How to Set Up Google Authenticator 2FA on WordPress

Quick setup (TOTP app + QR code)

1. Install a 2FA plugin that supports TOTP (Google Authenticator codes). Activate it.
2. Go to your profile (Users → Profile) or the plugin’s 2FA settings and enable Time-based One-Time Password (TOTP).
3. Scan the QR code with the Google Authenticator app (or compatible apps like Microsoft Authenticator/Authy). You’ll see rotating 6-digit codes.
4. Confirm by entering the current 6-digit code and saving settings.
5. Generate backup codes and store them in a secure place (password manager or printed copy).
6. Test: log out and back in—enter your username/password, then the 6-digit code.

Tip: Add a second device (e.g., a spare phone) by scanning the same QR code before you save/close the page.

Enforce by role + backup code best practices

1. Enforce by role: in the plugin’s settings, require 2FA for Administrator (and Editors if needed). Give a short grace period (e.g., 24–72 hours) so users can enroll.
2. Backup codes: generate one-time codes for each user. Instruct them to store codes offline (printed or in a password manager) and to treat them like keys.
3. Emergency bypass: keep one owner account with a secure backup method (backup codes or a hardware key if your plugin supports it) to avoid total lockout.
4. Time drift: if codes fail, ensure the phone’s time is set to automatic network time; TOTP is time-based and small drifts can break codes.

Note: Service or API accounts should be locked down with strong passwords and limited capabilities, or converted to human accounts with 2FA where possible.

Recovery options

1. Use a backup code: at the 2FA prompt, choose the backup code option and enter one of your saved codes.
2. Re-sync time: if you switched phones and codes don’t work, check device time and try again.
3. No backup codes? Temporarily disable the 2FA plugin via WP-CLI or SFTP, then re-enable and re-enroll:

   # If you have SSH/WP-CLI access:
   wp plugin deactivate google-authenticator
   # (or the slug used by your 2FA plugin)
   
   # If using SFTP/FTP (no CLI):
   # rename the plugin folder to disable it, e.g.
   # /wp-content/plugins/google-authenticator → google-authenticator.disabled
   

4. Re-enable 2FA: log in, restore/activate the plugin, and scan a new QR code. Generate new backup codes.

Tip: After recovery, add a secondary device and refresh your backup codes so you’re covered next time.

Which 2FA method to choose?

• Passkeys / WebAuthn (best): phishing-resistant and fast; use if your 2FA plugin supports hardware keys or built-in device authenticators.
• TOTP apps (Google Authenticator, Microsoft Authenticator, Authy): widely supported and secure when you store backup codes safely.
• SMS: acceptable as a last resort, but weakest (SIM-swap risk). Prefer passkeys or TOTP whenever possible.

Recommendation: enable TOTP now (broad support) and add passkeys when available; keep SMS disabled or as emergency only.

Migrate or add a second device

1. Add a backup device now: with the 2FA settings page open, scan the same QR code on a second phone or hardware key before saving.
2. If you still have the old phone: open your 2FA plugin settings, regenerate the QR/secret, and scan it on the new device; delete the old entry.
3. If you lost the phone: use a backup code to log in, then regenerate your TOTP secret and new backup codes.
4. Record new backups: store codes securely (password manager or printed copy kept offline).

Tip: name entries in your app clearly (e.g., “Site Admin — example.com”) so you can tell multiple sites apart.

Enforce 2FA by role (admins, editors, customers)

1. Enable enforcement in your 2FA plugin: require 2FA for Administrators and optionally Editors/Shop managers (and Customers if supported).
2. Grace period: give users 24–72 hours to enroll; show a dashboard notice until they complete setup.
3. Recovery ready: make sure each enforced role has backup codes and at least one secondary device enrolled.
4. Exclude service accounts: for application passwords or integrations, use least-privilege accounts instead of human logins.

Announcement copy: “2FA will be required for Admins starting Friday. Please enable Google Authenticator or a passkey under Users → Profile and save your backup codes.”

Common issues

• Time sync: set phone time to automatic network time; TOTP codes are time-based.
• Caching: exclude /wp-login.php and the login page from any CDN/page cache.
• Multiple codes saved: if you regenerated a QR, delete old entries in your app to avoid using stale secrets.
• Conflicting plugins: temporarily disable other login/security plugins to test, then re-enable one by one.