Two-factor authentication (2FA) adds a second step at login, so a stolen password is not enough.
- In your WordPress dashboard, go to Plugins > Add New and install a 2FA plugin such as Two-Factor, WP 2FA, or Wordfence Login Security.
- Activate it, then open your user profile or the plugin settings to set up 2FA.
- Scan the QR code with an authenticator app like Google Authenticator or Authy, enter the verification code, and save.
Save your backup/recovery codes somewhere safe in case you lose your phone. Apply 2FA to all admin accounts for the best protection. If you ever get locked out, you can deactivate the plugin by renaming its folder in cPanel File Manager, or open a ticket.
