Setting Up Two-Factor Authentication in AuthDock

Enable TOTP or email two-factor authentication on WordPress with AuthDock, enforce it per role, and issue backup codes.

Updated July 21, 2026 3 min readbeginner

On this page

You add two-factor authentication to WordPress with AuthDock by enabling 2FA in the plugin settings, choosing which roles it is enforced for, and letting each user enrol by scanning a QR code with any TOTP authenticator app — or by receiving six-digit email codes if they prefer no app. A stolen password on its own stops being enough to sign in.

Before you begin

AuthDock installed and configured — see the AuthDock setup guide
An authenticator app for TOTP (Google Authenticator, Authy, 1Password, Bitwarden, or any RFC 6238 app)

Enabling and enforcing 2FA

Turn on two-factor authentication

In AuthDock's settings, enable the 2FA module. Both methods — TOTP codes and six-digit email codes — can be offered side by side, so users pick what suits them.

Choose which roles must use it

Enforcement is per role. A common policy: require 2FA for administrators and editors, leave it optional for authors and subscribers. Users in an enforced role are prompted to enrol at their next login.

Set the grace period

Enforced users get a configurable grace period — three days by default — to enrol before 2FA becomes mandatory. Long enough to avoid a support avalanche, short enough to matter.

Enrol your own account

Open your profile, scan the QR code with your authenticator app, and confirm with a generated code. Enrolment issues ten single-use backup codes — store them somewhere that is not the site you are protecting.

Decide on trusted devices

Optionally allow users to remember a device for thirty days, so the second factor is asked once per device rather than every login. It trades a little assurance for a lot less friction.

How AuthDock stores and verifies codes

TOTP secrets are stored under AES-256-CBC encryption, verification is replay-protected, and a ±1 time-step drift tolerance means a slightly out-of-sync phone clock still works. Attempts are rate limited to five per session, so the 2FA prompt cannot itself be brute-forced.

2FA composes with every other login method: a user signing in through Google, GitHub, Facebook, X, or a magic link is still asked for their second factor before the session is issued, because all methods run through the same verification pipeline.

When someone loses their phone

Backup codes are the first answer — each of the ten codes works once. If those are gone too, an administrator can reset the user's 2FA enrolment from the dashboard, and the event lands in the audit log along with an optional notification to the user. For the case where the locked-out account is your own administrator account, read the lockout recovery guide before it happens.

Enable notifications for "2FA disabled" events. An attacker who gains admin access will switch 2FA off first, and that alert is your earliest signal.

Next steps

AuthDock

Hardened WordPress authentication — login protection, brute-force defence, and access control without a bloated security suite.

About AuthDock →Get AuthDock (Free)