{
    "title": "Two-factor authentication (2FA)",
    "seo_title": "Two-factor authentication (2FA): definition and factors",
    "h1": "Two-factor authentication (2FA)",
    "description": "Two-factor authentication (2FA): the factor types, how TOTP codes work, which methods are more or less secure and how to set it up on WordPress.",
    "lead": "Two-factor authentication (2FA) adds a second proof of identity to the password at login: a temporary code generated by an app, a security key or a notification on a trusted device. A stolen or guessed password is then no longer enough to get into the account.",
    "language": "en",
    "locale": "en-US",
    "type": "definition",
    "url": "https://www.wp-masquerade.com/glossary/two-factor-authentication/",
    "canonical": "https://www.wp-masquerade.com/glossary/two-factor-authentication/",
    "markdown": "https://www.wp-masquerade.com/glossary/two-factor-authentication/index.md",
    "json": "https://www.wp-masquerade.com/glossary/two-factor-authentication/index.json",
    "published": "2026-10-28T08:00:00+00:00",
    "modified": "2026-10-29T02:20:08+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Two-factor authentication (2FA)",
            "url": "https://www.wp-masquerade.com/glossary/two-factor-authentication/",
            "markdown": "https://www.wp-masquerade.com/glossary/two-factor-authentication/index.md",
            "json": "https://www.wp-masquerade.com/glossary/two-factor-authentication/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Double authentification (2FA)",
            "url": "https://www.wp-masquerade.com/fr/definitions/double-authentification/",
            "markdown": "https://www.wp-masquerade.com/fr/definitions/double-authentification/index.md",
            "json": "https://www.wp-masquerade.com/fr/definitions/double-authentification/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Autenticación de dos factores (2FA)",
            "url": "https://www.wp-masquerade.com/es/glosario/autenticacion-de-dos-factores/",
            "markdown": "https://www.wp-masquerade.com/es/glosario/autenticacion-de-dos-factores/index.md",
            "json": "https://www.wp-masquerade.com/es/glosario/autenticacion-de-dos-factores/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Zwei-Faktor-Authentifizierung (2FA)",
            "url": "https://www.wp-masquerade.com/de/glossar/zwei-faktor-authentifizierung/",
            "markdown": "https://www.wp-masquerade.com/de/glossar/zwei-faktor-authentifizierung/index.md",
            "json": "https://www.wp-masquerade.com/de/glossar/zwei-faktor-authentifizierung/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Autenticazione a due fattori (2FA)",
            "url": "https://www.wp-masquerade.com/it/glossario/autenticazione-a-due-fattori/",
            "markdown": "https://www.wp-masquerade.com/it/glossario/autenticazione-a-due-fattori/index.md",
            "json": "https://www.wp-masquerade.com/it/glossario/autenticazione-a-due-fattori/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Autenticação de dois fatores (2FA)",
            "url": "https://www.wp-masquerade.com/pt/glossario/autenticacao-de-dois-fatores/",
            "markdown": "https://www.wp-masquerade.com/pt/glossario/autenticacao-de-dois-fatores/index.md",
            "json": "https://www.wp-masquerade.com/pt/glossario/autenticacao-de-dois-fatores/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Tweefactorauthenticatie (2FA)",
            "url": "https://www.wp-masquerade.com/nl/woordenlijst/tweefactorauthenticatie/",
            "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/tweefactorauthenticatie/index.md",
            "json": "https://www.wp-masquerade.com/nl/woordenlijst/tweefactorauthenticatie/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Two-factor authentication (2FA)"
        },
        {
            "level": 2,
            "text": "The three types of factors"
        },
        {
            "level": 2,
            "text": "How a TOTP code works"
        },
        {
            "level": 2,
            "text": "Methods, from weakest to strongest"
        },
        {
            "level": 2,
            "text": "For WordPress"
        },
        {
            "level": 2,
            "text": "Common mistakes"
        }
    ],
    "body": "It is also called two-step verification or, more broadly, multi-factor authentication (MFA). The idea is to stop betting everything on a secret that can be guessed, reused or stolen. Even if the password falls into the wrong hands, the attacker is stopped at the second step, which requires an object or a trait they don't have.\n\n## The three types of factors\n\nNIST's digital identity guidelines (SP 800-63B), like most security guidance, use the usual classification:\n\n- **Something you know** (knowledge): password, passphrase, PIN.\n- **Something you have** (possession): a phone with an app that generates codes, a security key, a smart card, a passkey.\n- **Something you are** (inherence): fingerprint, face.\n\nFor there to really be two factors, they must come from two different types. A password followed by a security question is still single-factor authentication, since both rely on knowledge.\n\n## How a TOTP code works\n\nThe most common method on websites relies on the TOTP algorithm, standardized in RFC 6238. During setup, the site and the phone app share a secret, usually transmitted through a QR code. Afterward, each one computes a code on its own from that secret and the current time, in 30-second steps by default. The site doesn't need to contact the phone: if both computations match, the person really holds the secret.\n\n![Five-step login with a TOTP code: the user enters their password, the site verifies it and then asks for a code, the phone app computes the code from a shared secret and the time, the user types in the code valid for 30 seconds, and the site computes the expected code before opening the session](https://www.wp-masquerade.com/media/2026/10/double-authentification-totp-en.webp)\n\n*The site never sends the code: the phone and the server each compute it on their own.*\n\n*Video: “What is Two-Factor Authentication? (2FA)” (Duo Security)*\n\n## Methods, from weakest to strongest\n\n- **Code by text message or email**: better than nothing, but only as secure as the phone line or the inbox. NIST classifies SMS codes as a “restricted” authenticator because of these risks.\n- **TOTP app** (Google Authenticator, Microsoft Authenticator, Aegis, 2FAS…): works offline, with no dependence on the carrier.\n- **Security keys and passkeys** (WebAuthn): tied to the site's domain name, they resist [phishing](https://www.wp-masquerade.com/glossary/phishing/) far better, whereas a TOTP code can be typed into a fake site.\n\nAlways plan a fallback: single-use recovery codes, kept somewhere other than the phone.\n\n## For WordPress\n\nWordPress doesn't include two-factor authentication: its documentation recommends adding it through a plugin or an identity provider, at least for administrators. It is the most effective defense against [brute-force attacks](https://www.wp-masquerade.com/glossary/brute-force-attack/) and [credential stuffing](https://www.wp-masquerade.com/glossary/credential-stuffing/). A few things to check:\n\n- make it mandatory by role, not just optional;\n- cover the other entry points too: since WordPress 5.6, application passwords are used by tools that connect to the REST API or [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/); a protected account shouldn't accept its main password there;\n- keep the plugin up to date: a vulnerability can bypass the second step, as the [Really Simple Security case](https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/) showed.\n\n[WP Masquerade Pro's two-factor authentication](https://www.wp-masquerade.com/features/two-factor-authentication/) uses TOTP codes generated on your own site, with no external service, ten backup codes, enforcement by role and restriction of XML-RPC and REST API logins to application passwords for protected accounts. Our guide to [TOTP, backup codes and passkeys](https://www.wp-masquerade.com/wordpress-two-factor-authentication/) compares the options in detail.\n\n## Common mistakes\n\n- Losing your phone without having saved your backup codes.\n- Letting the phone's clock drift: TOTP codes are then rejected.\n- Believing two-factor authentication protects a session that is already open: it stops neither an XSS flaw nor the theft of a session cookie.\n\n## Related terms\n\n- [Brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/)\n- [Credential stuffing](https://www.wp-masquerade.com/glossary/credential-stuffing/)\n- [Phishing](https://www.wp-masquerade.com/glossary/phishing/)\n- [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/)\n- [bcrypt hashing](https://www.wp-masquerade.com/glossary/bcrypt/)\n\n\n## Sources\n\n- [NCSC: Multi-factor authentication for your corporate online services](https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services)\n- [RFC 6238: TOTP, Time-Based One-Time Password Algorithm](https://www.rfc-editor.org/rfc/rfc6238)\n- [WordPress Advanced Administration: Brute Force Attacks](https://developer.wordpress.org/advanced-administration/security/brute-force/)\n- [WordPress REST API Handbook: Authentication](https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/)",
    "definition": "Two-factor authentication (2FA) adds a second proof of identity to the password at login: a temporary code generated by an app, a security key or a notification on a trusted device. A stolen or guessed password is then no longer enough to get into the account.",
    "group": "Web security",
    "aka": [
        "2FA",
        "two-step verification",
        "multi-factor authentication",
        "MFA",
        "TOTP"
    ],
    "related": [
        {
            "title": "Brute-force attack",
            "url": "https://www.wp-masquerade.com/glossary/brute-force-attack/",
            "markdown": "https://www.wp-masquerade.com/glossary/brute-force-attack/index.md"
        },
        {
            "title": "Credential stuffing",
            "url": "https://www.wp-masquerade.com/glossary/credential-stuffing/",
            "markdown": "https://www.wp-masquerade.com/glossary/credential-stuffing/index.md"
        },
        {
            "title": "Phishing",
            "url": "https://www.wp-masquerade.com/glossary/phishing/",
            "markdown": "https://www.wp-masquerade.com/glossary/phishing/index.md"
        },
        {
            "title": "XML-RPC",
            "url": "https://www.wp-masquerade.com/glossary/xml-rpc/",
            "markdown": "https://www.wp-masquerade.com/glossary/xml-rpc/index.md"
        },
        {
            "title": "bcrypt hashing",
            "url": "https://www.wp-masquerade.com/glossary/bcrypt/",
            "markdown": "https://www.wp-masquerade.com/glossary/bcrypt/index.md"
        }
    ],
    "sources": [
        {
            "title": "NCSC: Multi-factor authentication for your corporate online services",
            "url": "https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services"
        },
        {
            "title": "RFC 6238: TOTP, Time-Based One-Time Password Algorithm",
            "url": "https://www.rfc-editor.org/rfc/rfc6238"
        },
        {
            "title": "WordPress Advanced Administration: Brute Force Attacks",
            "url": "https://developer.wordpress.org/advanced-administration/security/brute-force/"
        },
        {
            "title": "WordPress REST API Handbook: Authentication",
            "url": "https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/"
        }
    ],
    "format": "application/json"
}