Two-Factor Authentication (2FA)

What is Two-Factor Authentication?

2FA means that to log in you need TWO things:

Something you know: Your password
Something you have: A unique 6-digit code that changes every 30 seconds

The code comes from your phone via an app like Google Authenticator or through SMS. Even if someone steals your password, they can't log in without the code from your phone.

Effect: If your password leaks, your account stays secure because the attacker doesn't have your phone.

Available 2FA Methods

1. App Authenticator (TOTP - Recommended)

Uses an app on your phone (Google Authenticator, Microsoft Authenticator, Authy) that generates codes without an internet connection.

Advantages: Doesn't depend on SMS, always works, new codes every 30s

Disadvantages: Requires access to the app on your phone

2. Email Code

Receive a temporary code directly at the email address registered on your WordPress account, without needing to install any app.

Advantages: Requires no installation, works on any device with access to your email.

Requires PRO: Email code is a SeenSecure PRO license feature. On the FREE plan, the authenticator app (TOTP) method still works normally; only the email alternative is disabled.

Disadvantages: Depends on your email account remaining secure — if the email is also compromised, this layer alone loses some of its value. That's why dual verification exists (see below).

3. Dual Verification (App + Email Together)

This isn't a third independent method, but a policy the administrator can enable: it requires passing both factors — the app code and the email code — on the same login attempt, instead of accepting either one on its own.

When it makes sense: for very high-value accounts (the site's main administrator) where the extra step is worth it in exchange for an attacker needing to compromise two completely different channels — your phone and your email — instead of just one.

Method	Security	Convenience	Recommendation
App Authenticator	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	Best option
Email Code	⭐⭐⭐	⭐⭐⭐⭐⭐	App-free alternative
Dual (App + Email)	⭐⭐⭐⭐⭐⭐	⭐⭐	Critical accounts

Why Isn't a Password Alone Enough?

What this protection is for: your WordPress password can be perfectly strong and still not depend only on you for it to leak. Every week, some online service suffers a security breach (a shop, a forum, an app) and its user database — emails and passwords, sometimes encrypted, sometimes not — ends up circulating on dark web forums. If you've ever used the same password (or a very similar one) on two different sites, a breach on one of them puts the other at risk, even if that other site was never attacked directly.

Why an attacker attempts it: this is known as credential stuffing. Attackers don't need to guess your password or brute-force it — they already have it, leaked from another site — so they automate a script that tries millions of email+password combinations pulled from known breaches against thousands of different sites (yours included) until it finds where reuse works. It's cheap, requires no advanced skills, and works precisely because password reuse is so common.

Real example: a user signed up years ago on some random online shop with their personal email and a password they also use for their WordPress admin account. That shop suffers a breach and the email+password list leaks. Months later, a credential stuffing script tries that same combination against the user's WordPress login screen — and the password is correct, because they never changed it or varied it between sites. Without 2FA, the attacker would walk straight in as administrator. With 2FA enabled, after the correct password a second screen appears asking for the authenticator app code: the attacker doesn't have the user's phone, so access stops right there.

How 2FA stops it: the second factor doesn't live in any database that could leak alongside your password — it lives on your physical phone, as a secret only your authenticator app knows, which generates a new code every 30 seconds by combining that secret with the current time. An attacker who only has your email and password leaked from another site has no way to produce that code: knowing the correct password isn't enough, you need to physically possess the second factor at the exact moment of the login attempt. That's why 2FA neutralizes credential stuffing even when the stolen password is 100% correct.

Phishing: fake emails mimicking WordPress or another service trick the user into typing their password on a fake page — 2FA still protects unless the attacker also gets the real-time code.
Spyware/keyloggers: malware that records keystrokes captures the password, but not the code that changes every 30 seconds on your phone.
Administrator accounts: the WordPress admin account controls the entire site — users, content, plugins — so it deserves the same level of protection as a bank account.

Industry data: According to Microsoft, enabling 2FA blocks more than 99% of automated account-takeover attacks. It's one of the best effort-to-benefit defenses that exist.

How to Configure 2FA

For Administrators

Go to SeenSecure > Login Security > 🔑 2FA tab
If it's your first time, activate 2FA on your own account with the "Activate 2FA on my account" button —this is required before you can configure the policy for other users— (steps below)
Once your own 2FA is active, the "Global Policy Configuration" section appears: check "2FA Mandatory for everyone" or, to scope it down, select specific roles (e.g. only Administrator) under "Roles that require 2FA"
Decide whether to allow "Email Code" as an app alternative —requires a PRO license— and whether to require "Dual Verification (Email + App)" for the most sensitive accounts
Optionally set an "Activation deadline"
Click "Save Global Policy"

Personal Configuration (Admin User)

Go to SeenSecure > Login Security > 🔑 2FA tab
Click "Activate 2FA on my account"
A QR code appears: scan it with Google Authenticator (or any other TOTP app)
If you can't scan the QR code, manually enter the alphanumeric key shown below it
Enter the 6-digit code the app generates and click "Verify and Activate"
Save the recovery codes shown on screen —they're also emailed to you—

Important: All 2FA configuration (activating it, viewing the QR code, global policies) is managed from SeenSecure > Login Security, a page only administrator accounts can open. If a non-admin user needs to activate their 2FA, an administrator has to guide them or check their status from the user list on that same tab.

Critical: Save the backup codes. If you lose access to your phone, you'll need one of these to log in.

For Other Users

If you require 2FA, your users will see a screen when trying to log in:

Enter your password normally
A screen appears asking for the 2FA code
Open the Authenticator app on your phone
Copy the 6 digits
Paste on screen and press Enter
Access granted

Guide for End Users

What Do I Need?

A smartphone (Android or iPhone)
An authenticator app (download it for free)

Recommended Apps

Google Authenticator (free, easy)
Microsoft Authenticator (free, very good)
Authy (free, premium, sync across devices)
LastPass Authenticator (if you use LastPass)

What Happens If I Lose My Phone?

Use a backup code you saved
Log in to your account
Set up 2FA again with your new phone

What Happens If I Don't Have Access to Backup Codes?

Contact the site administrator. They can disable 2FA on your account (after verifying your identity).

Note: The first login with 2FA is a bit slower (5 extra seconds). After that it's normal.

Best Practices

Enable 2FA on ALL your admin accounts
Save backup codes in a safe, offline place
If you require 2FA, give users time to activate it (not instantly)
Document the process for users who don't understand it
Test your 2FA: log out and log back in to confirm it works

Bottom Line: With 2FA enabled, your WordPress has enterprise-level defense. It's the smallest security investment with the biggest impact.