WordPress two-factor authentication for site users, enforced per role
Require TOTP authenticator codes, email codes, or backup codes for chosen WordPress user roles, enforced at the login screen. Grace logins, remember-device windows, and wp-config recovery constants mean operators are never locked out.
Stolen passwords are the leading cause of WordPress site compromises, and most 2FA implementations lock operators out when they lose a device
A strong password alone does not stop credential stuffing, phishing, or a leaked database. Two-factor authentication closes that gap but only if the implementation handles device loss and recovery gracefully. An overly strict 2FA setup that locks administrators out of production sites creates a security control that is worse than having none.
Under the hood
The steps that make it work, and what each one does.
Choose which roles require 2FA
Configure 2FA requirements per WordPress user role from the WPMgr dashboard. Administrator, editor, author, contributor, and subscriber roles can each be set to required, optional, or not available.
Users set up their preferred method
Users who are required to set up 2FA are guided through the setup flow on their next login. They can choose a TOTP authenticator app or an email code delivered to their WordPress email address.
Backup codes for device loss
Each user generates a set of single-use backup codes during setup. Codes are hashed in the database and can be regenerated from the user profile at any time while 2FA is set up.
Recovery via wp-config constants
Every 2FA control that could affect admin access has a documented wp-config constant for recovery. If a user is locked out and has lost their backup codes, an operator with server access can disable 2FA for that user.
Enter authenticator code
Backup codes and wp-config recovery available
What's included
Every capability ships in the open-source release.
TOTP authenticator app
Compatible with any TOTP authenticator app. The setup flow generates a QR code and a manual entry key. Replay protection burns each code after use.
Email code fallback
Users can choose to receive a one-time code by email instead of using an authenticator app. Email codes expire after a short window.
Single-use backup codes
Each user receives a set of backup codes during setup. Codes are single-use and hashed in the database. Generating a new set of codes immediately invalidates the previous set.
Per-role enforcement
2FA requirements are configured per WordPress user role. Administrator and editor roles can be required while subscriber and contributor remain optional.
wp-config recovery constants
Every 2FA control that could block access has a documented recovery constant in wp-config.php. Operators with server access can always recover a locked-out user.
Audit log of all 2FA events
Setup, successful logins, failed attempts, and backup code use are all recorded in the tamper-evident audit log.
Questions answered
Common questions about this feature.
Which authenticator apps are supported?
Any TOTP-compatible authenticator app works, including Authy, Google Authenticator, and 1Password. The setup flow generates a QR code and a manual entry key for apps that do not support QR scanning.
What if a user loses their authenticator device?
Each user generates backup codes during setup. Any backup code can be used in place of a TOTP code for a one-time login. After using a backup code, the user can set up 2FA again on their new device. If all backup codes are exhausted, a wp-config constant can be used by an operator with server access to reset 2FA for that user.
Can autologin from the WPMgr dashboard bypass 2FA?
Yes. The one-click wp-admin autologin used by the WPMgr dashboard bypasses the 2FA interstitial by design. It uses a short-lived signed token rather than the standard WordPress login flow.
Is dashboard 2FA (for the WPMgr control plane) different from site-user 2FA?
Yes. Dashboard 2FA protects access to the WPMgr control plane itself (TOTP and WebAuthn passkeys for the operator). Site-user 2FA protects WordPress user accounts on connected sites (TOTP and email codes). Both are configured separately.
Run your whole fleet from one dashboard.
Free and open source. No per-site fee. The full release is on GitHub.