{"id":32758,"date":"2018-03-28T14:03:43","date_gmt":"2018-03-28T14:03:43","guid":{"rendered":"https:\/\/wpblog.com\/?p=32758"},"modified":"2023-05-11T13:55:32","modified_gmt":"2023-05-11T13:55:32","slug":"enable-wordpress-two-factor-authentication","status":"publish","type":"post","link":"https:\/\/wpblog.com\/enable-wordpress-two-factor-authentication\/","title":{"rendered":"How to Enable 2 Factor Authentication at Your WordPress Website Through Plugins"},"content":{"rendered":"<p>It is no secret that WordPress is one of the favorite targets of cybercriminals. Since more than 30% of the Internet runs on WordPress, there is always a chance that your WordPress website could be on the radar of a cybercriminal.<\/p>\n<p>Two Factor Authentication (2FA) is a popular method used to confirm the identity of the user accessing the website. When active, the user is verified twice using two separate methods. This way even if a hacker guesses your username and password, they cannot log into your account because they would fail the next check required to complete the 2FA authentication.<\/p>\n<h2>How to Integrate Two Factor Authentication in WordPress?<\/h2>\n<p>In keeping with the WordPress\u2019s reputation of convenience, 2FA could be integrated in several ways. In this article, I will demonstrate the following methods:<\/p>\n<ul>\n<li>2-Step SMS Verification through a plugin.<\/li>\n<li>Google Authenticator for 2FA.<\/li>\n<li>Two Factor Authentication using Email.<\/li>\n<\/ul>\n<h2>SMS Verification Through Plugin<\/h2>\n<p>In this WordPress two factor authentication setup, once a user enters the credentials, an SMS is sent to a registered phone number. The SMS contains a verification code which the user must enter on the login screen (or the next screen) to complete the login process.<\/p>\n<p>To demonstrate this method, I will use FraudLabs Pro SMS Verification WordPress plugin.<\/p>\n<p>Open your WordPress dashboard and install this plugin. Go to <strong>Settings<\/strong> and click FraudLab Pro SMS Verification. The following window will open up:<\/p>\n<p><img loading=\"lazy\" class=\"alignnone wp-image-32765 size-full\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image7-5.png\" alt=\"2 Factor Authentication\" width=\"893\" height=\"555\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image7-5.png 893w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image7-5-600x373.png 600w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image7-5-300x186.png 300w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image7-5-768x477.png 768w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image7-5-580x360.png 580w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image7-5-860x534.png 860w\" sizes=\"(max-width: 893px) 100vw, 893px\" \/><\/p>\n<p>In order to get the API key, you need to create an account on FraudLabsPro website. The API key will be sent to the registered email address. Enter the API key in the plugin\u2019s settings page.<\/p>\n<p><img loading=\"lazy\" class=\"alignnone size-full wp-image-32766\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image3-5.png\" alt=\"\" width=\"905\" height=\"551\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image3-5.png 905w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image3-5-600x365.png 600w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image3-5-300x183.png 300w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image3-5-768x468.png 768w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image3-5-580x353.png 580w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image3-5-860x524.png 860w\" sizes=\"(max-width: 905px) 100vw, 905px\" \/><\/p>\n<p>Scroll down and select the form(s) where you would like to verify the user through SMS verification.<\/p>\n<p><img loading=\"lazy\" class=\"alignnone size-full wp-image-32767\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image10-5.png\" alt=\"\" width=\"724\" height=\"260\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image10-5.png 724w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image10-5-600x215.png 600w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image10-5-300x108.png 300w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image10-5-580x208.png 580w\" sizes=\"(max-width: 724px) 100vw, 724px\" \/><\/p>\n<p>Currently, I only require the verification of the WP login form. Click <strong>Save Changes t<\/strong>o save all settings.<\/p>\n<p>To see SMS verification in action, I will log out and try to log in back.<\/p>\n<p><img loading=\"lazy\" class=\"alignnone wp-image-32769 size-full\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image8-5.png\" alt=\"SMS verification in action\" width=\"602\" height=\"647\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image8-5.png 602w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image8-5-600x645.png 600w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image8-5-279x300.png 279w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image8-5-580x623.png 580w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<p>As you can see, the login screen asks not only the credentials but also the fields for a phone number where a one-time password (OTP) could be sent to complete the verification process.<\/p>\n<div><\/div>\n<div><img loading=\"lazy\" class=\"alignnone wp-image-32785\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa.jpg\" alt=\"\" width=\"708\" height=\"657\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa.jpg 2048w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-600x557.jpg 600w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-300x278.jpg 300w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-768x713.jpg 768w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-1024x950.jpg 1024w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-580x538.jpg 580w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-860x798.jpg 860w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-1160x1077.jpg 1160w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/2fa-1320x1225.jpg 1320w\" sizes=\"(max-width: 708px) 100vw, 708px\" \/><\/div>\n<p>I can only log in if I enter the code sent via SMS even though my username and password are correct.<\/p>\n<h2>WordPress 2 Factor Authentication Through Google Authenticator<\/h2>\n<p>Another method of setting up 2FA is through the <a href=\"https:\/\/wordpress.org\/plugins\/two-factor\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Two Factor<\/a> plugin.<\/p>\n<p>Go to <strong>Plugins<\/strong> and install and activate the above-mentioned plugin. Now navigate to Users and click on <strong>Your Profile<\/strong>. Two Factor options are available at the bottom of the screen. Choose the second option and click the<strong> View options<\/strong> link.<\/p>\n<p><img loading=\"lazy\" class=\"alignnone wp-image-32772\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6.png\" alt=\"\" width=\"724\" height=\"255\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6.png 1168w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6-600x212.png 600w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6-300x106.png 300w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6-768x271.png 768w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6-1024x361.png 1024w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6-580x205.png 580w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6-860x303.png 860w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image4-6-1160x409.png 1160w\" sizes=\"(max-width: 724px) 100vw, 724px\" \/><\/p>\n<p>Install the Google Authenticator app on your phone and scan the <a href=\"https:\/\/www.adobe.com\/express\/feature\/image\/qr-code-generator\" target=\"_blank\" rel=\"noopener\">QR code<\/a> to get the six digits code. Next, enter the code in the plugin\u2019s settings page and click the Update profile button to complete the process.<\/p>\n<p>Now log out from the WordPress dashboard to see the WordPress 2 factor authentication in action:<\/p>\n<p><img loading=\"lazy\" class=\"alignnone size-full wp-image-32773\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image5-7.png\" alt=\"\" width=\"466\" height=\"288\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image5-7.png 466w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image5-7-300x185.png 300w\" sizes=\"(max-width: 466px) 100vw, 466px\" \/><\/p>\n<p>I cannot log in unless I provide the Google Authentication code.<\/p>\n<h2>2FA Through Email<\/h2>\n<p>This method is similar to SMS verification method. However, instead of an SMS, users receive a verification code in the email. The good news is that you could use the same Two Factor plugin we used previously.<\/p>\n<p>Go to <strong>Users<\/strong> from the WordPress dashboard and click <strong>Your profile<\/strong>. Scroll all the way to the bottom and choose the <strong>Email<\/strong> option.<\/p>\n<p><img loading=\"lazy\" class=\"alignnone wp-image-32774\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6.png\" alt=\"\" width=\"857\" height=\"226\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6.png 1179w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6-600x158.png 600w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6-300x79.png 300w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6-768x203.png 768w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6-1024x270.png 1024w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6-580x153.png 580w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6-860x227.png 860w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image2-6-1160x306.png 1160w\" sizes=\"(max-width: 857px) 100vw, 857px\" \/><\/p>\n<p>Now click the <strong>Update Profile<\/strong> to save the changes.<\/p>\n<p><img loading=\"lazy\" class=\"alignnone size-full wp-image-32775\" src=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image1-6.png\" alt=\"\" width=\"381\" height=\"312\" srcset=\"https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image1-6.png 381w, https:\/\/wpblog.com\/wp-content\/uploads\/2018\/03\/image1-6-300x246.png 300w\" sizes=\"(max-width: 381px) 100vw, 381px\" \/><\/p>\n<p>A verification code will be sent to the registered email address every time you try to log into the WordPress dashboard.<\/p>\n<h2>Final Words<\/h2>\n<p>Two Factor Authentication is a highly recommended best practice for WordPress security. Since WordPress 2 factor authentication could be easily setup through plugins, there is no reason why you should not have it set up on your website. If you need help in setting up these plugins, do leave a comment below.<\/p>\n<!-- AddThis Advanced Settings generic via filter on the_content --><!-- AddThis Share Buttons generic via filter on the_content -->","protected":false},"excerpt":{"rendered":"<p>It is no secret that WordPress is one of the favorite targets of cybercriminals. Since more than 30% of the Internet runs on WordPress, there is always a chance that your WordPress website could be on the radar of a cybercriminal. Two Factor Authentication (2FA)&#8230;<!-- AddThis Advanced Settings generic via filter on get_the_excerpt --><!-- AddThis Share Buttons generic via filter on get_the_excerpt --><\/p>\n","protected":false},"author":2,"featured_media":32780,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[45],"tags":[595,596,594],"acf":[],"_links":{"self":[{"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/posts\/32758"}],"collection":[{"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/comments?post=32758"}],"version-history":[{"count":20,"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/posts\/32758\/revisions"}],"predecessor-version":[{"id":42049,"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/posts\/32758\/revisions\/42049"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/media\/32780"}],"wp:attachment":[{"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/media?parent=32758"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/categories?post=32758"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpblog.com\/wp-json\/wp\/v2\/tags?post=32758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}