Protecting your WordPress login with CAPTCHA and two-step verification takes less than ten minutes, and once set up you’ll barely notice it in daily use. This guide is written for anyone who has never done this before: it covers everything from deciding which combination suits you to what to do if a user loses access to their second factor.
Before you start
You’ll need: SeenSecure active on your WordPress, administrator access to your panel, and (if you’re going to use the Authenticator method) a compatible app installed on the phone of each user who will use it — Google Authenticator, Microsoft Authenticator, or Authy all work, they’re free and download from your phone’s app store in under a minute.
Step 1 — Decide which combination your site needs
Before touching anything in the panel, decide on the level that makes sense for you. As a quick reference:
| Your situation | CAPTCHA | 2FA |
|---|---|---|
| Blog or site with few users | Invisible mode on login | Email, admin only |
| Online store with a team | Login, registration, and password recovery | Authenticator for admin and editor |
| Multi-user site or agency | All public-facing forms | Authenticator required for every role with wp-admin access |
Step 2 — Enable CAPTCHA in Login Security > CAPTCHA
From the SeenSecure panel, go to Login Security > CAPTCHA. There you choose one of the 7 available modes (visual, math, emoji, colors, Google reCAPTCHA v2, invisible reCAPTCHA v3, or hybrid) and which forms it applies to: login, registration, comments, and password recovery are enabled separately, so you don’t have to turn them all on if you don’t need to.
Step 3 — Go to Login Security > 2FA
On the 2FA tab you’ll see the main switch and the two available methods: Authenticator App and Email Code. You can enable one, the other, or both at once so each user can choose the one they prefer.
Step 4 — Decide your role-based policy
Before turning anything on, decide who you’re going to require it for. For most sites, it makes sense to start like this:
| Role | 2FA | Why |
|---|---|---|
| Administrator | Required, with Authenticator | Can install plugins, change any setting, or delete the site |
| Editor | Required, Authenticator or Email | Manages all published content |
| Author / Contributor | Optional, or Email | Lower risk, convenience is prioritized |
Step 5 — Enable the Authenticator method
Check “Enable Authenticator App” and save. The next time that user logs in, they’ll see a QR code on screen: they scan it with their phone’s app (the “+” button or “Scan QR code” inside the app), enter the 6-digit code it shows to confirm, and they’re linked for good — this step only happens once per user, it doesn’t need to be repeated on every login.
Step 6 — Enable Email as an alternative method
If you want to offer an app-free option, also check “Enable Email code.” The user will be able to choose, the first time they log in after activation, which method they prefer. The code arrives at the email address registered on their WordPress profile, valid for a few minutes.
Step 7 — Save and tell your team about the change
Save the configuration. From this point on, roles marked as required will see the extra step on their next login, and the public forms you marked will show the chosen CAPTCHA. Give your team a heads-up beforehand — a short message explaining what they’ll see and how to install the app avoids confusion and unnecessary questions.
What to do if a user loses access to their second factor
If someone switches phones or accidentally uninstalls the app, an administrator can reset that specific user’s 2FA from Login Security > Restricted Accounts, with no need to disable it for the whole site or touch the database by hand.
How to check everything is working
After enabling it, try logging in from an incognito window with a test user: you should first see the CAPTCHA (if you enabled it on login) and, after the correct password, the second-factor screen. If something doesn’t show up, check that the role for that user is marked as required in step 4.
Frequently asked questions
Can I try it with my own account before requiring it for anyone else?
Yes, that’s exactly what’s recommended — enable it first only on your admin account, confirm the whole flow works well with your specific setup, and then roll it out to the rest of the roles.
Do CAPTCHA or 2FA slow down day-to-day login?
A CAPTCHA in invisible mode is usually not noticeable at all; 2FA adds a few seconds the first time you log in from a device, nothing more — it’s not asked for on every click, only when signing in.
What happens if I disable any of these protections later?
You can disable each piece separately at any time from the same panel; users will simply stop seeing that extra step on their next login, without losing any other data from their account.
Do I have to enable CAPTCHA and 2FA at the same time, or can I start with just one?
You can enable them separately, in whichever order you prefer — many sites start with CAPTCHA alone, find it isn’t enough for higher-risk accounts, and add 2FA afterward for those specific roles.