What this problem looks like
Passwords alone fail against credential stuffing and phishing. TOTP two-factor adds a six-digit code from an app on your phone. Enforce 2FA on every account that can install plugins or edit users.
Test on your own admin account before enforcing site-wide. One misconfigured enforcement can lock out every administrator at once.
Step 1: Install a 2FA plugin
From wp-admin go to Plugins → Add New. Search for Two Factor by the WordPress Contributors or WP 2FA by Melapress. Install only from wordpress.org or known vendors.
- Install and activate the plugin.
- Open its settings page under Settings or Users.
- Confirm compatibility with your login customisation plugins.
Step 2: Set up TOTP on your admin account
Go to your user profile. Scan the QR code with Google Authenticator, Authy, or 1Password. Enter the six-digit code to confirm enrollment.
Step 3: Enforce 2FA for privileged roles
In plugin settings, require 2FA for Administrator and Editor roles. Give users a grace period to enroll before blocking login without a code.
Step 4: Test login on staging and production
Log out and log in with password plus TOTP code. Test from a private window. Confirm WooCommerce my-account login is unaffected if customers use a separate flow.
Step 5: Plan account recovery
Document who holds backup codes. If a phone is lost, rename the 2FA plugin folder in wp-content/plugins/ via File Manager, SFTP, or FTP to deactivate it temporarily. Rotate salts after recovery if compromise is suspected.
When to stop DIY and hire help
Agencies managing many client sites benefit from enforced 2FA and login hardening without lockout risk. BugShield configures WordPress security policies at a confirmed fixed price.