Lock down your WordPress login with two-factor authentication

Before you start

You’ll need an authenticator app on your phone. Google Authenticator and Microsoft Authenticator are both free. If you already use a password manager like 1Password or Bitwarden, it can generate the codes for you, so you don’t need a separate app.

Step 1: Open the 2FA settings

Log in to your website and go to AIOS > Two Factor Auth in the left-hand menu. Note that your menu will likely have far fewer menu items in it than mine does.

 

Can’t see this menu? Your site may run a different version of AIOS, or 2FA may not be switched on for your user role. Ask whoever manages your website to check.

Step 2: Scan the QR code

Open your authenticator app (I use Google Authenticator or 1Password, my password manager), add a new account, and scan the QR code on the screen. Your website will appear in the app with a six-digit code that refreshes every 30 seconds.

Step 3: Check the codes match

Compare the code on your screen with the code in your app. Once they match, tick the Enabled checkbox.

Step 4: Save a backup of your private key

If you lose your phone, your private key lets you set up 2FA again on a new device without getting locked out.

On the Two Factor Auth page, find your private key and copy it somewhere safe:

• A password manager is the best option. 1Password, Bitwarden, and Apple Passwords all work.
• A locked note in the Notes app is a good alternative on Apple devices. Locked notes are encrypted and need your password or Face ID to open.

Keep the key separate from your website password. If both are in the same place, one leak gives away both. Don’t email it to yourself or save it in a plain document.

Step 5: Log in with your code

Next time you log in, a box will appear after your password asking for your 2FA code. Open your app, enter the current code, and you’re in.

Keep your access safe

Your authenticator app and your private key are your way back in. If you get a new phone, move your accounts across before you wipe the old one.

If you lose access to both, you’ll need someone with admin access to reset 2FA for you. If you’re a Studio Clvr client, get in touch, and we’ll sort it out. Otherwise, contact whoever manages your website.

Common questions

Do I need to enter a code every time I log in? On the free version of AIOS, yes. The premium version can remember trusted devices so you’re asked less often.

Can I use 1Password or another password manager instead of an app? Yes. Any app that supports one-time passcodes (often labeled TOTP) will work. I use 1Password and it auto-enters the one-time-code so I don’t need to worry about it. Hot tip: don’t hit enter after inputting your password, that seems to break it. 1Password will do everything for you, including progressing from the main login to the 2FA screen.

What happens if I skip the private key backup? If you lose your phone/access, you’ll be locked out until someone with admin access resets your 2FA. Saving the key takes a few seconds and saves you that wait.