero from your phone number.
Enter the code you received by text message, then click Activate.
Tick I have stored these backup codes and click Done. Save the backup codes somewhere in case your phone can’t receive messages.
(Even if you skip this, it’s not the end of the world. If your phone can’t receive messages, you can go into your hosting, delete the Jetpack folder in the plugins directory, and log in as usual.)
Go back to your WordPress dashboard, select Plugins and click Add New. Find the Jetpack plugin, then install and activate it.
The first time you use Jetpack, click the Set up Jetpack button to connect it to your WordPress.com account.
Since we are already logged in to WordPress.com, just click Accept.
Next, skip the pricing plans and scroll down to the Start with free button to use Jetpack for free.
Once connected, go back to your WordPress dashboard, open Jetpack > Settings > Security, and turn on the option that allows users to log in with WordPress.com accounts (10/2026). The screenshot below is from 2019, when these options lived in the WordPress.com management screen. I recommend turning on the first and third options; the second one depends on your needs.
Here is what each of these Jetpack options does:
- Allow users to log in to this site using WordPress.com accounts: lets users log in to your site with a WordPress.com account.
- Match accounts using email addresses: automatically links an account on your site to the WordPress.com account with the same email address, so you can log in with WordPress.com right away without linking them manually. It has nothing to do with whether usernames must be email addresses.
- Require accounts to use WordPress.com Two-Step Authentication: WordPress.com accounts must have two-step authentication turned on to log in. Note that this only applies to logins through WordPress.com. If the default login form is still there, someone could still log in with a regular password, so you also need the step below that removes the default login form.
The settings save automatically. Click WP Admin in the menu to return to your WordPress dashboard.
If you want to change these options later, you don’t need to go through WordPress.com. Just go to Jetpack and select Settings in your WordPress menu, as shown below.
Next, add the code below to your theme’s functions.php file to remove the default login form so that users log in with a WordPress.com account instead. You have 2 options:
Only remove the default login form and keep the Log in with WordPress.com button
/*Only remove the default login form*/
add_filter( 'jetpack_remove_login_form', '__return_true' );Redirect straight to WordPress.com when someone opens the login page
/*Redirect straight to WordPress.com*/
add_filter( 'jetpack_sso_bypass_login_forward_wpcom', '__return_true' );
add_filter( 'jetpack_sso_match_by_email', '__return_false' );
add_filter( 'jetpack_remove_login_form', '__return_true' );
add_filter( 'jetpack_sso_require_two_step', '__return_true' );Note: An earlier version of this post also included the line jetpack_sso_new_user_override. I removed it because, according to Jetpack’s documentation, this filter lets people with a WordPress.com account register on your site even when you have disabled registrations. If security is the goal, you shouldn’t turn it on.
Here is the result: the usual login form is gone from the login page. From now on, you just click Log in with WordPress.com and sign in with your WordPress.com account.
Once you enter the correct password, you will immediately get a text message on your phone. Enter the verification code and click Continue to log in.
When this post was written (2019), Lucid Gen used Jetpack’s two-step login via SMS too. The messages arrive very quickly, so I’m happy with it. Still, keep reading to learn a few more ways to make your website more secure.
Simple but effective way to secure WordPress
It really is “simple”, folks. Nothing scary here. Just remember the tips below, combine them with two-factor authentication, and you can feel a lot safer.
Remember these 4 "don'ts"
- Don’t install pirated plugins.
- Don’t install lots of unknown Chrome extensions.
- Don’t share your login with too many people.
- Don’t visit shady websites or download files from unknown sources.
Strengthen security at login
- Secure both your hosting admin login and your WordPress login.
- Change your WordPress login URL to something other than the default.
- Install SSL on your website and switch from HTTP to HTTPS to strengthen security.
Conclusion
Did this article help you make your website more secure? Leave a comment below to share your thoughts. You can also check out other WordPress articles on LucidGen.com, you might find something useful.
