{"id":6692,"date":"2016-09-15T08:39:28","date_gmt":"2016-09-15T15:39:28","guid":{"rendered":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/kinsta.com\/?p=6692"},"modified":"2026-03-10T05:17:50","modified_gmt":"2026-03-10T05:17:50","slug":"wordpress-two-factor-authentication","status":"publish","type":"post","link":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/kinsta.com\/blog\/wordpress-two-factor-authentication\/","title":{"rendered":"The Importance of WordPress Two-Factor Authentication"},"content":{"rendered":"

We take security very seriously\u00a0here at Kinsta and that’s why we<\/strong> offer two-factor authentication for all of our WordPress hosting clients.<\/strong> Nothing could be worse than someone hijacking access to all of your sites!<\/p>\n

This feature is available in our MyKinsta dashboard and we highly recommend everyone take advantage of it.<\/p>\n

Today we will dive into why WordPress two-factor authentication is important, how our 2FA feature works, and a great free way to set up two-factor for your WordPress site itself.<\/p>\n

<\/div><\/kinsta-auto-toc><\/span><\/p>\n

Why Two-Factor Authentication Is Important<\/h2>\n

If you take a look at the top CMS platforms<\/a> such as Joomla!, Drupal, and Magento<\/a>; WordPress is leading with over 61.7% of the market share<\/a>. Due to its popularity, this also means it is attacked more than the others. You can’t really say that one platform is more secure than the other. Mainly more attacks occur because of the mere volume of sites out there.<\/p>\n

Another reason is due to unskilled website owners. WordPress has always been awesome due to the fact that almost anyone can pick it up and start using it, but that also means there are a lot of beginners most likely leaving back doors wide open by not patching, not locking things down with correct permissions<\/a>, etc.<\/p>\n

WordFence surveyed<\/a> a large number of WordPress site owners in 2016 and asked them to answer\u00a0the following\u00a0question: “If you know how your site was compromised please describe how the attackers gained access.”\u00a061.5% responded saying they didn\u2019t know how the attacker compromised their website.\u00a0<\/strong><\/p>\n

They also ran another survey to see what attackers do<\/a> with compromised WordPress sites. As you can see, 25% are typically taken offline or defaced. This is probably one of the worst things that could happen if you run a WordPress business.\u00a0That is\u00a0why you should implement security measures first, not after.<\/p>\n

\"what
What WordPress attackers do<\/figcaption><\/figure>\n

There are many ways you can lock down a WordPress site, one simple tweak is to change your WordPress login URL<\/a>. This will instantly knock down the number of failed login attempts you have to your WordPress site from bots and scripts constantly scanning the web looking for a way in. But one of the most important things is to simply choose\u00a0a complex\u00a0password<\/strong>.<\/p>\n

Sounds pretty easy right? Well,\u00a0check out SplashData\u2019s 2018 annual list<\/a> of the most popular passwords stolen throughout the year (sorted in order of popularity).<\/p>\n

    \n
  1. 123456<\/li>\n
  2. password<\/li>\n
  3. 123456789<\/li>\n
  4. 12345678<\/li>\n
  5. 12345<\/li>\n
  6. 111111<\/li>\n
  7. 1234567<\/li>\n
  8. sunshine<\/li>\n
  9. qwerty<\/li>\n
  10. iloveyou<\/li>\n<\/ol>\n

    That is right! The most popular password is “123456”, followed by an astonishing “password”. That is one reason why here at Kinsta on new WordPress installs we actually force a complex password to be used<\/strong> for your wp-admin login (as seen below on our one-click install process).<\/p>\n

    \"Force
    Force safe password generation<\/figcaption><\/figure>\n

    Security starts with the basics. Google has some good recommendations on how to choose a strong password<\/a>. And one of their recommendations is to enable two-factor authentication.<\/p>\n\n

    Two-factor authentication involves a 2 step process in which you need not only your password to login but a second method. It is generally a text (SMS), phone call, or time-based one-time password (TOTP). In most cases, this is 100% effective in preventing brute force attacks to your WordPress site. Why? Because it is almost impossible that the attacker will have both your password and your cell phone.<\/p>\n

    Check out more below on how to enable\u00a0WordPress\u00a0two-factor authentication.<\/p>\n

    Kinsta Two-Factor Authentication<\/h2>\n

    Here at Kinsta, we take user security very seriously. To help our customers protect their MyKinsta accounts and WordPress sites, we offer Authenticator-based 2FA support.<\/p>\n

    Compared to the traditional SMS-based 2FA method which sends login codes via text message, our Authenticator-based method uses dynamically-generated codes in Google Authenticator, 1Password, and other 2FA apps. This means your 2FA configuration is protected against basic security attacks like SIM swapping.<\/p>\n

    We recommend enabling 2FA for all of your Internet services that support it. To enable two-factor authentication in MyKinsta, check out our knowledgebase article<\/a>.<\/p>\n

    Enable WordPress Two-Factor Authentication<\/h2>\n

    Now that you have your Kinsta dashboard secured, you can\u00a0also enable WordPress two-factor authentication on your website. We recommend one of the following two plugins.<\/p>\n

    Two Factor Authentication<\/h3>\n

    The\u00a0Two Factor Authentication<\/a> WordPress plugin is developed by the same authors of UpdraftPlus, the popular backup plugin. It supports standard TOTP + HOTP protocols (Google Authenticator, Authy, and many others). There is both a free and premium version.<\/p>\n

    \"Two<\/a>
    Two Factor Authentication WordPress plugin<\/figcaption><\/figure>\n

    It currently has over 10,000 active installs with a 4.5 out of 5-star rating and features the following:<\/p>\n