WordPress Login Security and Two-Factor Plugins
Every control in this article exists because of one gap: a firewall cannot tell an attacker with your password from you. Virtual patching, malware scanning, and vulnerability monitoring all address flaws in code. An intruder logging in with valid credentials is exploiting nothing, and nothing in your security stack objects.
The good news is that the fixes here are cheap, and one of them, passkeys, is genuinely different from everything that preceded it rather than incrementally better. As of 2026 WordPress still has no native passkey login in core, so this remains plugin territory, and knowing which plugin puts it in which tier is most of the purchasing decision.
Verified August 2026. Prices confirmed against vendor pages.
Two-factor methods, ranked honestly
Passkeys and hardware keys, using WebAuthn and FIDO2, are the strongest available method and the only one that is phishing-resistant by design. Rather than a shared secret, the browser stores a cryptographic key unlocked by a fingerprint, face, or device PIN. The key never leaves the device and is bound to your specific domain, so a convincing fake login page captures nothing reusable. That property is what makes this a different category rather than a better version of the same idea.
Authenticator apps generating time-based codes are the sensible default: free, offline, widely understood, and effective against every automated attack. Their weakness is that a user can be persuaded to read a code to somebody, which is exactly what passkeys prevent.
Email codes are weaker but far better than nothing, and their real advantage is that they need no setup from the user, which matters on a site with contributors who will not install anything. SMS is the weakest common method, vulnerable to number takeover, and still worth enabling if the alternative is no second factor at all. The ranking matters less than the adoption: a mediocre method everyone uses beats an excellent one two people configured.
The 6 options compared
1. Two Factor plus WebAuthn Provider
The free route to the strongest method, and the one most people do not know exists. Two Factor is the minimal, community-maintained plugin, actively developed with version 0.16.0 released in March 2026, and the companion Two-Factor Provider: WebAuthn plugin adds passkeys, WebAuthn and FIDO2 hardware keys to it.
Two plugins, no licence, and you have phishing-resistant authentication on a WordPress site. That is a better security outcome than most paid tiers in this comparison deliver, because it is the method rather than the packaging that determines the protection. The trade is that Two Factor is deliberately minimal: no enforcement policies across user roles, no reporting, no onboarding flow for staff, and no support beyond the forums. For a solo site owner or a small technical team, none of that matters and this is the answer.
- Price: Free, both plugins
- Passkeys: Yes, via the WebAuthn provider plugin
- Best for: Individuals and small technical teams
- Watch out for: No role policies, enforcement, or support
2. WP 2FA by Melapress
The best option where you must roll two-factor out to people who did not ask for it. The free tier is genuinely usable, covering authenticator app codes, email codes, backup codes, front-end configuration so users never see the dashboard, and a REST API.
Front-end configuration is the underrated feature there: asking a contributor to set up two-factor from a page that looks like your site, rather than from wp-admin, measurably improves completion. Passkeys are Premium only, alongside YubiKey support, SMS codes, email login links, multiple passkeys per user, and WooCommerce customer 2FA, with tiers by site count from single site upwards. If your requirement is enforcement across roles with a deadline and a grace period, this is the product built for that job, and the free tier is a reasonable place to start before paying for passkeys.
- Price: Free tier; Premium by site count, confirm current tiers
- Passkeys: Premium only, with multiple passkeys per user
- Best for: Rolling 2FA out to non-technical users
- Watch out for: The strongest method sits behind the paywall
3. Wordfence Login Security
A free standalone plugin providing two-factor authentication and reCAPTCHA on login, extracted from the main Wordfence product so you can run it without the whole firewall. For a site that already has security handled elsewhere, this is a clean single-purpose addition.
Within the full Wordfence Premium at $149 a year per site, login protection sits alongside real-time firewall rules and a continuously updated IP blocklist covering more than 40,000 known threat actors, which is directly relevant here: credential-stuffing traffic largely originates from infrastructure that is already known and already blocked. Remember that free Wordfence receives new rules and signatures 30 days after Premium, which matters less for login security than for virtual patching, since brute-force protection does not depend on fresh vulnerability intelligence.
- Price: Free standalone; Wordfence Premium $149/yr per site
- Passkeys: No; app codes and recovery codes
- Best for: Sites already running Wordfence
- Watch out for: No passkey support at any tier
4. Limit Login Attempts Reloaded
Free, tiny, and the single highest-value thing you can install if you currently have nothing. It caps failed login attempts from an address and locks it out, which stops automated brute-force attacks outright.
It is worth being precise about what this does and does not do. It defeats brute force, meaning thousands of guesses against one account, completely. It does much less against credential stuffing, where an attacker tries one correct password per account from a breach dump, because that pattern does not generate failed attempts in bulk. So install it, because it costs nothing and removes the noisiest attack class from your logs, and do not treat it as a substitute for a second factor. The two solve different problems and belong together.
- Price: Free
- Passkeys: Not applicable; this is rate limiting
- Best for: Every site, as a first five-minute measure
- Watch out for: Does little against credential stuffing
5. miniOrange 2FA
The broadest method support in the category, covering an unusually long list of authentication types including hardware tokens, push notifications, and enterprise identity integrations that the WordPress-native plugins do not attempt.
Its natural buyer is an organisation with an existing identity policy: a company standardised on a particular authenticator, a client whose IT department mandates specific methods, or a site that needs to slot into single sign-on. In that context, breadth is the requirement and the alternatives simply do not reach. For a small site it is more product than the situation needs, and the pricing model, with functionality distributed across plans and add-ons, rewards reading carefully before purchase. Confirm which methods sit in which plan against your actual requirement rather than the feature list.
- Price: Free tier plus paid plans; confirm current structure
- Passkeys: Available, alongside many other methods
- Best for: Organisations with an existing identity policy
- Watch out for: Feature distribution across plans needs checking
6. Fewer administrators
Free, and more effective than any plugin here. Every administrator account is a full compromise waiting for one bad password, and most WordPress sites have several that nobody has looked at in two years.
Open your users list. The developer who built the site in 2021, the marketing agency you stopped working with, the plugin support person you granted access to for one afternoon, the account named “admin” that somebody created as a spare. Delete or demote every one of them. Then check the roles of the people who remain: a writer needs Author, not Administrator, and the difference is whether a stolen password costs you a spam post or your entire site. This takes fifteen minutes, costs nothing, and reduces the number of doors more reliably than improving the locks on all of them.
- Price: Free
- Passkeys: Not applicable; this reduces what needs protecting
- Best for: Every site, before buying anything
- Watch out for: Check for accounts created by plugins and integrations
Comparison table
| Option | Price | Passkeys | App codes | Role enforcement |
|---|---|---|---|---|
| Two Factor plus WebAuthn | Free | Yes, free | Yes | Minimal |
| WP 2FA | Free tier; Premium paid | Premium only | Yes, free | Yes, with grace periods |
| Wordfence Login Security | Free; Premium $149/yr | No | Yes | Yes |
| Limit Login Attempts Reloaded | Free | Not applicable | No | Not applicable |
| miniOrange 2FA | Free tier plus paid | Yes | Yes | Yes |
| Fewer administrators | Free | Not applicable | Not applicable | The point |
XML-RPC, the REST API, and sensible hardening
Two endpoints attract more confident bad advice than anything else in WordPress security, so it is worth being specific about both.
XML-RPC deserves its reputation, because it historically allowed many authentication attempts to be bundled into a single request, turning a rate limit into a formality. If nothing you use depends on it, and for most modern sites nothing does, disable it. Check first for the Jetpack connection, the WordPress mobile apps, and any remote publishing tool, since those are the things that break.
The REST API is different and should not be disabled. The block editor uses it, and so does a great deal of ordinary plugin functionality; switching it off produces a site that fails in confusing ways. The legitimate concern is the specific endpoint that enumerates usernames, which hands an attacker half of every credential. Restrict that rather than the API.
- Block user enumeration through both the REST API and author archive URLs, which leak the same information in a different format.
- Do not use the same string for username and display name. If your posts are bylined with your login, you have published half your credentials.
- Rename or protect the login URL if you like, understanding it is obscurity rather than security. It reduces automated noise considerably and stops nobody who is looking.
- Use unique passwords, generated and stored in a manager. Credential stuffing works entirely because passwords are reused, and this single habit defeats it more completely than any plugin.
Related guides
Frequently asked questions
Does WordPress support passkeys natively?
Not as of 2026. Core has not shipped passkey login, so it remains plugin territory, and the free Two Factor plus WebAuthn Provider combination is the cheapest route to it.
Should I force two-factor on all users?
On anyone who can publish or change settings, yes. Subscribers on a membership site are a judgement call, weighing account value against the friction and the support requests that follow.
What happens when someone loses their phone?
Backup codes, generated at setup and stored somewhere other than the phone. Decide the recovery process before you enforce two-factor, because the alternative is you editing the database on a Sunday.
Are passkeys worth the upgrade cost?
If phishing is a realistic threat, yes, because they are the only method that structurally defeats it. If your risk is automated attacks, app codes handle those and the free option is sufficient.
Is limiting login attempts enough on its own?
No. It defeats brute force and does little against credential stuffing, where each attempt uses a password that was correct somewhere else. Rate limiting and a second factor address different attacks.
Does renaming the login page help?
It reduces automated traffic noticeably and provides no protection against anyone targeting you specifically. Do it if the log noise bothers you, and do not count it as a control.
The verdict
For the strongest protection at no cost: Two Factor plus the WebAuthn Provider plugin. Passkeys are phishing-resistant by design, and this combination puts them on a WordPress site for free.
If you must roll two-factor out to other people: WP 2FA, whose free tier covers app codes, email codes and front-end setup, with passkeys in Premium if you need them.
If you already run Wordfence: its Login Security features are there, and Premium at $149 a year adds an IP blocklist covering the infrastructure most credential attacks come from.
Then do the two free things today. Install Limit Login Attempts Reloaded, and open your users list and delete every administrator who should not be one. Fifteen minutes, no money, and fewer doors to defend.
