How to set up an authenticator app for WordPress

Setting up an authenticator app for WordPress adds an important second layer of protection to your account. Instead of relying only on a username and password, two-factor authentication requires an additional verification step, such as a temporary code generated by an authenticator app.

This means that even if somebody obtains your WordPress password, the password alone may no longer be sufficient to complete the normal interactive login process.

The setup itself is usually straightforward: enable authenticator-based two-factor authentication for your WordPress account, scan a QR code with a compatible authenticator app, verify the generated code and securely store any recovery codes provided by the 2FA system.

In this guide, we will look at how authenticator apps work, how to configure one for WordPress safely, how to test the setup before logging out and what to do to reduce the risk of common 2FA lockouts.

What is an authenticator app?

An authenticator app is an application that can generate temporary verification codes used as an additional authentication factor.

For WordPress, a common implementation uses time-based one-time passwords, usually called TOTP.

A typical authenticator code looks something like:

428 731

The code changes automatically after a short time interval. TOTP implementations commonly use a 30-second time step.

When authenticator-based 2FA is enabled for a WordPress login, you first enter your normal username or email address and password. The 2FA system then asks for the temporary code displayed in your authenticator app.

Both parts of that authentication flow must succeed before the login is completed.

Why use an authenticator app for WordPress?

Passwords can be compromised in many different ways.

For example:

• a password may be reused on another compromised website;
• a phishing page may trick a user into entering credentials;
• malware may capture stored passwords;
• a weak password may be guessed;
• credentials may be accidentally exposed in a document or message;
• credentials stored in another system may be compromised.

Two-factor authentication reduces the usefulness of a stolen password because an attacker also needs to satisfy the second authentication requirement.

An authenticator app is particularly useful because TOTP codes are generated locally from a previously enrolled secret and do not normally depend on SMS delivery or an active mobile network connection.

Two-factor authentication should still be considered one part of a broader login security strategy. For the other layers worth reviewing, see A WordPress login hardening checklist.

What does TOTP mean?

TOTP stands for Time-Based One-Time Password.

When you configure a TOTP authenticator, the WordPress 2FA system and the authenticator application share a secret value.

The authenticator combines that secret with the current time to calculate a temporary verification code.

The server independently calculates the expected value. If the code submitted by the user matches an acceptable value for the current time window, the second authentication step succeeds.

The shared secret itself is not normally entered during every login. It is established during enrollment, commonly by scanning a QR code.

The underlying TOTP algorithm is standardized in the TOTP specification.

Which authenticator apps can you use with WordPress?

If the WordPress 2FA implementation supports standard TOTP authentication, you can generally use an authenticator application that supports compatible TOTP accounts.

Examples of applications and tools commonly used for TOTP include:

• Google Authenticator;
• Microsoft Authenticator;
• 2FAS;
• Authy;
• password managers with built-in TOTP support;
• other applications compatible with standard TOTP authentication.

The important requirement is compatibility with the authentication method configured on the WordPress site.

For a company or larger team, it is useful to define which applications and recovery procedures are supported internally so users receive consistent setup instructions.

Do you need a phone to use an authenticator app?

A smartphone is the most common device used for authenticator apps, but it is not necessarily the only option.

Some password managers, desktop applications and security tools can also generate TOTP codes.

The important requirement is that the selected application can securely store the authentication secret and generate compatible time-based codes.

For important administrator accounts, consider what happens if the device or application becomes unavailable before deciding where the second factor should live.

Before setting up WordPress 2FA

Before changing the authentication configuration of an important WordPress account, prepare a basic recovery path.

Ideally, you should:

• make sure you know your current WordPress password;
• keep your existing authenticated WordPress session open;
• have another trusted administrator available on important sites;
• choose the authenticator app you intend to use;
• know where you will securely store backup codes;
• avoid performing the first setup immediately before an urgent site task.

The goal is simple: configure and test the second factor before your current working session disappears.

How to set up an authenticator app for WordPress

The exact interface depends on the 2FA implementation installed on your WordPress website, but the general TOTP enrollment process is usually similar.

Step 1: Log in to WordPress normally

Start by logging in to WordPress with your existing username or email address and password.

Keep this browser session open throughout the entire setup process.

That session gives you a recovery opportunity if the new authenticator configuration does not work as expected.

Step 2: Open your 2FA settings

Navigate to the section where two-factor authentication is configured for your user account.

Depending on the implementation, these settings may appear in:

• your WordPress user profile;
• a dedicated security page;
• the settings page of a security plugin;
• a dedicated two-factor authentication module.

Look for an option related to authenticator apps, TOTP, one-time passwords or two-factor authentication.

Step 3: Enable authenticator-based authentication

Enable the authenticator or TOTP authentication method for your account.

The system will normally generate a unique authentication secret.

This is commonly presented as a QR code so that you do not need to type the secret manually.

Step 4: Open your authenticator app

Open the authenticator application on the device you want to use for WordPress authentication.

Choose the option to add a new account.

The wording varies between applications, but common options include:

• Add account;
• Scan QR code;
• Add TOTP;
• Set up account;
• Enter setup key.

Step 5: Scan the WordPress QR code

Use the authenticator application to scan the QR code displayed by WordPress.

After scanning it, the application should create a new entry for your WordPress account.

The entry may display the website name, your username or another label provided by the 2FA system.

You should then see a temporary numerical code that changes periodically.

Step 6: Enter the verification code in WordPress

WordPress will normally ask you to confirm the setup by entering the current code from the authenticator app.

Enter the code before it expires.

If the code is accepted, the system has confirmed that the authenticator and the website are using the same TOTP secret correctly.

Step 7: Save your backup codes

If the 2FA system provides backup or recovery codes, generate and save them immediately.

Do not skip this step merely because the authenticator app currently works.

Backup codes provide an alternative recovery path when the primary authenticator is unavailable.

Store them somewhere secure and separate from the authenticator device when possible.

Step 8: Do not log out yet

After the setup reports success, keep your current WordPress session open.

You still need to confirm that the complete login process works from a fresh session.

Step 9: Open a private browser window

Open an incognito or private browser window while keeping the original WordPress session active.

Navigate to the WordPress login page and enter your normal credentials.

The configured 2FA system should then request the second-factor verification code.

Step 10: Enter a fresh authenticator code

Open the authenticator app and enter the current code.

If the code is accepted and the dashboard loads correctly, the new 2FA configuration is working.

Only after this test succeeds should you consider the setup complete.

Why should you test 2FA in a private browser window?

The private-window test verifies the authentication flow you will experience after your current session expires.

It also lets you keep the original authenticated session available while testing.

If something is wrong, you can return to the original browser window and repair the configuration instead of discovering the problem after logging out of every session.

This is one of the simplest ways to reduce the risk of locking yourself out during initial setup.

What is the QR code used for?

The QR code displayed during TOTP setup contains information that allows the authenticator app to configure the account.

Most importantly, it encodes the secret used to generate future one-time passwords.

Because that secret is security-sensitive, the QR code should be treated as a credential.

Anyone who obtains the enrollment secret may be able to configure another authenticator capable of generating matching codes.

Do not take unnecessary screenshots of the 2FA QR code

A screenshot of the setup QR code can preserve the secret needed to recreate the authenticator entry.

Saving that screenshot permanently in a photo library, cloud backup, shared folder or team chat can therefore create an unnecessary security risk.

Once the authenticator has been configured and tested, you generally should not need the original QR code.

Use backup codes and documented account recovery procedures rather than treating a screenshot of the enrollment secret as your recovery strategy.

What if you cannot scan the QR code?

Many 2FA systems also provide the underlying setup key in text form.

If the camera cannot scan the QR code, you may be able to select an option in the authenticator app to enter the setup key manually.

The application may ask for information such as:

• account name;
• secret key;
• authentication type;
• time-based or counter-based mode.

For TOTP-based WordPress authentication, select the time-based option when the application requires you to choose between time-based and counter-based codes.

What if WordPress rejects the authenticator code?

If WordPress reports that the verification code is invalid, first make sure you are entering the code for the correct authenticator entry.

Users with several accounts in the same authenticator application can easily select the wrong one.

Also check whether the current code is about to expire. If only a few seconds remain, wait for the next code and try again.

If every code is rejected, verify the device’s date and time settings and confirm that the current WordPress enrollment matches the authenticator entry you are using.

Authenticator apps require accurate time

Time-based authentication depends on both sides using sufficiently synchronized clocks.

If the device clock is significantly incorrect, WordPress and the authenticator may calculate codes for different time windows.

Enable automatic date and time synchronization on the device whenever possible.

If codes previously worked and suddenly begin failing while the authenticator entry still exists, checking clock synchronization is a sensible early troubleshooting step.

What are WordPress 2FA backup codes?

Backup codes are emergency credentials that can be used when the normal authenticator is unavailable, provided the particular 2FA implementation supports them.

For example, they may help if:

• your phone is lost;
• your phone is damaged;
• you accidentally delete the authenticator app;
• the WordPress entry disappears from the authenticator;
• you replace your phone and the authentication secret is not transferred correctly.

Backup codes are commonly designed for one-time use. Once a code has been used successfully, do not assume that the same code remains a valid recovery credential.

Where should you store WordPress backup codes?

Recovery codes should be stored securely and remain accessible when the authenticator device is unavailable.

Possible options include:

• a trusted password manager;
• an encrypted credential vault;
• a protected offline backup;
• a secure company recovery system;
• a securely stored physical copy where appropriate.

Avoid leaving backup codes in an unprotected text file, ordinary shared document or team chat history.

They are authentication credentials and should be protected accordingly.

Do not keep your only backup codes on the authenticator phone

If the authenticator app and the only copy of the backup codes are stored on the same device, losing that device can remove both recovery paths at once.

Recovery information should ideally survive the failure, loss or destruction of the primary authentication device.

This does not mean creating uncontrolled copies everywhere. It means avoiding one obvious single point of failure.

What happens when you change phones?

Replacing a phone is one of the most common situations where 2FA recovery planning becomes important.

Do not assume that authenticator entries will automatically appear on the new device.

Some authenticator applications support synchronization or migration, while others may require an explicit transfer or re-enrollment process.

Before wiping, resetting or selling the old device, confirm that the WordPress authenticator entry works from the replacement device.

How to move WordPress 2FA to a new phone safely

A safe migration process is:

1. keep the old authenticator device available;
2. confirm that your WordPress backup codes are accessible;
3. transfer the authenticator entry using the app’s supported migration method, if available;
4. generate a code on the new device;
5. test a fresh WordPress login;
6. only remove or wipe the old configuration after the new device is confirmed to work.

If the authenticator cannot transfer the account securely, you may instead need to re-enroll the WordPress 2FA configuration while you still have authenticated access.

What if you lose your phone?

If the device containing your authenticator is lost, first check whether you have another configured authentication method or an unused backup code.

If a backup code works, use it to access WordPress and replace the old authenticator configuration.

If the lost device could still contain the TOTP secret, re-enrolling with a new secret is safer than continuing to rely indefinitely on the original enrollment.

After recovery, generate a fresh set of recovery codes if the 2FA system supports them.

What if you lose your 2FA backup codes?

If your authenticator still works, losing the recovery codes does not normally mean you are locked out.

Log in while the authenticator remains available and use the 2FA system’s recovery settings to generate or replace backup codes.

If both the authenticator and recovery codes are unavailable, another trusted administrator or a documented site recovery mechanism may be required to reset 2FA for the account.

For the complete recovery process, see What to do if you lose your 2FA backup codes.

Should every WordPress user enable an authenticator app?

The answer depends on the website, the available 2FA implementation and the privileges associated with each account.

Accounts with elevated access should receive particular attention.

This commonly includes:

• administrators;
• site owners;
• developers;
• editors with broad publishing access;
• e-commerce managers;
• users with access to sensitive customer or business information.

Lower-privileged accounts may also benefit from 2FA, particularly on membership, commerce or collaborative websites.

Before deciding which users should be required to enroll, it helps to understand what each role can actually do. See How to audit user roles on a WordPress site.

Start with WordPress administrators

Administrator accounts are particularly important because they can normally make site-wide changes.

Depending on the installation, an administrator may be able to:

• install or remove plugins;
• change themes;
• create other administrators;
• modify security settings;
• access sensitive site information;
• change site configuration;
• install or execute additional code through available administration features.

For that reason, administrator accounts should generally be among the first accounts considered for stronger authentication controls.

Do not use one shared authenticator for an entire team

Teams sometimes use shared WordPress accounts or enroll the same TOTP secret on several people’s devices.

This creates operational and security problems.

If several users share the same account and second-factor secret, it becomes difficult to determine who actually performed an action.

It also makes user removal more difficult because changing access for one person may require rotating credentials used by everybody else.

Individual WordPress accounts with individual authentication factors are preferable whenever possible.

For a larger deployment, see How to roll out 2FA to a WordPress team without lockouts before enforcing 2FA across multiple accounts.

Do not share authenticator codes in team chat

A temporary code may remain valid only briefly, but that does not make it appropriate to share casually.

If users regularly send 2FA codes to each other through chat, the organization is effectively turning an individual authentication factor into a shared credential.

Each user should authenticate with their own configured factor.

Use strong passwords even when 2FA is enabled

Two-factor authentication does not make password quality irrelevant.

The password remains an authentication factor.

WordPress users should still use strong, unique passwords and avoid:

• reusing passwords from other services;
• sharing passwords through email or chat;
• using predictable variations of company names;
• storing passwords in unprotected documents.

2FA works best as an additional security layer rather than compensation for poor credential practices.

2FA does not replace other login protection

Two-factor authentication and controls such as login attempt limiting solve different problems.

2FA reduces the usefulness of a compromised password because another authentication requirement remains.

Rate limiting and other login protections can reduce repeated automated authentication attempts against WordPress.

A layered login strategy can use both rather than treating one as a replacement for the other.

Be careful with Application Passwords and API access

Not every WordPress authentication flow passes through the normal interactive login screen.

WordPress Application Passwords, for example, are separate revocable credentials intended for programmatic access by applications, scripts and integrations.

Other systems may authenticate using:

• WordPress Application Passwords;
• API tokens;
• OAuth;
• integration-specific credentials;
• custom REST API authentication.

Enabling authenticator-based 2FA for dashboard logins does not automatically mean every external integration will begin requesting a six-digit TOTP code.

Review important integrations separately when introducing new authentication requirements.

For WordPress’s built-in mechanism, see the official Application Passwords documentation.

What if the authenticator app is deleted?

Deleting the authenticator application can remove locally stored authentication secrets if the app does not synchronize or back them up elsewhere.

If that happens, an unused WordPress backup code may provide a recovery path.

After logging in, configure a new authenticator and generate a new recovery set.

If no recovery method is available, another trusted administrator or the site’s documented emergency procedure may be needed to reset the account’s 2FA configuration.

What if the WordPress authenticator entry is accidentally deleted?

Deleting only the WordPress entry from the authenticator has effectively the same practical consequence as losing access to the device: the application can no longer calculate codes from that secret.

If you still have an authenticated WordPress session, use it to repair or replace the 2FA configuration before logging out.

Otherwise, use an available recovery method or the site’s documented account recovery procedure.

Do not scan the same QR code repeatedly during troubleshooting

If setup is failing, repeatedly adding the same account to the authenticator can leave several nearly identical entries.

That makes it easy to enter a code from the wrong entry later.

When restarting the setup process, identify which enrollment is currently valid and remove obsolete authenticator entries carefully.

Give authenticator entries clear names

If you manage several WordPress websites, generic authenticator labels can quickly become confusing.

An entry called:

WordPress

is not particularly helpful when the authenticator contains six different WordPress accounts.

Where the application permits it, use labels that identify both the site and the account, for example:

TheOneWP – admin@example.com
Client Store – developer@example.com
Company Blog – editor@example.com

Clear labels reduce the chance of entering a valid code for the wrong website.

Should you store TOTP codes in a password manager?

Some password managers can store both passwords and TOTP secrets.

This can make authentication convenient because one application can manage the password and generate the temporary code.

Whether that is appropriate depends on the security model and operational requirements of the account.

Keeping the password and TOTP secret in separate systems provides greater separation between the two credentials, while storing them together in a strongly protected credential manager may offer substantial usability benefits.

Organizations should define their own policy based on account sensitivity, recovery requirements and the threats they are trying to reduce.

What should you do after enabling an authenticator app?

Once WordPress 2FA is working, complete a few final checks:

• confirm that a fresh login works;
• store your backup codes securely;
• remove obsolete authenticator entries;
• make sure your device uses accurate automatic time synchronization;
• document the recovery procedure if the account belongs to a team;
• confirm that an administrative recovery path exists for critical sites.

The setup is not complete merely because WordPress accepted the first verification code. Recovery and testing are part of the configuration too.

How to set up WordPress authenticator 2FA safely: checklist

• Choose a compatible TOTP authenticator app.
• Log in to WordPress normally.
• Keep the existing authenticated session open.
• Open the account’s 2FA settings.
• Enable authenticator or TOTP authentication.
• Scan the QR code with your authenticator app.
• Check that the account has a clear label.
• Enter the generated verification code in WordPress.
• Generate backup codes when the 2FA system supports them.
• Store recovery codes securely.
• Do not keep the only recovery copy on the authenticator device.
• Open a private browser window.
• Test a complete fresh login.
• Confirm that the authenticator code is accepted.
• Keep automatic date and time synchronization enabled.
• Document recovery steps for important accounts.
• Plan authenticator migration before replacing a device.

Setting up an authenticator app with TheOneWP

TheOneWP includes a dedicated Two-Factor Authentication module for adding an additional authentication step to WordPress user accounts.

When authenticator-based authentication is enabled, users can configure their account using a compatible authenticator app and verify login attempts with temporary authentication codes.

The operational parts of the setup remain just as important as enabling the feature itself.

Users should configure the authenticator, verify that it works, save their recovery codes and test a fresh login before ending the original authenticated session.

For sites with several administrators, editors or other privileged users, 2FA should also be introduced through a controlled team process rather than enabled without preparation.

If recovery codes are later lost, follow What to do if you lose your 2FA backup codes before making destructive changes to the account or its authentication configuration.

Final thoughts on setting up a WordPress authenticator app

Setting up an authenticator app for WordPress is one of the simplest ways to strengthen interactive account authentication.

The process normally requires only a few steps: enable TOTP-based 2FA, scan the setup QR code, verify a temporary code and securely save the available recovery credentials.

The most important mistake to avoid is treating successful enrollment as the end of the process.

Keep your current session open, test a fresh login, store backup codes securely and understand how account recovery works before you actually need it.

For administrator and other privileged accounts, these precautions are especially important because losing access can prevent urgent maintenance or security work from being performed.

Configured properly, authenticator-based 2FA becomes a routine part of the WordPress login process while making a compromised password considerably less useful on its own.