{"id":102185,"date":"2022-12-28T19:04:55","date_gmt":"2022-12-29T00:04:55","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/?p=102185"},"modified":"2025-04-02T16:54:40","modified_gmt":"2025-04-02T20:54:40","slug":"wordfence-2fa","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/plugins\/wordfence-2fa\/","title":{"rendered":"Using Wordfence Login Security for 2FA"},"content":{"rendered":"
\"Using<\/figure>\n\n\n\n

The Wordfence Login Security plugin for WordPress allows you to use two-factor authentication, XML-RPC Protection, and login page CAPTCHA.\u00a0 Two-factor authentication (2FA)\u00a0 is a vital layer of defense that you can add to your WordPress installation to protect it from intruders. The use of 2FA prevents intruder access through compromised passwords.<\/p>\n\n\n\n

This tutorial will focus primarily on using the Wordfence plugin for two-factor authentication, but we will also briefly describe the other features.<\/p>\n\n\n\n

Setting Up Wordfence 2FA \u2013 Video<\/h2>\n\n\n\n
\n
\n\t\n\t\t\"How\n\t\t<\/span>\n\t<\/a>\n<\/div><\/div>\n<\/div><\/figure>\n\n\n\n

Installing WordFence Login Security<\/h2>\n\n\n\n

The Wordfence Login security plugin can be installed through the WordPress Plugin page<\/a> or the WordPress Administrator Dashboard Plugins page.\u00a0 The steps below walk you through the installation in the dashboard.<\/p>\n\n\n\n

NOTE: Installation of the plugin does not automatically turn on two-factor authentication.<\/em><\/p>\n\n\n\n

    \n
  1. Login to your WordPress Administrator Dashboard.<\/li>\n\n\n\n
  2. Click on Plugins<\/strong>.<\/li>\n\n\n\n
  3. Click on Add New<\/strong>.<\/li>\n\n\n\n
  4. Search for \u201cWordFence Login Security Plugin<\/strong>.\u201d<\/li>\n\n\n\n
  5. Click on the Install Now<\/strong> button.<\/li>\n\n\n\n
  6. When it completes installing, click on the Activate<\/strong> button.<\/li>\n<\/ol>\n\n\n\n

    The completion of the installation will place a Login Security<\/strong> section in your WordPress menu.\u00a0 The Wordfence Login Security plugin contains only a portion of the full functionality found within the full Wordfence plugin<\/a>.<\/p>\n\n\n\n

    Using Wordfence Two-factor Authentication<\/h2>\n\n\n\n

    Two-factor authentication works by challenging you to enter a code or key after you have initially logged in with your password.\u00a0 Wordfence 2FA uses Time-based One-time Passwords (TOTP) that can be obtained from applications like Google Authenticator, FreeOTP, and Authy.\u00a0 Wordfence provides a list of supported TOTP-based apps<\/a>.

    You will need a mobile device that can connect to the internet and use a TOTP-based application. The steps below use Google\u2019s Authenticator on an iPhone. Authenticator can be obtained from Apps on Google Play for Android devices or through the App Store for Apple devices.<\/p>\n\n\n\n

    Activating the Wordfence Two-factor Authentication\u00a0for an Administrator<\/h3>\n\n\n\n
      \n
    1. Click on Login Security to open up the main page.<\/li>\n\n\n\n
    2. Open your authenticator app.<\/li>\n\n\n\n
    3. Add a new account.\u00a0 For Google Authenticator, you can click on the plus sign in the bottom right corner.\u00a0 You will see the options to Scan a QR code<\/strong> or Enter a setup key<\/strong>.<\/li>\n\n\n\n
    4. Scan the QR code on the Login Security page, and an account will immediately be created in the Google Authenticator app.<\/li>\n\n\n\n
    5. Once the account has been created, click one box in the bottom right corner and then type in the current<\/em> code that you see in the Google Authenticator app for Wordfence.\u00a0<\/li>\n\n\n\n
    6. Copy or download the five Recovery Codes<\/strong>. Keep these codes secure as they can be used to log in, bypassing 2FA.\u00a0 These codes can only be used once.<\/li>\n\n\n\n
    7. Click on Activate<\/strong>.<\/li>\n<\/ol>\n\n\n\n


      Some apps allow you to enter a code instead of using the scanner.\u00a0 This is handy when you don\u2019t have a working camera. The code for activation can be found immediately under the QR code.<\/p>\n\n\n\n

      Setting Up Non-admin Users for Two-factor Authentication<\/strong><\/p>\n\n\n\n

      You can also set other user roles to be required to use 2FA. These users can set it up independently after being notified of the requirement. Notification can occur through a note displayed when the user logs in to WordPress or through an email. To notify a user through email, you can select their user role, then click on Notify <\/strong>as per the screenshot below.

      \"Wordfence<\/p>\n\n\n\n

      If a user who is required to set up 2FA has not done so, then they will also see a notice when they login to the WordPress Administrator Dashboard:

      \"Wordfence


      The steps for a user activating two-factor authentication are identical <\/em>to the seven steps above. The main difference is the access to the Wordfence setup page. Each user can click on the link in the notification or in the email. They can also access the Wordfence 2FA settings through their WordPress user profile page.<\/p>\n\n\n\n

      Users will not be required to use 2FA while the grace period is active. If you want to make 2FA immediately required, you must first activate 2FA for the user, then change the grace period to 0 in the Wordfence 2FA settings.<\/p>\n\n\n\n

      Congratulations, you\u2019ve activated Wordfence\u2019s 2FA!\u00a0 After the grace period has expired, you will be required to enter a code from your authenticator after you log in with your username and password.\u00a0
      <\/p>\n\n\n\n

      Recovery Codes<\/h3>\n\n\n\n

      In the right column, you will see five lines of codes that can be used if you do not have access to your authenticator or the device with your authenticator app.\u00a0 Note that each line of code is for one-time use only.\u00a0 You can create recovery codes through the User Profile Wordfence options if needed.

      \"screeenshot
      <\/p>\n\n\n\n

      2FA Settings Tab<\/h3>\n\n\n\n

      The settings tab includes two-factor authentication, XML-RPC, and CAPTCHA settings.\u00a0 The following settings descriptions focus on the 2FA settings.
      \"screenshot

      Setting Up User Roles to use 2FA<\/strong><\/p>\n\n\n\n

        \n
      1. Under the settings table, you will see 2FA Roles<\/strong>.\u00a0 Use the drop-down menus to make a role required to use 2FA.

        \"Screenshot
        <\/li>\n\n\n\n
      2. When you change a role, you will see the blue SAVE<\/strong> button under the users\u2019 table light up.\u00a0 Click on SAVE<\/strong> to save your changes.<\/li>\n<\/ol>\n\n\n\n

        Managing Users<\/strong><\/p>\n\n\n\n

        You can manage users to enable 2FA. This is based on the Users who are registered on your WordPress site.\u00a0\u00a0<\/p>\n\n\n\n

          \n
        1. Click on the Settings<\/strong> tab.<\/li>\n\n\n\n
        2. Click on Manage Users<\/strong> in the top right corner.<\/li>\n\n\n\n
        3. Hover over the user name, click Edit<\/strong>, or click on 2FA<\/strong>.<\/li>\n\n\n\n
        4. If you click on Edit<\/strong>, you must scroll to the bottom of the User\u2019s profile until you find the Wordfence Login Security section.\u00a0 Clicking on 2FA<\/strong> or Activate 2FA<\/strong> will bring you back to the setup screen to activate 2FA. Manage 2FA Settings<\/strong> returns you to the Settings<\/strong> tab. This allows you to enable or disable 2FA for that user.
          \"Screenshot<\/li>\n\n\n\n
        5. Click on Update Profile<\/strong> to save the changes.<\/li>\n<\/ol>\n\n\n\n

          Grace Period<\/strong><\/p>\n\n\n\n

          This period of time allows for a certain number of days for a user to set up 2FA through the WordPress user profile interface. When the time expires, the user will lose access unless 2FA has been set up.<\/p>\n\n\n\n

          Allow Remembering Device for 30 Days<\/strong><\/p>\n\n\n\n

          This option is a checkbox that allows a user with 2FA to be prompted for the code only once every 30 days.<\/p>\n\n\n\n

          Login Page Captcha<\/strong><\/h2>\n\n\n\n

          The Login Page Captcha used by WordPress now uses reCaptcha v3<\/a>. This particular version of reCaptcha works by analyzing the website traffic and identifying suspicious activity. There is no checkbox or CAPTCHA puzzle used in the verification.\u00a0 It is invisible to the user. \u00a0

          In this case, the analysis is primarily on the login page.\u00a0 Suspicious visitors will be automatically flagged and sent a verification email.\u00a0 For more details, see           WordFence Logging Page Captcha documentation<\/a>.<\/p>\n\n\n\n

          XML-RPC Protection<\/strong><\/h2>\n\n\n\n

          XML-RPC\u00a0 \u2013 Extensible Markup Language Remote Procedure Call \u2013 is a protocol that allows WordPress to communicate with other systems using HTTP. The problem is that it also introduced security problems.

          XML-RPC has been largely replaced by the REST API but remains in the WordPress core.\u00a0 The Wordfence protection provided in the plugin disables XML-RPC authentication or requires that the authentication use 2FA.<\/p>\n\n\n\n

          \n\n\n\n

          The Wordfence Login Security plugin for WordPress is a great solution for adding security to your WordPress logins without loading the full version of Wordfence.\u00a0 Two-factor authentication improves security by helping to prevent intruder access through compromised user passwords.<\/p>\n\n\n\n

          With the additional features of the login CAPTCHA and XML-RPC protection, the plugin provides a solid option for adding login security to your WordPress site.<\/p>\n\n\n\n

          Other 2FA Plugins:<\/p>\n\n\n\n