Quick question:
How soundly do you sleep at night?
Strange question, we know. But if you read this whole article instead of cutting straight to the chase, you’ll get why we asked.
But for now…
If you’re looking for a nice, juicy article on WordPress Two-Factor Authentication, tell us if all this sounds familiar:
- You got an alert from a security plugin that your WordPress site login page was getting a lot of traffic
- You got a warning that bots were trying to hack into your site
- You were told by your security plugin that you needed login protection
And then, you started to look into login protection and you realized that…
Every blog and YouTube video was recommending you to get WordPress Two-Factor Authentication installed.
That’s probably how you started looking for WordPress Two-Factor Authentication.
In this article, we’re going to:
- Walk You Through What WordPress Two-Factor Authentication Is
- Why You Should Use It
- How to Install WordPress 2FA in Quick and Easy Steps
- Which WordPress Two-Factor Authentication Plugin You Should Use
Let’s dive right in.
What is WordPress 2-Factor Authentication?
Do you think that the safety of your site depends on a plugin?
That’s only partly true.
In reality, your site’s security is mostly up to you. You need to take action and set up defenses for your WordPress site.
A perfect example of this is WordPress Two-Factor Authentication.
You’ll see why really soon.
WordPress Two-Factor Authentication is a security measure that adds a layer of protection to your login page beyond your password.
Adding WordPress 2FA makes it virtually impossible:
- For a hacker to hijack your site, even if… they have your password guessed
- For a bot to break into your site login page, even if… they are trying to brute force it
When you add WordPress 2FA, you will still need to use your username and password to log in. But then, you’ll need some extra information to verify that it’s really you.
What extra information is this?
Usually, this is:
- An OTP sent to a device that only you would have access to;
- A time-based OTP sent via email;
- An additional password or PIN;
- A security question that you would set at the time of installation (NOT RECOMMENDED);
The real reason why you should use WordPress Two-Factor Authentication is that the password you use can be hacked in a million different ways. In fact, password hacking is estimated to rise even further and cost the world $6 trillion annually by 2021.
Let us ask you again: How soundly do you sleep at night?
Reality Check: It’s easier than you think to steal your password. Most of your team and users also use very weak passwords that are easy to guess for a hacker with a brute force algorithm and rainbow tables (more on this soon).
Installing 2FA to your site is not a substitute for a strong password. You should still create a really strong password to protect your site.
Now that you understand what WordPress Two-Factor Authentication is and how it works, let’s help you set it up for your site.
Just follow along with the next bit.
How to Install WordPress Two-Factor Authentication?
The only way to install WordPress Two-Factor Authentication is to use a third-party plugin. The standard installation of WordPress does NOT come with 2FA protection for your login page. The best you can get from a Softaculous installation is a login limiter.
But even that’s not a great option for an off-the-rack WordPress installation.
So, what can you do?
The best way to install WordPress 2FA to your site is to use a security plugin.
Now, there are two ways to do this:
- Install a full security suite that comes with powerful security features
- Use a specialized plugin that only installs WordPress 2FA
In this article, we’re going to explore both options.
Our Recommendation: Use MalCare’s Full Suite of Security Features
This might seem like a slightly biased recommendation, but it’s truly not.
Trust us when we say it: installing WordPress Two-Factor Authentication is a good thing. But that’s nowhere near powerful enough to keep your site truly secure.
Of course, there is no such thing as a fully secure WordPress site.
That’s just how WordPress is built.
But with MalCare, you get a fully functioning Two-Factor Authentication system along with robust bot protection.
MalCare’s powerful login protection system offers features that keep your site as safe as money in a bank.
MalCare has a powerful learning algorithm that connects to all 250k+ sites it serves.
The learning algorithm operates like this:
- First, the algorithm identifies the IP address of whoever is trying to login to your site.
- Then, it analyzes the IP address for known malicious IPs of hackers and bots.
- Finally, it uses its AI to check if the IP of the login is malicious even if it is unknown.
After these 3 steps, MalCare will either allow the login page to be loaded or it will block the login attempt and flag the IP address as malicious. Once flagged for one site, the same IP address can never attack any WordPress site protected by MalCare.
After that, the user has to enter their username and password to attempt a login.
This completely bypasses the need for WordPress Two-Factor Authentication.
But if you are a MalCare customer, MalCare uses 2FA for its own dashboard.
If the credentials to the dashboard check out, MalCare’s WordPress Two-Factor Authentication forces you to verify yourself using an OTP system.
This way, no one can tamper with your account and turn off the protection we provide.
To enable it, you need to login to your MalCare Dashboard:
Click on ‘Account’:
Click on ‘My Account’:
Then head over to ‘Two Factor Authentication’ and click on ‘Enable’:
A QR code should pop up on your screen:
You can:
- Scan it on your mobile using Google Authenticator or any other two-factor authentication app on your phone;
- Or you can enter the passcode on the Google Authenticator app manually.
Either way, you will get an OTP to verify your device.
Enter the OTP on MalCare and click on ‘Activate’.
And there you have it!
Every time you have to log in to your MalCare dashboard, you will generate an OTP to verify who you are.
Trust us when we say it:
MalCare’s has a whole host of features to protect, scan, and clean your site round the clock.
If you are not already using MalCare, we strongly recommend installing the plugin today to enable complete WordPress protection right away.
A Few Other Options: Other WordPress 2FA Plugins
There are a host of WordPress Two-Factor Authentication plugins out there. Most of these do only one thing and they do it right. On the surface, this seems like a legitimate idea.
But it’s really not.
WordPress 2FA plugins don’t offer more than one layer of security for your site.
Of course, if you already have a plugin for:
- Malware scanning;
- Malware cleaning;
- WordPress hardening;
And all you want is WordPress two-factor authentication, then by all means – get a separate plugin to do just that.
Or, you could start using MalCare today and forget about having to install six different plugins.
That said, here’s our list of the top 5 WordPress plugins for login protection and two-factor authentication that you can trust:
#1 MalCare
We’ve already talked about this option in this article.
Honestly, it’s a little unfair to list MalCare along with other WordPress two-factor authentication plugins.
In reality, MalCare is a comprehensive suite for WordPress security.
If you are new to WordPress security and you just want a simple solution that you can trust, we highly recommend using MalCare.
“We aim to make WordPress easy to use so that our customers can focus on what really matters – their business. The philosophy behind MalCare is to provide simple, one-click security for ALL WordPress site owners. We do it by constantly developing better and more reliable security measures for your site.” – Akshat Choudhary, CEO of MalCare
Now, if that doesn’t sound appealing to you, we don’t know what will!
Join 250,000+ WordPress sites and Try MalCare for FREE.
#2 Two-Factor
Two-Factor is a nice free plugin that gets the job done. The 2FA settings in your WordPress user profile page are straightforward and simple to use. You can:
- Get an OTP via email
- Get an OTP using Google Authenticator
The best part?
You can also generate a backup code just in case you cannot log in using the second factor.
The only con is that Two-Factor does not have a global setting. This means that as the admin, you would have to enable 2FA for each user individually.
#3 WP 2FA
WP 2FA is another free plugin to install WordPress two-factor authentication. WP 2FA was developed by our friends at WPWhiteSecurity. Incidentally, WPWhiteSecurity is protected by MalCare.
This is one of the simplest two-factor authentication plugins ever created.
An extra-emphasis goes into making the user experience super-simple. So, naturally, you get a setup wizard to guide every user to install two-factor authentication for their accounts. There is absolutely no need to have ANY technical expertise (just like MalCare).
You have the choice between a bunch of OTP options and you can make 2FA mandatory for all users from the admin account.
No complaints if you end up installing this one.
Cheers, Robert!
#4 Google Authenticator
Google Authenticator is the first 2FA plugin that we ever used.
This plugin is also free and it is the most simple and basic 2FA WordPress plugin. After you install the plugin, visit your profile page and enable the Google Authenticator Settings. Then, scan the QR code that pops up with the Google Authenticator app on your smartphone.
There are quite a few reasons not to use this one.
For one thing, it is compatible only with Google Authenticator and no other authentication app out there.
This plugin does not have global settings either. So, you will have to manually set up 2FA for all your users.
There are no backup codes either. So, if you lose your smartphone, you will have to manually delete the plugin via FTP or SSH.
#5 Unloq Two Factor Authentication
Unloq’s WordPress Two-Factor Authentication plugin is another good choice.
You get the full suite of standard options in installing Two-Factor Authentication. You can also send an invite to all your users to set up 2FA from a central dashboard. You also get Push Notifications to verify your account instead of using OTP every time.
You can get both mobile device OTPs and email OTPs – that’s a helpful feature too.
The only catch?
You’ll have to do it all using the Unloq mobile app.
Not cool.
What’s Next?
Now that you know and fully understand what WordPress Two-Factor Authentication is and how to set it up on your site, here’s what you need to do next:
Realize that it is not enough.
Seriously, do NOT rely exclusively on a 2FA plugin and imagine that your site is safe.
It’s not.
So, what can you do?
Simple – have a malware scanner to continuously monitor your site for malware. Install a good malware cleaner that you can rely on so that you can clean your site instantly even if you get infected.
Yes, you need a decent firewall protecting your login page as well.
But most importantly, you need to beef up your security measures using WordPress security hardening plugins.
Here’s something most of you don’t know:
Hackers feed off of your ignorance. Most hacks occur simply because WordPress users don’t take the time to understand the threats they are faced with every single day.
So, just take a minute to subscribe to our newsletter. Educate yourself. Our emails are short, juicy, and always helpful.
Or, you could just install MalCare and sleep a little more soundly at night.
Until next time!
