With 2FA on, a stolen passwordisn't enough anymore.

Passwords get phished, reused, and dumped in breaches — some attackers arrive holding a correct one. MalCare's built-in 2FA adds the one thing a breach can't include: a code that lives 30 seconds, on your phone.

Protect my site →How it works
Any authenticator app/One dashboard/No extra plugin
One correct password, two attempts, two outcomes at the second gateOne correct password feeds two identical login attempts, which drop at the same moment down two chutes into a single machine — the second gate. Each attempt is an identical login block. When both blocks land below the second gate, a familiar six-box 2FA field appears on each one. The attacker's field contains six red asterisks because no code is present; no signal reaches its shutter, the shutter stays closed, and the attempt stops dead against it. Your field fills with six green digits from the phone, the code is accepted and disappears, the shutter parts, and the attempt drops through to the base — into wp-admin. The password decided nothing. The second part decided everything.ONE CORRECT PASSWORDpassword ✓correct — in both handsATTACKERno codeYOUcode ✓THE SECOND GATEreads each attempt forthe one part a breachcannot contain2FA CODE · 30 SEC******2FA CODE · 30 SEC481276DATUM · CODEBLOCKEDpassword correct · no codeIN · WP-ADMINpassword correct · code present
Trusted by 400,000+ sites · 120 countries
Already correct

Some attackers don't guess. They log in.

Phished, reused, or pulled from a breach dump — a stolen password makes an attacker's login identical to yours. Nothing about the attempt looks wrong.

Phished

A fake page captures the real password

One convincing fake page, one paste — no malware needed.

Reused

One breach opens many accounts

The attacker only has to breach the weakest site you reused it on.

Dumped

Old passwords keep circulating

Passwords from old breaches circulate for years and get tried daily.

The second factor

The code isn't in the breach.

The second factor is the one thing a breach can't contain — a code that exists for 30 seconds, on your device only.

  • 2.1New every 30 secondsA code expires before it can be reused.
  • 2.2On your phone, not in a database dumpThere is nothing stored for an attacker to steal ahead of time.
  • 2.3Any authenticator appGoogle Authenticator, Microsoft Authenticator, Authy, LastPass — with email OTP as the fallback path.
Setup

2FA set up in minutes, with the app you already use.

Each user pairs once and is done. MalCare emails everyone the instructions.

Step 1

Scan the QR

From the setup email, in any TOTP app.

Step 2

Type the six digits

Once, to confirm the pairing.

Step 3

Done

A green checkmark lands next to your name in the dashboard. Email OTP is the fallback if a phone isn't an option.

Protect my site →Talk to an expert
Every user

Enforce 2FA for every user, from one dashboard.

Require 2FA for admins and editors, keep it optional for contributors — per user or per role, across every site you manage.

  • 4.1Rollout by emailAffected users get setup instructions automatically.
  • 4.2Status at a glanceGreen checkmarks show exactly who has finished setup.
  • 4.3Enable, disable, resetAny user, two clicks, without entering wp-admin.
The objections

Everyone knows they should turn on 2FA. Most still haven't.

Four reasons 2FA stays off — each one answered by something on this page.

The outside key

“I'll lock myself out.”

You can't — control lives off your site. Reset from the dashboard and you're back in, in minutes.

Roll out by role

“My team will fight it.”

Setup is minutes per user, by email, on apps they already have. Enforce by role and start with admins.

Two clicks

“Lost phones become my help desk.”

Reset any user in two clicks from the dashboard. No wp-admin, no FTP, no ticket.

One field

“It annoys people at every login.”

One extra field, carrying your brand — and bots never reach it.

White-label

Your logo on the 2FA screen, not ours.

The verification step is part of your product. Clients and members see your brand on it, not a plugin's.

  • 6.1Your logo, your lookThe card is skinned to your brand.
  • 6.2Reads as your productA branded step, not a third-party interruption.
  • 6.3MalCare stays invisibleClients never see our name — management stays in your dashboard.

The same verification card carrying a plugin's name, then carrying yours

Skinned to you
  • logo
  • wordmark
  • accent
  • greeting
  • button
  • footer
Untouched
  • the field
  • the code
  • the 30-second window
  • the gate

A plugin prints its own name here. MalCare prints yours.

Never locked out

Lose your phone, not your site.

Plugin 2FA keeps its settings behind the login it guards. MalCare's 2FA is controlled from your dashboard — off the site — so a lost phone is a two-minute fix.

One wall in section: the same 2FA control panel bolted to the inside face, where it is unreachable, and to the outside face, where it is notA wall is drawn in section across the middle of the figure, hatched, and labelled: your site — everything below this line needs the login. A door sits in the wall, carrying its two requirements: password, met; and code, struck through, because the phone is gone. At the top left, one origin — you, Monday 9:00, phone gone. Two reach lines leave it. The first runs to the door and stops dead against the wall at a stop mark: the plugin's control panel is bolted to the inside face, so its settings sit behind the login they guard, and the outcome is still out — a ticket or FTP. The second runs along the outside to an identical control panel bolted to the outside face, and arrives at 9:02. From that panel a conduit passes through a bushing in the wall, runs along inside it, and reaches the lock, where a callout reads 9:07, requirement cleared, back in. Both panels are drawn the same size with the same three rows — enable, disable, reset — at the same position, mirrored about the wall. The only difference between them is which face they are bolted to.↑ Outside your site↓ Inside · behind the loginYou · Mon 9:00phone goneStill out — a ticket, or FTPthe settings are behind the loginpassword ✓code ✕9:02 · reached from your dashboardMalCare 2FAoutside faceenabledisableresetPlugin 2FAinside faceenabledisableresetreset9:07 · requirement clearedback in — a two-minute fixThe same control panel, in the same place.Only the face it is bolted to is different.
Yourself

Reset, re-pair, back in

Lost authenticator? Reset from the dashboard, re-pair, back in.

Your team

Two clicks, no ticket

Reset any user in two clicks — no ticket.

Why enforcing is safe

Recovery stays outside

Recovery doesn't run through wp-admin, so requiring 2FA can't strand anyone.

2FA locks the login. The other layers cover everything else.

Most hacks come through vulnerable plugins, not logins — 2FA secures one door of several. It ships as one layer of MalCare's 7-layer security, on from day one.

  • Bots blocked before they reach the login
  • Attack payloads dropped at the firewall
  • Malware found by the daily deep scan
  • Every login recorded in the activity log — who, when, from where
Seven layers of cover drawn outermost first, with four attacks descending into them and each stopping at the layer that catches itSeven horizontal bands are stacked down the frame, numbered and named in the order an attacker meets them: bot protection, geo-blocking, firewall, two-factor authentication, vulnerability scanning, malware scanning and the activity log. The fourth band, two-factor authentication, is picked out in blue and marked as the layer this page is about. Four attacks descend into the stack from above as vertical arrows. A bot flood stops at band one. An attack payload passes bands one and two and stops at the firewall. A stolen password passes the first three and stops at two-factor authentication. The fourth arrow is drawn much thicker than the others — a vulnerable plugin — and it passes straight through bands one to four, touching neither the firewall nor two-factor authentication, before being caught at the vulnerability scanner on band five. Most hacks arrive on that arrow, not at the login, which is why two-factor authentication ships as one layer of seven rather than as the whole answer.Seven layers, outermost firstFour attacks arriving1Bot protection2Geo-blocking3Firewall4Two-factor auththe layer this page is about5Vulnerability scan6Malware scan7Activity logbot flood — stoppedattack payload — droppedstolen password — stoppedvulnerable plugin — caughtThe thick one never goes near the login — it passes straight through layer 4.Which is why 2FA ships as one layer of seven, not as the whole answer.

In their words. The login held.

Rated 5 out of 5
Best login protection ever! We handle hundreds of sites, and I'd heard bad stories about brute force attacks & password hacking… but thankfully we never had to worry about this because of MalCare. I'm sure this saved us from many sleepless nights!
Robert AbelaWP Activity Log
Rated 5 out of 5
I was on the beach with my family when MalCare notified me of a plugin vulnerability across 50 of my sites. With one click on my smartphone, all sites were fixed within minutes.
Paul LaceyWordPress Expert
Rated 5 out of 5
I had been running iThemes, WordFence & Sucuri, but they kept getting hacked. Then I installed MalCare, which quickly found the malware and cleaned up the entire site.
Adam SilverConciergeWP · Founder
Rated 5 out of 5
MalCare sends few security notifications, so one day out of curiosity I checked their firewall section. I was pleasantly surprised that hundreds of attacks were being quietly thwarted! I really like this "strong & silent" protection.
Jo WalthamCallia Web

Rolling out 2FA across client sites? A real person helps.

Enforcement by role, team setup, white-label — talk it through before you switch anything on.

Talk to an expert →Protect my site
24/7/Security experts/No obligation

Common questions, answered.

Log in to your MalCare dashboard — it's off your site, so your site's 2FA can't lock you out of it — and reset your 2FA. Set up again on a new device and you're back in, in minutes. No FTP, no support ticket.
Yes — enable it per user, per role, or for everyone at once, across all your sites. Each affected user gets email instructions, and the dashboard shows green checkmarks for who's completed setup.
Any TOTP app — Google Authenticator, Microsoft Authenticator, Authy, LastPass Authenticator, and the rest. Email OTP is available as an alternate path.
Yes — white-label it with your logo and look, so clients and members see your brand on the verification step, not a third party's.
Setup is minutes per user, guided by email, on apps they likely already use. After that it's one extra field at login. Roll it out by role if you want to start gently.
Stolen passwords being enough. Phished, reused, breached, or brute-forced credentials all fail at the second gate — the attacker has your password but not your device.
Honestly, no — it secures the login, but most hacks come through plugin vulnerabilities, not logins. That's why it ships as one layer of MalCare's 7-layer security, not a standalone fix.
Not if you white-label — the verification step carries your branding, and management stays in your dashboard.

No new plugin. Just turn 2FA on.

2FA comes built into MalCare — enforced from one dashboard, branded as yours, reset from outside your site.

Protect my site →How it works
Any TOTP app/Reset from outside your site/Works on any host