If someone gets hold of your WordPress password, two-factor authentication (2FA) is what stops them from getting in. It adds a second check at login, such as a code from your phone, a security key, or your fingerprint, so a stolen password alone is no longer enough.

Quick note before we start: this post is about self-hosted WordPress (WordPress.org), the version most business websites and WooCommerce stores run on. Here’s the catch: self-hosted WordPress doesn’t include 2FA out of the box. You have to add it yourself. There are two common ways to do that, and which one is right depends on who logs in to your site.

Option 1: Jetpack Secure Sign On (WordPress.com login)

If your site already runs Jetpack, you can turn on Secure Sign On. Users then log in to your WordPress.org site with their WordPress.com account, and you can require that those accounts use WordPress.com Two-Step Authentication. It’s quick to set up and costs nothing.

The problem: you now have two front doors

Turning on Secure Sign On doesn’t remove the regular WordPress login. Your site now has the “Log in with WordPress.com” button, which is protected by 2FA, and the standard username and password form, which is not. An attacker doesn’t care which door is locked. They’ll use the one that isn’t. Jetpack’s own documentation confirms this: unless you disable the default login form, users can still log in that way and skip two-step authentication.

Closing the back door in code

You can force every login through WordPress.com with 2FA by adding two Jetpack filters, either in a small custom plugin or in your child theme’s functions.php:

// Require WordPress.com Two-Step Authentication for Secure Sign On
add_filter( 'jetpack_sso_require_two_step', '__return_true' );

// Remove the default WordPress username/password form
add_filter( 'jetpack_remove_login_form', '__return_true' );

Test this in a private browser window before you log out. Make sure every admin has a WordPress.com account with 2FA turned on and connected to their site user. If you skip that step, you can lock yourself out.

When Jetpack’s approach makes sense, and when it doesn’t

Jetpack Secure Sign On is a good fit for sites where only your team logs in: brochure sites, service businesses, and blogs. It’s mostly not recommended for sites where customers or members log in, and especially not for WooCommerce stores.

On a WooCommerce store, your customers log in to check out, review orders, manage subscriptions, and save addresses. If you remove the standard login form, every customer would need a WordPress.com account just to buy from you. That’s not realistic, and it will hurt sales and flood your support inbox. If you leave the form in place, you’re back to having an unprotected back door.

Option 2: The WP 2FA plugin (recommended for stores)

For WooCommerce stores and any site where customers or members log in, we recommend WP 2FA by Melapress. It adds 2FA directly to the native WordPress login. That means there’s one login, protected the way you choose, and no second door to worry about.

Supported 2FA methods

• Authenticator app (TOTP): Google Authenticator, Authy, 1Password, Microsoft Authenticator, and others. (Free)
• Email codes: a one-time code sent to the user’s inbox. (Free)
• Backup codes: for when someone loses their phone. (Free)
• Passkeys: passwordless login with Face ID, Touch ID, Windows Hello, or a phone. (Premium)
• YubiKey hardware keys. (Premium)
• SMS codes: through Twilio or Clickatell. Carrier charges apply. (Premium)

Passkeys are the best option

If you can use them, passkeys are the way to go. A passkey is tied to a device and usually unlocked with biometrics, like your fingerprint or face. Users have no code to type and nothing an attacker can phish. Passkeys are both more secure and faster than typing a six-digit code.

If passkeys feel like too much for your team right now, a standard authenticator app is still a huge improvement over a password alone. SMS works too, but we’d treat it as a last resort, because text messages can be intercepted and phone numbers can be hijacked through SIM swapping.

Why it’s great for WooCommerce: role-based policies

This is where WP 2FA stands out. You decide which user roles must use 2FA. Administrators can be required to set it up immediately, Shop Managers can get a short grace period, and Customers can keep it optional. The accounts that can change your store, see customer data, or issue refunds get locked down, while your shoppers keep a simple checkout.

WP 2FA Premium also includes a one-click WooCommerce integration, so users can set up 2FA from the My Account page, plus trusted devices, 2FA on password resets, and usage reports showing who has and hasn’t enrolled.

Free or Premium? The free version lets you require 2FA sitewide using authenticator apps, email codes, and backup codes. Per-role policies, passkeys, SMS, and the WooCommerce integration need Premium, which starts at about $79 per year for a single site. For a store, Premium is well worth the cost.

The bottom line

Self-hosted WordPress doesn’t give you 2FA by default, and the easiest workaround can leave a back door open. If only your team logs in, Jetpack Secure Sign On with the default form removed works well. If customers log in, especially on a WooCommerce store, use WP 2FA with passkeys or an authenticator app, enforced for admins and shop managers.

Need help setting up 2FA on your site? Book a time with britecode and we’ll configure it, test it, and make sure nobody gets locked out.