Set up two-factor sign-in and passkeys
Turn on two-factor sign-in with an authenticator app and backup codes, add passkeys, require them by role, and help a user who lost their device.
Two-factor sign-in (two-factor authentication, or 2FA, sometimes called MFA) asks for a six-digit code from an authenticator app after the password. A passkey signs you in with your fingerprint, face or device PIN. Administrators manage both on BetterShield › Protect › Two-Factor; everyone else uses their own profile screen.
The summary at the top
Three tiles show Your two-factor (Off until you set it up), Two-factor required for and Passkey-only sign-in for (both no roles by default).
Your sign-in: two-factor
The Two-factor authentication card:
- Press Set up two-factor.
- Open any authenticator app that makes six-digit codes, such as 1Password, Google Authenticator, Microsoft Authenticator, Authy or Bitwarden. Scan the QR code, or type the Manual entry key.
- Enter the code the app shows and press Confirm code.
- Store the ten backup codes (Copy codes or Download as a file). They are shown only once, and each works once.
- Press the I have stored these codes button to turn two-factor on.
Nothing changes at sign-in until step 5. Cancel at step 3 discards the setup.
Once it is on, the card shows how many backup codes are unused. Under New backup codes, enter an App code or backup code and press Issue new codes; the new set replaces every old code. Under Turn off, enter a current code and press Turn two-factor off. Application passwords for connected tools keep working.
Your sign-in: passkeys
On the Passkeys card, type Name this device, press Add a passkey, and confirm on your device. A passkey is an extra way in: your password, codes and recovery link keep working. Each account can hold 10. Passkeys need HTTPS; without it, the card says why. Each passkey shows when it was last used, and Remove deletes it after you confirm.
Once any account has a passkey, the WordPress sign-in page (wp-login.php) shows Sign in with a passkey. A passkey unlocked with a fingerprint, face or PIN counts as both factors. One that only asks for a touch still needs the app code on a two-factor account, and is not accepted on its own.
What the site requires
| Option | What it does | Why it matters | Default |
|---|---|---|---|
| Require two-factor of a role | Accounts in the ticked roles are asked to set up two-factor, with a countdown on every dashboard page. After the grace period, the dashboard sends them to set it up until they do. | Sign-in is never blocked: it is enforced in the dashboard, after the password, and safe mode stands it down. | No roles |
| Grace period, in days | 0 to 90, counted from when an account first met the requirement. Zero asks immediately. | Existing accounts get the full window. | 14 |
| Sign in with a passkey only | For ticked roles, an account’s password stops signing it in once it has added a passkey. A line per role shows how many have one. | A password that cannot sign anyone in cannot be phished, guessed or reused from a breach. | No roles |
Press Save requirement under each. Adding a role to Require two-factor of a role first checks your recovery link or printed recovery codes, as a sign-in hardening fix does.
Passkey-only sign-in has these safeguards:
- Nobody is refused until they hold a passkey. Others keep their password and are asked on their dashboard.
- Adding a role is refused unless the site has a working recovery link or printed recovery codes (Protect › Recovery), and unless passkeys work on the site.
- A refused password gets a message pointing to the passkey button. XML-RPC needs an application password instead.
- If the passkey is lost, the recovery link, a printed recovery code, or removing the last passkey brings password sign-in back.
On a WooCommerce store, customers set up both on My Account › Sign-in security. A role WooCommerce keeps out of the dashboard is not asked by Require two-factor of a role, but can still set it up there.
Set up from your profile
Anyone signed in can use their own Profile screen:
- Two-factor sign-in: Set up two-factor, scan the code or type the key, enter the Code from the app, press Confirm code, store the ten codes, then press the I have stored these codes button. Later, Issue new backup codes asks for a current code first.
- Passkeys: Name this device, then Add a passkey.
Signing in
After the password, the Authentication code screen takes the app’s current code or an unused backup code. After ten wrong codes in an hour, codes for that account are not checked for a while.
When someone loses their device
- They sign in with a backup code, then issue a new set.
- If the codes are gone too, an administrator opens Users, edits the account, and under Two-factor sign-in presses Turn off two-factor for this account. The person signs in with their password and sets it up again.
- For a passkey-only account, an administrator can untick its role under Sign in with a passkey only, which brings password sign-in back for that role. A role the network requires cannot be unticked on one site.
If you are locked out yourself, use your recovery link.
Multisite
On BetterShield › Network, Require two-factor across the network (with its own Grace period, in days) and Passkey-only roles across the network set a floor for every site. A site can add roles but not remove the network’s, and the shorter grace period applies. Adding a passkey-only role needs a working recovery link or printed codes on every site. Both start Not set.