Two Factor Authentication for WordPress


This passcode box appears after the user name and password screen with miniOrange 2-factor installed.

Hardening and securing WordPress websites is one of my specialties.  We have reported previously on three of the best WordPress security plugins, Sucuri, Bulletproof, and WordFence.  I can tell you that each of these plug-ins performed admirably against the continuous barrage of brute force and password reset attacks that my sites have endured.  Security appeared to be strong, but I wanted more.

I have been deploying two-factor authentication (TFA) everywhere I can, in order to overcome the inherent weakness of password only security.  The Dark Web is awash in stolen credentials, and I am sure mine are in the lists, too.  I have been using Google Authenticator primarily, and have been pretty happy with it.  Now, an attacker needs more than my password, they need my smartphone too, and if the attacker in in India or the Ukraine, that is not a likely scenario.

Could I add TFA to my WordPress site?  Something that worked with Authenticator, too?

I found miniOrange 2-Factor, by Krishna Murari Vijay, of miniOrange.  I set it up to work with Google Authenticator, but it can also provide two-factor via email verification, soft token, one time password (OTP) over SMS, QR code authentication via the miniOrange Authenticator smartphone app, Authy TFA, phone call verification, push notification to your phone, and security questions with knowledge based answers (KBA).  Somewhere in that extensive collection is a method that will work for you.

I have to say that it appears to be adding an extra layer of security, as my WordFence alerts for brute force and reset exploits has decreased considerably.  I am happy to give it a strong recommendation.  All of my WordPress clients will be getting miniOrange 2-Factor added to the WordFence security we already have in place.  If you own or manage a WordPress site, maybe you should add this too.


About the Author:

I am a cybersecurity and IT instructor, cybersecurity analyst, pen-tester, trainer, and speaker. I am an owner of the WyzCo Group Inc. In addition to consulting on security products and services, I also conduct security audits, compliance audits, vulnerability assessments and penetration tests. I also teach Cybersecurity Awareness Training classes. I work as an information technology and cybersecurity instructor for several training and certification organizations. I have worked in corporate, military, government, and workforce development training environments I am a frequent speaker at professional conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference in 2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. I have been blogging on cybersecurity since 2006 at

Add a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.