The security of your WordPress website depends on the systems you implement to protect it and strengthen its security. With the increase in automatic password cracking, your users’ confidential information and access to your site are more at risk than ever.
That’s why it’s so important to further protect your WordPress site by adding two-factor authentication. Because your site is only as secure as your weakest password.
In this article, I’m going to tell you what two-factor authentication or identification is, why it’s so important and how to implement it on your site with easy to use and configure plugins.
What is two-factor identification?
Two-factor authentication (2FA) is a type of multi-factor authentication (MFA) and is an additional layer of protection for your website. It is an additional user verification tool, for when someone logs into their account on your WordPress site.
In a standard WordPress setup, a user only has to specify a username and password to log in. Both can be guessed by dictionary attacks or if they are very weak.
When you add two-factor identification to your WordPress site, first, the user will have to enter their username and password as usual, but that’s not the end of it.
Then he will have to provide other information that proves that it is really him who wants to log in. In addition to the password, this information can be one of the following:
- Something that only the user knows, usually a password or PIN code.
- Something that only the user has, such as a physical device, a phone or a hardware key.
- Something to prove that it is you, such as biometric data like a fingerprint or facial scan.
This data can be presented in a variety of different forms, which include:
- A text message or phone call that gives a unique code to access.
- Biometric proof such as the phone’s fingerprint sensor.
- A separate app that users can download that gives them time-based codes that they can enter.
For example, if a user wants to log into a WordPress site, they must first enter their username and password (something only the user knows) . Then, enter two-factor identification, either asking them to verify their identity with a unique code sent by text message or a time-based code in an authentication application (something only the user has).
Or, on a higher security site like a bank might require the username and password (something only the user knows) first. Then, they might require a time-expired PIN code using their card (something only the user has) on a card reader and, as an added benefit, fingerprint scanning if you are logging in via your phone (something to prove you are who you say you are).
Why you should add two-factor identification to your WordPress site
It’s easier than you think for someone to steal your password. In addition, most of your site users and team members use very weak passwords.
In fact, it probably won’t be news to you that cybercrime is on the rise. In recent years, personal data breaches, data loss and password exposure have been on the rise and are expected to cost the world 5 billion euros annually by 2022.
No matter the size of your website, the rise in automated password hacking means your site could benefit from some additional layers of security.
Enforcing strong WordPress passwords for your users is incredibly important for the security of your website. However, a strong password alone is not enough. One slip of user error could result in a hacker gaining access to your site and could put your customer or user data at risk.
The good news is that this can be stopped by implementing two-factor authentication in WordPress. In fact, even if one of your passwords was breached, the hacker would be stopped at the next stage. Indeed, the second factor would be the last one.
Still not convinced? Here are the benefits of two-factor identification:
- Your data will be more secure : A weak password will no longer be the reason for unwanted access to your website.
- You will be protected against fraud: 2FA reduces the likelihood that an attacker can impersonate a user.
- Your team will have more freedom: Employees can securely access documents and data without putting the information at risk.
- You will increase your users’ confidence: Your customers will appreciate that you are taking extra steps to ensure that their data is secure.
- Reduce future costs: If your site is protected, you won’t have to spend money to fix it.
Now that we know the benefits of 2FA for your website and your business, it’s time to install it on your WordPress.
How to add two-factor authentication to your WordPress site
The easiest and fastest way to set up WordPress two-factor authentication is to install a plugin.
But as it is becoming more and more complicated to choose among the many plugins for every need, let’s take a look at the easiest 2FA plugins to implement and configure.
What do you need to use 2FA double verification?
The only thing you will need, apart from your WordPress web administrator or editor user account and a plugin that includes the activation of double authentication, is a mobile app such as Google Authenticator or Authy, free for iOS and Android, installed on your mobile or tablet.
2FA with WordFence Login Security
Although you already know that I do not recommend it, if for some reason you already use the WordFence plugin, you should know that regarding the two-factor identification this utility is already included, both within the complete plugin and through a plugin that only offers this specific tool, which is recommended in itself: WordFence Login Security.
No matter what you choose, if it is the complete WordFence plugin or the WordFence Login Security plugin, or any of the following, the steps to activate and start using the double identification are exactly the same.
- Activate the dual authentication.
- Install a two-factor authentication app on your mobile device (Google Authenticator, Authy, etc.).
- With the double authentication app, scan the QR code to add the application (your website) to the app.
- Save the backup codes, in case you lose your mobile device to be able to log in without the app.
- The next time you log in, in addition to the username/email + password, you will be asked for temporary expiration numbers generated by the authentication app for your application (web).
Then the settings:
- For which user profiles the double authentication will be mandatory/optional/inactive.
- Whether to allow the optional 30-day grace period (so that the user can choose not to be prompted every day).
- Require 2FA for XML-RPC connections (recommended)
- Also add reCAPTCHA (unnecessary)
- Enable NTP protocol (recommended)
- WooCommerce integration (optional)
As you’ll see, it delivers perfectly and works flawlessly, so – although I don’t recommend using Wordfence as a security plugin – the Wordfence Login Security plugin is a good option for adding double authentication to your WordPress site.
2FA with iThemes Security
As you may already know, this plugin was one of my favorites until the summer of 2021 when they decided to totally complicate the interface, forcing you to go through a wizard that made difficult what was once simple.
However, if you still use this plugin for the security of your WordPress website, it also includes the option to enable double identification, which you will find in the wizard.
After activating it, and only after completing the tedious setup wizard, you will be able to configure two-factor authentication.
In the settings you will be able to choose the double verification methods:
- Mobile App
- Backup ID codes
The most common is to choose the mobile app, but if you opt only for the confirmation email method, or only the mobile app, I always recommend activating the backup codes, which are always a lifesaver.
Once you activate them, on the next login, users will be prompted to initiate the login process by double-identification, using the methods you have activated.
Once activated, it is very simple and intuitive.
What is more complicated is how to define for which users to activate double verification, because for this you will have to configure iThemes Security by creating groups of users and, for each one, decide what you activate and how. This is the part that they complicated so much with the damn wizard, and why I currently do not recommend this security plugin.
2FA with SG Security
Another way to enable two-factor identification in WordPress is via SiteGround Security, currently my favorite security plugin, which can be installed on any WordPress site, even if it is not hosted by SiteGround.
The best part is that, like everything in this security plugin, activating two-factor authentication is just one click.
Once two-factor identification is enabled, the next time an administrator or editor user accesses your WordPress site, they will first have to enter their username and password, and then they will be prompted for the temporary expiration numbers generated by the mobile authentication app, and can check the box to not be asked again for it for 30 days.
After logging in, you will be shown the backup codes, encouraged to save them in a safe place, and you will be able to log in.
Subsequently, each user will have the QR code and security code on their profile settings page, as well as the backup codes, in case they forgot to save them on their first two-factor authentication login.
SG Security’s 2-factor identification works with the main double authentication mobile apps, such as Google Authenticator and Authy, and at the moment it is activated by default for administrators and editors, the user profiles with more access and, consequently, more sensitive, although it is planned to extend it to other profiles.
It does not have as many settings as the other plugins, but it makes up for it with simplicity, something that many users value positively, me among them, especially with these new technologies, which tend to be difficult for most users, so although for advanced configurations it could fall short, it seems to me a more than valid option, and above all simple to implement and configure.
2FA with WP 2FA
The last option I will recommend you is a specific plugin for two-factor identification, and that I consider to be the best among the many that there are just for this utility: WP 2FA.
As soon as you install it and activate it, a configuration wizard will start, totally recommended, that will ask you for the methods you want to activate, which users to require the double identification and a few more settings, as you can see in the following screenshots:
As we have already seen before a bit of the terminology of this technology I will not get repetitive, because basically, the wizard settings are the same as in other plugins, so the screenshots are pretty self-explanatory and easy to understand.
Only the screens will change depending on whether you choose identification via mobile app or email.
With this you would have finished configuring the basic settings, but there is still more, because being a specific plugin it has quite a few additional settings, which are not shown in the initial wizard, that you should review.
For this you have a new item in the administration called WP 2FA, with two additional settings configuration pages:
- 2FA Policies
In the 2FA policy you will be able to:
- Select the available dual-ID methods
- Choose for which profiles to force double identification
- Define a grace period or not
- Whether an external 2FA settings page will be created for the users or the settings will be in the WordPress admin
- Choose where to redirect users to after setting up their 2FA page
- Whether users will be able to disable 2FA in their profile or not
WP 2FA settings
In the settings section you will find 3 tabs, namely:
- Email settings: Here you can customize the texts and more options of the emails sent by the double authentication system.
- General settings: A few technical settings about how the plugin works, which you will normally not have to modify.
- White label: You will be happy to know that you can customize the texts that are shown to users in the double authentication process.
As you can see, it is the most complete of all in terms of customization possibilities, there is no possible competition in this regard.
It also has a premium version, payable, but it is not really necessary except for applying double-ID expiration policies, statistics and little else.
What is the best 2FA two-factor identification plugin?
I think it is clear that the most complete is WP 2FA, there is no doubt. The fact that it is a specialized 2FA plugin is noticeable, and beats any of the other options, for customization, for settings, for everything.
Now, should you install a specific 2FA plugin if your security plugin already offers this tool?
Well I think that, unless you NEED some specific functionality offered by the specific plugin and it is not available in your security plugin, I would use the 2FA feature of your security plugin, for not overloading plugin headers in your site, activating more code, having to maintain more plugins, etc. For economy of resources you could say.